infinitecampus-mcp 2.3.1 → 2.3.3

package/dist/bundle.js

@@ -3112,6 +3112,9 @@ var require_utils = __commonJS({
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
+    var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
+    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -3304,27 +3307,77 @@ var require_utils = __commonJS({
       }
       return output.join("");
     }
-    function normalizeComponentEncoding(component, esc2) {
-      const func = esc2 !== true ? escape : unescape;
-      if (component.scheme !== void 0) {
-        component.scheme = func(component.scheme);
-      }
-      if (component.userinfo !== void 0) {
-        component.userinfo = func(component.userinfo);
-      }
-      if (component.host !== void 0) {
-        component.host = func(component.host);
+    var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
+    var HOST_DELIM_RE = /[@/?#:]/g;
+    var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
+    function reescapeHostDelimiters(host, isIP) {
+      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+      re.lastIndex = 0;
+      return host.replace(re, (ch) => HOST_DELIMS[ch]);
+    }
+    function normalizePercentEncoding(input, decodeUnreserved = false) {
+      if (input.indexOf("%") === -1) {
+        return input;
       }
-      if (component.path !== void 0) {
-        component.path = func(component.path);
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decodeUnreserved && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        output += input[i];
       }
-      if (component.query !== void 0) {
-        component.query = func(component.query);
+      return output;
+    }
+    function normalizePathEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decoded !== "." && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isPathCharacter(input[i])) {
+          output += input[i];
+        } else {
+          output += escape(input[i]);
+        }
       }
-      if (component.fragment !== void 0) {
-        component.fragment = func(component.fragment);
+      return output;
+    }
+    function escapePreservingEscapes(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            output += "%" + hex3.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        output += escape(input[i]);
       }
-      return component;
+      return output;
     }
     function recomposeAuthority(component) {
       const uriTokens = [];
@@ -3339,7 +3392,7 @@ var require_utils = __commonJS({
           if (ipV6res.isIPV6 === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
-            host = component.host;
+            host = reescapeHostDelimiters(host, false);
           }
         }
         uriTokens.push(host);
@@ -3353,7 +3406,10 @@ var require_utils = __commonJS({
     module.exports = {
       nonSimpleDomain,
       recomposeAuthority,
-      normalizeComponentEncoding,
+      reescapeHostDelimiters,
+      normalizePercentEncoding,
+      normalizePathEncoding,
+      escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
       isUUID,
@@ -3577,12 +3633,12 @@ var require_schemes = __commonJS({
 var require_fast_uri = __commonJS({
   "node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     function normalize(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
-        serialize(parse3(uri, options), options);
+        normalizeString(uri, options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
         parse3(serialize(uri, options), options);
@@ -3649,19 +3705,9 @@ var require_fast_uri = __commonJS({
       return target;
     }
     function equal(uriA, uriB, options) {
-      if (typeof uriA === "string") {
-        uriA = unescape(uriA);
-        uriA = serialize(normalizeComponentEncoding(parse3(uriA, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriA === "object") {
-        uriA = serialize(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
-      }
-      if (typeof uriB === "string") {
-        uriB = unescape(uriB);
-        uriB = serialize(normalizeComponentEncoding(parse3(uriB, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriB === "object") {
-        uriB = serialize(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
-      }
-      return uriA.toLowerCase() === uriB.toLowerCase();
+      const normalizedA = normalizeComparableURI(uriA, options);
+      const normalizedB = normalizeComparableURI(uriB, options);
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
     }
     function serialize(cmpts, opts) {
       const component = {
@@ -3686,12 +3732,12 @@ var require_fast_uri = __commonJS({
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = escape(component.path);
+          component.path = escapePreservingEscapes(component.path);
           if (component.scheme !== void 0) {
             component.path = component.path.split("%3A").join(":");
           }
         } else {
-          component.path = unescape(component.path);
+          component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
@@ -3726,7 +3772,16 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
-    function parse3(uri, opts) {
+    function getParseError(parsed, matches) {
+      if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
+        return 'URI path must start with "/" when authority is present.';
+      }
+      if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) {
+        return "URI port is malformed.";
+      }
+      return void 0;
+    }
+    function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
         scheme: void 0,
@@ -3737,6 +3792,7 @@ var require_fast_uri = __commonJS({
         query: void 0,
         fragment: void 0
       };
+      let malformedAuthorityOrPort = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -3757,6 +3813,11 @@ var require_fast_uri = __commonJS({
         if (isNaN(parsed.port)) {
           parsed.port = matches[5];
         }
+        const parseError = getParseError(parsed, matches);
+        if (parseError !== void 0) {
+          parsed.error = parsed.error || parseError;
+          malformedAuthorityOrPort = true;
+        }
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
@@ -3795,14 +3856,18 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = unescape(parsed.host);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
             }
           }
           if (parsed.path) {
-            parsed.path = escape(unescape(parsed.path));
+            parsed.path = normalizePathEncoding(parsed.path);
           }
           if (parsed.fragment) {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            try {
+              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            } catch {
+              parsed.error = parsed.error || "URI malformed";
+            }
           }
         }
         if (schemeHandler && schemeHandler.parse) {
@@ -3811,7 +3876,29 @@ var require_fast_uri = __commonJS({
       } else {
         parsed.error = parsed.error || "URI can not be parsed.";
       }
-      return parsed;
+      return { parsed, malformedAuthorityOrPort };
+    }
+    function parse3(uri, opts) {
+      return parseWithStatus(uri, opts).parsed;
+    }
+    function normalizeString(uri, opts) {
+      return normalizeStringWithStatus(uri, opts).normalized;
+    }
+    function normalizeStringWithStatus(uri, opts) {
+      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      return {
+        normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
+        malformedAuthorityOrPort
+      };
+    }
+    function normalizeComparableURI(uri, opts) {
+      if (typeof uri === "string") {
+        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
+        return malformedAuthorityOrPort ? void 0 : normalized;
+      }
+      if (typeof uri === "object") {
+        return serialize(uri, opts);
+      }
     }
     var fastUri = {
       SCHEMES,
@@ -7308,14 +7395,14 @@ var require_permessage_deflate = __commonJS({
       }
     };
     module.exports = PerMessageDeflate2;
-    function deflateOnData(chunk) {
-      this[kBuffers].push(chunk);
-      this[kTotalLength] += chunk.length;
+    function deflateOnData(chunk2) {
+      this[kBuffers].push(chunk2);
+      this[kTotalLength] += chunk2.length;
     }
-    function inflateOnData(chunk) {
-      this[kTotalLength] += chunk.length;
+    function inflateOnData(chunk2) {
+      this[kTotalLength] += chunk2.length;
       if (this[kPerMessageDeflate]._maxPayload < 1 || this[kTotalLength] <= this[kPerMessageDeflate]._maxPayload) {
-        this[kBuffers].push(chunk);
+        this[kBuffers].push(chunk2);
         return;
       }
       this[kError] = new RangeError("Max payload size exceeded");
@@ -7615,7 +7702,7 @@ var require_receiver = __commonJS({
        * @param {Function} cb Callback
        * @private
        */
-      _write(chunk, encoding, cb) {
+      _write(chunk2, encoding, cb) {
         if (this._opcode === 8 && this._state == GET_INFO) return cb();
         if (this._maxBufferedChunks > 0 && this._buffers.length >= this._maxBufferedChunks) {
           cb(
@@ -7629,8 +7716,8 @@ var require_receiver = __commonJS({
           );
           return;
         }
-        this._bufferedBytes += chunk.length;
-        this._buffers.push(chunk);
+        this._bufferedBytes += chunk2.length;
+        this._buffers.push(chunk2);
         this.startLoop(cb);
       }
       /**
@@ -9904,8 +9991,8 @@ var require_websocket = __commonJS({
       this.removeListener("end", socketOnEnd);
       websocket._readyState = WebSocket2.CLOSING;
       if (!this._readableState.endEmitted && !websocket._closeFrameReceived && !websocket._receiver._writableState.errorEmitted && this._readableState.length !== 0) {
-        const chunk = this.read(this._readableState.length);
-        websocket._receiver.write(chunk);
+        const chunk2 = this.read(this._readableState.length);
+        websocket._receiver.write(chunk2);
       }
       websocket._receiver.end();
       this[kWebSocket] = void 0;
@@ -9917,8 +10004,8 @@ var require_websocket = __commonJS({
         websocket._receiver.on("finish", receiverOnFinish);
       }
     }
-    function socketOnData(chunk) {
-      if (!this[kWebSocket]._receiver.write(chunk)) {
+    function socketOnData(chunk2) {
+      if (!this[kWebSocket]._receiver.write(chunk2)) {
         this.pause();
       }
     }
@@ -10021,14 +10108,14 @@ var require_stream = __commonJS({
       duplex._read = function() {
         if (ws.isPaused) ws.resume();
       };
-      duplex._write = function(chunk, encoding, callback) {
+      duplex._write = function(chunk2, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
           ws.once("open", function open() {
-            duplex._write(chunk, encoding, callback);
+            duplex._write(chunk2, encoding, callback);
           });
           return;
         }
-        ws.send(chunk, callback);
+        ws.send(chunk2, callback);
       };
       duplex.on("end", duplexOnEnd);
       duplex.on("error", duplexOnError);
@@ -10255,10 +10342,10 @@ var require_websocket_server = __commonJS({
             process.nextTick(emitClose, this);
           }
         } else {
-          const server2 = this._server;
+          const server = this._server;
           this._removeListeners();
           this._removeListeners = this._server = null;
-          server2.close(() => {
+          server.close(() => {
             emitClose(this);
           });
         }
@@ -10443,17 +10530,17 @@ var require_websocket_server = __commonJS({
       }
     };
     module.exports = WebSocketServer2;
-    function addListeners(server2, map2) {
-      for (const event of Object.keys(map2)) server2.on(event, map2[event]);
+    function addListeners(server, map2) {
+      for (const event of Object.keys(map2)) server.on(event, map2[event]);
       return function removeListeners() {
         for (const event of Object.keys(map2)) {
-          server2.removeListener(event, map2[event]);
+          server.removeListener(event, map2[event]);
         }
       };
     }
-    function emitClose(server2) {
-      server2._state = CLOSED;
-      server2.emit("close");
+    function emitClose(server) {
+      server._state = CLOSED;
+      server.emit("close");
     }
     function socketOnError() {
       this.destroy();
@@ -10472,11 +10559,11 @@ var require_websocket_server = __commonJS({
 ` + Object.keys(headers).map((h) => `${h}: ${headers[h]}`).join("\r\n") + "\r\n\r\n" + message
       );
     }
-    function abortHandshakeOrEmitwsClientError(server2, req, socket, code, message, headers) {
-      if (server2.listenerCount("wsClientError")) {
+    function abortHandshakeOrEmitwsClientError(server, req, socket, code, message, headers) {
+      if (server.listenerCount("wsClientError")) {
         const err = new Error(message);
         Error.captureStackTrace(err, abortHandshakeOrEmitwsClientError);
-        server2.emit("wsClientError", err, socket, req);
+        server.emit("wsClientError", err, socket, req);
       } else {
         abortHandshake(socket, code, message, headers);
       }
@@ -32106,11 +32193,11 @@ var Protocol = class {
    *
    * The Protocol object assumes ownership of the Transport, replacing any callbacks that have already been set, and expects that it is the only user of the Transport instance going forward.
    */
-  async connect(transport2) {
+  async connect(transport) {
     if (this._transport) {
       throw new Error("Already connected to a transport. Call close() before connecting to a new transport, or use a separate Protocol instance per connection.");
     }
-    this._transport = transport2;
+    this._transport = transport;
     const _onclose = this.transport?.onclose;
     this._transport.onclose = () => {
       _onclose?.();
@@ -33700,8 +33787,8 @@ var McpServer = class {
    *
    * The `server` object assumes ownership of the Transport, replacing any callbacks that have already been set, and expects that it is the only user of the Transport instance going forward.
    */
-  async connect(transport2) {
-    return await this.server.connect(transport2);
+  async connect(transport) {
+    return await this.server.connect(transport);
   }
   /**
    * Closes the connection.
@@ -34464,8 +34551,8 @@ import process3 from "node:process";
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
 var ReadBuffer = class {
-  append(chunk) {
-    this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
+  append(chunk2) {
+    this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk2]) : chunk2;
   }
   readMessage() {
     if (!this._buffer) {
@@ -34497,8 +34584,8 @@ var StdioServerTransport = class {
     this._stdout = _stdout;
     this._readBuffer = new ReadBuffer();
     this._started = false;
-    this._ondata = (chunk) => {
-      this._readBuffer.append(chunk);
+    this._ondata = (chunk2) => {
+      this._readBuffer.append(chunk2);
       this.processReadBuffer();
     };
     this._onerror = (error51) => {
@@ -34551,6 +34638,150 @@ var StdioServerTransport = class {
   }
 };
 
+// node_modules/@chrischall/mcp-utils/dist/server/index.js
+async function createMcpServer(opts) {
+  const server = new McpServer({ name: opts.name, version: opts.version });
+  if (opts.banner !== void 0) {
+    console.error(opts.banner);
+  }
+  const deps = opts.deps;
+  for (const register of opts.tools) {
+    await register(server, deps);
+  }
+  return server;
+}
+function withGracefulShutdown(server, opts = {}) {
+  const shouldExit = opts.exit ?? true;
+  let shuttingDown = false;
+  const handler = (signal) => {
+    if (shuttingDown)
+      return;
+    shuttingDown = true;
+    void (async () => {
+      try {
+        if (opts.onSignal)
+          await opts.onSignal(signal);
+        await server.close();
+      } catch (err) {
+        console.error(`[mcp-utils] error during graceful shutdown on ${signal}: ${err instanceof Error ? err.message : String(err)}`);
+      } finally {
+        if (shouldExit)
+          process.exit(0);
+      }
+    })();
+  };
+  process.on("SIGINT", () => handler("SIGINT"));
+  process.on("SIGTERM", () => handler("SIGTERM"));
+}
+async function runMcp(opts) {
+  const server = await createMcpServer(opts);
+  const shutdown = opts.shutdown ?? true;
+  if (shutdown !== false) {
+    withGracefulShutdown(server, shutdown === true ? {} : shutdown);
+  }
+  const spec = opts.transport ?? "stdio";
+  const transport = spec === "stdio" ? new StdioServerTransport() : spec;
+  await server.connect(transport);
+  return server;
+}
+
+// node_modules/@chrischall/mcp-utils/dist/response/index.js
+function textResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
+
+// node_modules/@chrischall/mcp-utils/dist/config/index.js
+var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
+function readEnvVar(key, opts = {}) {
+  const env = opts.env ?? process.env;
+  const raw = env[key];
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
+      return trimmed;
+    }
+  }
+  return opts.default;
+}
+var TRUE_TOKENS = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+var FALSE_TOKENS = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
+function parseBoolEnv(key, opts = {}) {
+  const fallback = opts.default ?? false;
+  const raw = readEnvVar(key, { env: opts.env });
+  if (raw === void 0)
+    return fallback;
+  const token = raw.toLowerCase();
+  if (TRUE_TOKENS.has(token))
+    return true;
+  if (FALSE_TOKENS.has(token))
+    return false;
+  return fallback;
+}
+async function loadDotenvSafely(opts = {}) {
+  try {
+    const mod = await import(
+      /* @vite-ignore */
+      "dotenv"
+    );
+    const result = mod.config({
+      ...opts.path !== void 0 ? { path: opts.path } : {},
+      override: opts.override ?? false,
+      quiet: true
+    });
+    return result.error === void 0;
+  } catch {
+    return false;
+  }
+}
+
+// node_modules/@chrischall/mcp-utils/dist/http/index.js
+var MAX_AGE_ZERO_RE = /(?:^|;)\s*Max-Age\s*=\s*0\s*(?:;|$)/i;
+var EXPIRES_EPOCH_RE = /(?:^|;)\s*Expires\s*=\s*Thu,\s*01\s*Jan\s*1970/i;
+function parseCookieJar(setCookieHeaders) {
+  const entries = setCookieHeaders == null ? [] : Array.isArray(setCookieHeaders) ? setCookieHeaders : splitSetCookie(setCookieHeaders);
+  const jar = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (MAX_AGE_ZERO_RE.test(entry) || EXPIRES_EPOCH_RE.test(entry))
+      continue;
+    const nameValue = (entry.split(";")[0] ?? "").trim();
+    const eqIdx = nameValue.indexOf("=");
+    if (eqIdx < 1)
+      continue;
+    const name = nameValue.slice(0, eqIdx).trim();
+    const value = nameValue.slice(eqIdx + 1).trim();
+    if (!value)
+      continue;
+    jar.set(name, value);
+  }
+  const cookies = {};
+  for (const [k, v] of jar)
+    cookies[k] = v;
+  const cookieHeader = [...jar.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
+  return { cookies, cookieHeader };
+}
+function splitSetCookie(header) {
+  return header.split(/,(?=\s*[^;,\s]+\s*=)/).map((s) => s.trim()).filter((s) => s.length > 0);
+}
+
+// node_modules/@chrischall/mcp-utils/dist/zod/index.js
+var PositiveInt = external_exports.number().int().positive();
+var NonNegInt = external_exports.number().int().nonnegative();
+var NonEmptyString = external_exports.string().min(1);
+var IsoDate = external_exports.iso.date();
+var IsoTime = external_exports.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/, "must be HH:MM (24h), e.g. 19:30");
+var schemaOrigin = external_exports.string().optional().describe("Portal origin (e.g. https://<vendor>.example.co) selecting which active session to use. Optional when only one session is active.");
+var schemaConfirm = external_exports.boolean().optional().describe("Must be true to proceed. Without this, the tool returns a preview.");
+var paginationSchema = {
+  offset: NonNegInt.default(0).describe("Number of items to skip (0-based)."),
+  limit: external_exports.number().int().min(1).max(200).default(50).describe("Maximum number of items to return (1-200).")
+};
+var pageSchema = {
+  page_num: PositiveInt.default(1).describe("1-based page number."),
+  page_size: external_exports.number().int().min(1).max(200).default(50).describe("Number of items per page (1-200).")
+};
+
 // node_modules/@fetchproxy/protocol/dist/frames.js
 var PROTOCOL_VERSION = 2;
 var HKDF_SESSION_INFO = "fetchproxy/1.0.0/session";
@@ -34560,7 +34791,9 @@ var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "read_local_storage",
   "read_session_storage",
   "capture_request_header",
-  "read_indexed_db"
+  "capture_redirect",
+  "read_indexed_db",
+  "download"
 ]);
 
 // node_modules/@fetchproxy/protocol/dist/mcp-id.js
@@ -34707,6 +34940,16 @@ function assertScopeKeyArray(value, label) {
     seen.add(k);
   }
 }
+var CAPTURE_PATH_RE = /^\/[A-Za-z0-9._~%\-/]*\*?$/;
+function hostMatchesAnyDomain(host, domains) {
+  const h = host.toLowerCase();
+  for (const d of domains) {
+    const dom = d.toLowerCase();
+    if (h === dom || h.endsWith("." + dom))
+      return true;
+  }
+  return false;
+}
 function assertCaptureHeadersArray(value, label) {
   if (!Array.isArray(value)) {
     throw new ProtocolError(`${label}: expected array, got ${typeof value}`);
@@ -34715,14 +34958,25 @@ function assertCaptureHeadersArray(value, label) {
   for (let i = 0; i < value.length; i++) {
     const entry = value[i];
     assertObject(entry, `${label}[${i}]`);
-    if (entry.urlPattern === void 0) {
-      throw new ProtocolError(`${label}[${i}].urlPattern: missing`);
+    if (entry.host === void 0) {
+      throw new ProtocolError(`${label}[${i}].host: missing`);
     }
     if (entry.headerName === void 0) {
       throw new ProtocolError(`${label}[${i}].headerName: missing`);
     }
-    if (typeof entry.urlPattern !== "string") {
-      throw new ProtocolError(`${label}[${i}].urlPattern: expected string, got ${typeof entry.urlPattern}`);
+    if (typeof entry.host !== "string") {
+      throw new ProtocolError(`${label}[${i}].host: expected string, got ${typeof entry.host}`);
+    }
+    if (!HOSTNAME_RE.test(entry.host)) {
+      throw new ProtocolError(`${label}[${i}].host: invalid hostname ${JSON.stringify(entry.host)}`);
+    }
+    if (entry.path !== void 0) {
+      if (typeof entry.path !== "string") {
+        throw new ProtocolError(`${label}[${i}].path: expected string, got ${typeof entry.path}`);
+      }
+      if (!CAPTURE_PATH_RE.test(entry.path)) {
+        throw new ProtocolError(`${label}[${i}].path: must start with '/' ${JSON.stringify(entry.path)}`);
+      }
     }
     if (typeof entry.headerName !== "string") {
       throw new ProtocolError(`${label}[${i}].headerName: expected string, got ${typeof entry.headerName}`);
@@ -34730,19 +34984,29 @@ function assertCaptureHeadersArray(value, label) {
     if (!HEADER_NAME_RE.test(entry.headerName)) {
       throw new ProtocolError(`${label}[${i}].headerName: invalid name ${JSON.stringify(entry.headerName)}`);
     }
-    assertCaptureUrlPattern(entry.urlPattern, `${label}[${i}].urlPattern`);
-    const key = `${entry.urlPattern}\0${entry.headerName}`;
+    const normalizedPath = entry.path ?? "/*";
+    const key = `${entry.host}\0${normalizedPath}\0${entry.headerName}`;
     if (seen.has(key)) {
-      throw new ProtocolError(`${label}: duplicate ${JSON.stringify({ urlPattern: entry.urlPattern, headerName: entry.headerName })}`);
+      throw new ProtocolError(`${label}: duplicate ${JSON.stringify({ host: entry.host, path: normalizedPath, headerName: entry.headerName })}`);
     }
     seen.add(key);
     for (const k of Object.keys(entry)) {
-      if (k !== "urlPattern" && k !== "headerName") {
+      if (k !== "host" && k !== "path" && k !== "headerName") {
         throw new ProtocolError(`${label}[${i}]: unexpected field ${JSON.stringify(k)}`);
       }
     }
   }
 }
+function validateCaptureHeaderDecls(value, domains, label = "captureHeaders") {
+  assertCaptureHeadersArray(value, label);
+  const arr = value;
+  for (let i = 0; i < arr.length; i++) {
+    const host = arr[i].host;
+    if (!hostMatchesAnyDomain(host, domains)) {
+      throw new ProtocolError(`${label}[${i}].host: ${JSON.stringify(host)} is not a declared domain or subdomain of [${domains.join(", ")}]`);
+    }
+  }
+}
 function assertStoragePointersArray(value, label, declaredKeys) {
   if (!Array.isArray(value)) {
     throw new ProtocolError(`${label}: expected array, got ${typeof value}`);
@@ -34830,23 +35094,6 @@ function assertIndexedDbScopesArray(value, label) {
     }
   }
 }
-function assertCaptureUrlPattern(pattern, label) {
-  if (!pattern.startsWith("https://")) {
-    throw new ProtocolError(`${label}: must start with https:// (got ${JSON.stringify(pattern)})`);
-  }
-  const afterScheme = pattern.slice("https://".length);
-  const slash = afterScheme.indexOf("/");
-  const host = slash === -1 ? afterScheme : afterScheme.slice(0, slash);
-  if (host.length === 0) {
-    throw new ProtocolError(`${label}: missing host (got ${JSON.stringify(pattern)})`);
-  }
-  if (host.includes("*")) {
-    throw new ProtocolError(`${label}: wildcards not permitted in host (got ${JSON.stringify(pattern)})`);
-  }
-  if (!HOSTNAME_RE.test(host)) {
-    throw new ProtocolError(`${label}: invalid host ${JSON.stringify(host)} in ${JSON.stringify(pattern)}`);
-  }
-}
 function validateFrame(raw) {
   assertObject(raw, "frame");
   const t = raw.type;
@@ -34911,7 +35158,7 @@ function validateHello(raw) {
       assertScopeKeyArray(raw.sessionStorageKeys, "hello.sessionStorageKeys");
     }
     if (raw.captureHeaders !== void 0) {
-      assertCaptureHeadersArray(raw.captureHeaders, "hello.captureHeaders");
+      validateCaptureHeaderDecls(raw.captureHeaders, raw.domains, "hello.captureHeaders");
     }
     if (raw.indexedDbScopes !== void 0) {
       assertIndexedDbScopesArray(raw.indexedDbScopes, "hello.indexedDbScopes");
@@ -35079,24 +35326,58 @@ function validateInnerRequest(raw) {
   }
   if (raw.op === "capture_request_header") {
     assertObject(raw.init, "inner.init");
-    if (raw.init.urlPattern === void 0) {
-      throw new ProtocolError("inner.init.urlPattern: missing");
+    if (raw.init.host === void 0) {
+      throw new ProtocolError("inner.init.host: missing");
     }
     if (raw.init.headerName === void 0) {
       throw new ProtocolError("inner.init.headerName: missing");
     }
-    assertString(raw.init.urlPattern, "inner.init.urlPattern");
+    assertString(raw.init.host, "inner.init.host");
+    if (!HOSTNAME_RE.test(raw.init.host)) {
+      throw new ProtocolError(`inner.init.host: invalid hostname ${JSON.stringify(raw.init.host)}`);
+    }
+    if (raw.init.path !== void 0) {
+      assertString(raw.init.path, "inner.init.path");
+      if (!CAPTURE_PATH_RE.test(raw.init.path)) {
+        throw new ProtocolError(`inner.init.path: must start with '/' ${JSON.stringify(raw.init.path)}`);
+      }
+    }
     assertString(raw.init.headerName, "inner.init.headerName");
     if (raw.init.timeoutMs !== void 0) {
       assertPositiveInt(raw.init.timeoutMs, "inner.init.timeoutMs");
     }
     for (const k of Object.keys(raw.init)) {
-      if (k !== "urlPattern" && k !== "headerName" && k !== "timeoutMs") {
+      if (k !== "host" && k !== "path" && k !== "headerName" && k !== "timeoutMs") {
         throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on capture_request_header`);
       }
     }
     return raw;
   }
+  if (raw.op === "capture_redirect") {
+    assertObject(raw.init, "inner.init");
+    if (raw.init.host === void 0) {
+      throw new ProtocolError("inner.init.host: missing");
+    }
+    assertString(raw.init.host, "inner.init.host");
+    if (!HOSTNAME_RE.test(raw.init.host)) {
+      throw new ProtocolError(`inner.init.host: invalid hostname ${JSON.stringify(raw.init.host)}`);
+    }
+    if (raw.init.path !== void 0) {
+      assertString(raw.init.path, "inner.init.path");
+      if (!CAPTURE_PATH_RE.test(raw.init.path)) {
+        throw new ProtocolError(`inner.init.path: must start with '/' ${JSON.stringify(raw.init.path)}`);
+      }
+    }
+    if (raw.init.timeoutMs !== void 0) {
+      assertPositiveInt(raw.init.timeoutMs, "inner.init.timeoutMs");
+    }
+    for (const k of Object.keys(raw.init)) {
+      if (k !== "host" && k !== "path" && k !== "timeoutMs") {
+        throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on capture_redirect`);
+      }
+    }
+    return raw;
+  }
   if (raw.op === "read_indexed_db") {
     assertObject(raw.init, "inner.init");
     if (raw.init.origin === void 0)
@@ -35122,7 +35403,32 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
-  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "read_indexed_db"; got ${JSON.stringify(raw.op)}`);
+  if (raw.op === "download") {
+    assertObject(raw.init, "inner.init");
+    if (raw.init.url === void 0) {
+      throw new ProtocolError("inner.init.url: missing");
+    }
+    assertHttpUrl(raw.init.url, "inner.init.url");
+    if (raw.init.filename !== void 0) {
+      assertString(raw.init.filename, "inner.init.filename");
+      if (/^([/\\]|[A-Za-z]:)/.test(raw.init.filename)) {
+        throw new ProtocolError(`inner.init.filename: must be relative ${JSON.stringify(raw.init.filename)}`);
+      }
+      if (raw.init.filename.split(/[/\\]/).includes("..")) {
+        throw new ProtocolError(`inner.init.filename: must not contain '..' ${JSON.stringify(raw.init.filename)}`);
+      }
+    }
+    if (raw.init.timeoutMs !== void 0) {
+      assertPositiveInt(raw.init.timeoutMs, "inner.init.timeoutMs");
+    }
+    for (const k of Object.keys(raw.init)) {
+      if (k !== "url" && k !== "filename" && k !== "timeoutMs") {
+        throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on download`);
+      }
+    }
+    return raw;
+  }
+  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "download"; got ${JSON.stringify(raw.op)}`);
 }
 function assertNonEmptyKeyArray(value, label) {
   if (!Array.isArray(value)) {
@@ -35193,6 +35499,13 @@ function validateInnerResponse(raw) {
       assertString(raw.value, "inner.value");
       return raw;
     }
+    if (op === "capture_redirect") {
+      if (raw.value === void 0) {
+        throw new ProtocolError("inner.value: missing on capture_redirect response");
+      }
+      assertString(raw.value, "inner.value");
+      return raw;
+    }
     if (op === "read_indexed_db") {
       if (raw.values === void 0) {
         throw new ProtocolError("inner.values: missing on read_indexed_db response");
@@ -35200,6 +35513,25 @@ function validateInnerResponse(raw) {
       assertObject(raw.values, "inner.values");
       return raw;
     }
+    if (op === "download") {
+      assertObject(raw.value, "inner.value");
+      assertString(raw.value.path, "inner.value.path");
+      if (typeof raw.value.bytes !== "number" || !Number.isInteger(raw.value.bytes) || raw.value.bytes < 0) {
+        throw new ProtocolError("inner.value.bytes: expected non-negative integer");
+      }
+      if (raw.value.mime !== void 0) {
+        assertString(raw.value.mime, "inner.value.mime");
+      }
+      if (raw.value.finalUrl !== void 0) {
+        assertString(raw.value.finalUrl, "inner.value.finalUrl");
+      }
+      for (const k of Object.keys(raw.value)) {
+        if (k !== "path" && k !== "bytes" && k !== "mime" && k !== "finalUrl") {
+          throw new ProtocolError(`inner.value: unexpected field ${JSON.stringify(k)} on download response`);
+        }
+      }
+      return raw;
+    }
     throw new ProtocolError(`inner.op: unknown success-response op ${JSON.stringify(raw.op)}`);
   }
   if (raw.ok === false) {
@@ -35407,13 +35739,13 @@ async function openEncryptedFrame(sessionKey, frame) {
 // node_modules/@fetchproxy/server/dist/election.js
 import { createServer, Server as HttpServer } from "node:http";
 async function electRole(opts) {
-  const server2 = createServer();
+  const server = createServer();
   return new Promise((resolve, reject) => {
     const onError = (e) => {
-      server2.removeListener("listening", onListening);
+      server.removeListener("listening", onListening);
       if (e.code === "EADDRINUSE") {
         try {
-          server2.close();
+          server.close();
         } catch {
         }
         resolve({ role: "peer" });
@@ -35422,12 +35754,12 @@ async function electRole(opts) {
       }
     };
     const onListening = () => {
-      server2.removeListener("error", onError);
-      resolve({ role: "host", server: server2 });
+      server.removeListener("error", onError);
+      resolve({ role: "host", server });
     };
-    server2.once("error", onError);
-    server2.once("listening", onListening);
-    server2.listen(opts.port, opts.host);
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(opts.port, opts.host);
   });
 }
 
@@ -35471,7 +35803,8 @@ async function buildServerHello(opts) {
   }
   if (opts.captureHeaders && opts.captureHeaders.length > 0) {
     hello.captureHeaders = opts.captureHeaders.map((d) => ({
-      urlPattern: d.urlPattern,
+      host: d.host,
+      ...d.path !== void 0 ? { path: d.path } : {},
       headerName: d.headerName
     }));
   }
@@ -35709,7 +36042,9 @@ async function startHost(opts) {
         } catch {
         }
       }
-      wss.close(() => resolve());
+      wss.close(() => {
+        opts.httpServer.close(() => resolve());
+      });
     }),
     sendOwnInner: async (inner) => {
       const session = await ownSessionReady;
@@ -35759,6 +36094,7 @@ async function startPeer(opts) {
   const innerListeners = [];
   const renegotiateListeners = [];
   const pendingPairListeners = [];
+  const closeListeners = [];
   let session = null;
   let pendingPairCode = null;
   let resolveFirstReady;
@@ -35808,6 +36144,7 @@ async function startPeer(opts) {
   ws.on("message", onMessage);
   ws.once("close", () => {
     rejectFirstReady(new Error("peer WS closed before ready"));
+    closeListeners.forEach((cb) => cb());
   });
   sessionPromise.catch(() => {
   });
@@ -35830,6 +36167,9 @@ async function startPeer(opts) {
       pendingPairListeners.push(cb);
     },
     pendingPairCode: () => pendingPairCode,
+    onClose: (cb) => {
+      closeListeners.push(cb);
+    },
     close: () => ws.close()
   };
   return handle;
@@ -35912,6 +36252,19 @@ function classifyFetchError(error51) {
   return "other";
 }
 
+// node_modules/@fetchproxy/server/dist/classify-bridge-error.js
+function classifyBridgeError(err) {
+  if (err instanceof FetchproxyTimeoutError)
+    return "timeout";
+  if (err instanceof FetchproxyBridgeDownError)
+    return "bridge_down";
+  if (err instanceof FetchproxyHttpError)
+    return "http";
+  if (err instanceof FetchproxyProtocolError)
+    return "protocol";
+  return "other";
+}
+
 // node_modules/@fetchproxy/server/dist/ws-server.js
 var FetchproxyProtocolError = class extends Error {
   constructor(message) {
@@ -35941,7 +36294,7 @@ var FetchproxyBridgeDownError = class extends FetchproxyProtocolError {
     const retryAttempted = args.retryAttempted ?? false;
     const op = args.op ?? "fetch";
     const retryClause = retryAttempted ? `Server already burned a one-shot lazy-revive retry; SW is still down. ` : `Server lazy-revive retry was disabled (bridgeReviveDelayMs unset/0). `;
-    const hint = `the fetchproxy extension's service worker is not responding ("${args.originalError}"). Chrome evicts extension service workers after ~30s idle by default. ${retryClause}Wake it by clicking the fetchproxy extension toolbar icon, then retry. If it keeps happening, reload the extension from chrome://extensions.`;
+    const hint = `the fetchproxy extension's service worker is not responding ("${args.originalError}"). Chrome evicts extension service workers after ~30s idle by default. ${retryClause}Make sure a tab for this domain is open, fully loaded, and signed in (the bridge fetches through that tab) \u2014 then retry. If it keeps happening, reload the extension from chrome://extensions and reload the tab.`;
     super(`fetchproxy bridge down during ${op}${args.url ? ` (${args.url})` : ""}. ${hint}`);
     this.name = "FetchproxyBridgeDownError";
     this.originalError = args.originalError;
@@ -35963,6 +36316,14 @@ var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
   port;
   /** 0.8.0+: actual elapsed milliseconds when the timer won the race. */
   elapsedMs;
+  /**
+   * 0.11.0+ (#90/#91): true when the server's lazy-revive retry path
+   * fired for this timeout (a cold-start `timeout` symptom followed by
+   * a warm-and-retry that also timed out). False when the retry was
+   * disabled (`bridgeReviveDelayMs` unset/0) so the timeout surfaced on
+   * the first attempt.
+   */
+  retryAttempted;
   constructor(args) {
     super(`fetchproxy: ${args.url} did not respond within ${args.timeoutMs}ms`);
     this.name = "FetchproxyTimeoutError";
@@ -35971,6 +36332,7 @@ var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
     this.role = args.role ?? null;
     this.port = args.port ?? 0;
     this.elapsedMs = args.elapsedMs ?? args.timeoutMs;
+    this.retryAttempted = args.retryAttempted ?? false;
   }
 };
 var SUBDOMAIN_LABEL_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
@@ -36009,6 +36371,12 @@ var FetchproxyServer = class {
   opts;
   hostHandle = null;
   peerHandle = null;
+  // 0.13.0+: true from the start of `close()` until the next `doConnect()`.
+  // Distinguishes an intentional shutdown (whose WS close we must ignore)
+  // from the host process dying (which strands a peer and must trigger
+  // re-election). The WS `close` event fires asynchronously, so this stays
+  // latched across `close()` rather than being reset in its tail.
+  closing = false;
   nextRequestId = 1;
   // 0.8.0+: process-wide freshness counters surfaced via bridgeHealth().
   // Replaces the local copies every downstream MCP was rolling on top
@@ -36034,8 +36402,12 @@ var FetchproxyServer = class {
   pendingStorage = /* @__PURE__ */ new Map();
   // 0.3.0+: capture-header awaiters resolve a single string.
   pendingCapture = /* @__PURE__ */ new Map();
+  // capture_redirect awaiters resolve the captured redirect URL string.
+  pendingRedirect = /* @__PURE__ */ new Map();
   // 0.4.0+: read_indexed_db awaiters resolve a JSON-typed values map.
   pendingIdb = /* @__PURE__ */ new Map();
+  // download awaiters resolve the saved-file metadata (path + size + mime).
+  pendingDownload = /* @__PURE__ */ new Map();
   mcpId = null;
   identity = null;
   // 0.5.3+: in-flight role-election / handle-start promise. Set the
@@ -36044,6 +36416,25 @@ var FetchproxyServer = class {
   // for "we're connecting right now" so two parallel first-calls don't
   // race the port bind.
   connectingPromise = null;
+  // 0.8.1+ (#67): server-initiated keep-alive ping. Active when
+  // `keepAliveIntervalMs` is set AND we've seen recent activity
+  // (fetch/capture success or failure, or markActive()) within
+  // `keepAliveMaxIdleMs`. The interval handle is created lazily on
+  // first activity and torn down on close() / extension disconnect.
+  keepAliveTimer = null;
+  lastActiveAt = null;
+  // 0.10.0+ (#73): observability counters surfaced via
+  // bridgeHealth().keepAlive / .swEviction. Monotonic across the process
+  // lifetime so a downstream healthcheck tool can verify the keep-alive
+  // is actually preventing SW eviction. `lastPingAt` and `totalPings`
+  // are stamped from `startKeepaliveIfIdle`'s tick. `lazyRevive*` and
+  // `lastEvictionDetectedAt` are stamped from the lazy-revive code path
+  // in fetch() / captureRequestHeader().
+  lastPingAt = null;
+  totalPings = 0;
+  lazyReviveAttempts = 0;
+  lazyReviveSuccesses = 0;
+  lastEvictionDetectedAt = null;
   constructor(opts) {
     if (!Array.isArray(opts.domains) || opts.domains.length === 0) {
       throw new Error("FetchproxyServer: opts.domains must be a non-empty array of hostnames");
@@ -36062,6 +36453,14 @@ var FetchproxyServer = class {
       }
       capabilities = [...opts.capabilities];
     }
+    if (opts.captureHeaders !== void 0) {
+      try {
+        validateCaptureHeaderDecls(opts.captureHeaders, opts.domains);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error("FetchproxyServer: invalid captureHeaders \u2014 " + message);
+      }
+    }
     this.opts = {
       port: opts.port ?? 37149,
       host: opts.host ?? "127.0.0.1",
@@ -36073,7 +36472,8 @@ var FetchproxyServer = class {
       localStorageKeys: [...opts.localStorageKeys ?? []],
       sessionStorageKeys: [...opts.sessionStorageKeys ?? []],
       captureHeaders: (opts.captureHeaders ?? []).map((d) => ({
-        urlPattern: d.urlPattern,
+        host: d.host,
+        ...d.path !== void 0 ? { path: d.path } : {},
         headerName: d.headerName
       })),
       indexedDbScopes: (opts.indexedDbScopes ?? []).map((d) => ({
@@ -36096,6 +36496,22 @@ var FetchproxyServer = class {
       // the legacy hang-forever / fail-once-on-SW-eviction behavior.
       fetchTimeoutMs: opts.fetchTimeoutMs ?? 3e4,
       bridgeReviveDelayMs: opts.bridgeReviveDelayMs ?? 2e3,
+      // 0.10.0+ (#72): keep-alive defaults to 25s — round-3 #71 cohort
+      // wave showed every Pattern A consumer was opting into this same
+      // value. Pass `0` to disable; the existing `<= 0` guards in
+      // `startKeepaliveIfIdle` / `noteActivityForKeepalive` honour that.
+      //
+      // #90 (P1-1): tightened to 20s. 25s left only ~5s of slack under
+      // Chrome's ~30s SW-eviction window — slack that timer drift, a
+      // busy host event loop (CPU-bound response parsing between calls),
+      // and the ping's own round-trip latency routinely ate, so the SW
+      // evicted before the next ping landed and the next call cold-
+      // started. 20s restores real margin. (The extension
+      // `chrome.alarms` backstop is clamped by Chrome to a 30s minimum
+      // period, firing *at* the edge — it can't rescue a sub-30s race;
+      // the server ping is the real defense.)
+      keepAliveIntervalMs: opts.keepAliveIntervalMs ?? 2e4,
+      keepAliveMaxIdleMs: opts.keepAliveMaxIdleMs ?? 5 * 60 * 1e3,
       identityDir: opts.identityDir,
       onPairCode: opts.onPairCode
     };
@@ -36175,6 +36591,7 @@ var FetchproxyServer = class {
   async doConnect() {
     const identity = this.identity;
     const mcpId = this.mcpId;
+    this.closing = false;
     const el = await electRole({ host: this.opts.host, port: this.opts.port });
     if (el.role === "host") {
       this.role = "host";
@@ -36196,7 +36613,10 @@ var FetchproxyServer = class {
         onPairCode: this.opts.onPairCode
       });
       this.hostHandle.onOwnInner((inner) => this.onInner(inner));
-      this.hostHandle.onExtensionDisconnect(() => this.rejectAllPending());
+      this.hostHandle.onExtensionDisconnect(() => {
+        this.stopKeepalive();
+        this.rejectAllPending();
+      });
       this.hostHandle.onPendingPair((code) => {
         this.rejectAllPending(this.pairingErrorMessage(code));
       });
@@ -36220,7 +36640,10 @@ var FetchproxyServer = class {
         sessionStoragePointers: this.opts.sessionStoragePointers
       });
       this.peerHandle.onInner((inner) => this.onInner(inner));
-      this.peerHandle.onRenegotiate(() => this.rejectAllPending());
+      this.peerHandle.onRenegotiate(() => {
+        this.stopKeepalive();
+        this.rejectAllPending();
+      });
       this.peerHandle.onPendingPair((code) => {
         this.rejectAllPending(this.pairingErrorMessage(code));
       });
@@ -36228,6 +36651,14 @@ var FetchproxyServer = class {
         const cb = this.opts.onPairCode;
         this.peerHandle.onPendingPair((code) => cb(code));
       }
+      this.peerHandle.onClose(() => {
+        if (this.closing || this.peerHandle === null)
+          return;
+        this.stopKeepalive();
+        this.rejectAllPending();
+        this.peerHandle = null;
+        this.role = null;
+      });
     }
   }
   pairingErrorMessage(code) {
@@ -36261,13 +36692,18 @@ var FetchproxyServer = class {
     }
     const first = await this._fetchOnceWithTimeout(init);
     const reviveMs = this.opts.bridgeReviveDelayMs;
-    let final = first;
-    if (!first.ok && first.kind === "content_script_unreachable" && reviveMs !== void 0 && reviveMs > 0) {
+    const isColdStartSymptom = !first.ok && (first.kind === "content_script_unreachable" || first.kind === "timeout");
+    if (isColdStartSymptom) {
+      this.lastEvictionDetectedAt = Date.now();
+    }
+    if (isColdStartSymptom && reviveMs !== void 0 && reviveMs > 0) {
+      this.lazyReviveAttempts += 1;
       await new Promise((r) => setTimeout(r, reviveMs));
       const second = await this._fetchOnceWithTimeout(init);
-      if (second.ok)
+      if (second.ok) {
+        this.lazyReviveSuccesses += 1;
         this.recordSuccess();
-      else
+      } else
         this.recordFailure(`${second.kind ?? "other"}: ${second.error}`);
       return { ...second, retryAttempted: true };
     }
@@ -36289,6 +36725,9 @@ var FetchproxyServer = class {
    * call (addresses #23 ask 4).
    */
   bridgeHealth() {
+    const intervalMs = this.opts.keepAliveIntervalMs;
+    const maxIdleMs = this.opts.keepAliveMaxIdleMs;
+    const idleSinceMs = this.lastActiveAt === null ? null : Date.now() - this.lastActiveAt;
     return {
       role: this.role,
       port: this.opts.port,
@@ -36299,17 +36738,85 @@ var FetchproxyServer = class {
       lastFailureAt: this.lastFailureAt,
       lastFailureReason: this.lastFailureReason,
       consecutiveFailures: this.consecutiveFailures,
-      lastExtensionMessageAt: this.lastExtensionMessageAt
+      lastExtensionMessageAt: this.lastExtensionMessageAt,
+      keepAlive: {
+        enabled: intervalMs > 0,
+        intervalMs,
+        maxIdleMs,
+        lastPingAt: this.lastPingAt,
+        totalPings: this.totalPings,
+        idleSinceMs
+      },
+      swEviction: {
+        lazyReviveAttempts: this.lazyReviveAttempts,
+        lazyReviveSuccesses: this.lazyReviveSuccesses,
+        lastEvictionDetectedAt: this.lastEvictionDetectedAt
+      }
     };
   }
   recordSuccess() {
     this.lastSuccessAt = Date.now();
     this.consecutiveFailures = 0;
+    this.noteActivityForKeepalive();
   }
   recordFailure(reason) {
     this.lastFailureAt = Date.now();
     this.lastFailureReason = reason;
     this.consecutiveFailures += 1;
+    this.noteActivityForKeepalive();
+  }
+  /**
+   * 0.8.1+ (#67): caller-side hint that work is happening or about to
+   * happen — bumps the keep-alive idle gate so the server keeps pinging
+   * the extension. Useful for MCPs that do a chain of side-effectful
+   * work between bridge calls and don't want the SW to evict in the
+   * gap (e.g. server-side parsing of a previous response that takes
+   * tens of seconds). No-op when `keepAliveIntervalMs` is `0`.
+   */
+  markActive() {
+    this.noteActivityForKeepalive();
+  }
+  noteActivityForKeepalive() {
+    const intervalMs = this.opts.keepAliveIntervalMs;
+    if (intervalMs <= 0)
+      return;
+    this.lastActiveAt = Date.now();
+    this.startKeepaliveIfIdle();
+  }
+  startKeepaliveIfIdle() {
+    if (this.keepAliveTimer !== null)
+      return;
+    const intervalMs = this.opts.keepAliveIntervalMs;
+    if (intervalMs <= 0)
+      return;
+    this.keepAliveTimer = setInterval(() => {
+      const now = Date.now();
+      if (this.lastActiveAt === null || now - this.lastActiveAt > this.opts.keepAliveMaxIdleMs) {
+        this.stopKeepalive();
+        return;
+      }
+      this.totalPings += 1;
+      this.lastPingAt = now;
+      void this.sendKeepalivePing();
+    }, intervalMs);
+  }
+  async sendKeepalivePing() {
+    try {
+      const inner = { type: "ping" };
+      if (this.hostHandle) {
+        await this.hostHandle.sendOwnInner(inner);
+      } else if (this.peerHandle) {
+        await this.peerHandle.sendInner(inner);
+      }
+    } catch (e) {
+      console.error("[fetchproxy] keepalive ping send failed:", e);
+    }
+  }
+  stopKeepalive() {
+    if (this.keepAliveTimer !== null) {
+      clearInterval(this.keepAliveTimer);
+      this.keepAliveTimer = null;
+    }
   }
   /**
    * Single bridge round-trip, wrapped by `fetchTimeoutMs` when set.
@@ -36368,7 +36875,8 @@ var FetchproxyServer = class {
         timeoutMs: this.opts.fetchTimeoutMs ?? 0,
         role: this.role,
         port: this.opts.port,
-        elapsedMs: result.elapsedMs
+        elapsedMs: result.elapsedMs,
+        retryAttempted
       });
     }
     if (result.kind === "content_script_unreachable") {
@@ -36499,6 +37007,108 @@ var FetchproxyServer = class {
     const response = await this.get(path, this.applyJsonDefaults(opts));
     return response.body;
   }
+  /**
+   * 0.11.0+: method-generic JSON convenience helper. Generalizes the
+   * `fetchJson<T>(path, { method, headers, body })` that
+   * zillow/redfin/compass/homes hand-rolled char-for-char in their
+   * `src/client.ts`:
+   *
+   *  - sets `Accept: application/json`;
+   *  - adds `Content-Type: application/json` only for a non-GET request
+   *    that carries a `body` (and only if the caller didn't set one);
+   *  - `JSON.stringify`s the body (GET / no-body sends nothing);
+   *  - treats a `204` or an empty body as `data: null` (no parse);
+   *  - otherwise `JSON.parse`s the body.
+   *
+   * Scope is serialization + header defaults + 204-handling +
+   * JSON.parse ONLY. It deliberately does NOT assert on the HTTP status
+   * or look for a sign-in interstitial — those guards differ per site
+   * (Zillow's `captcha-delivery`, Redfin's AWS-WAF challenge, …), so it
+   * returns BOTH the parsed `data` and the raw `FetchResult` and leaves
+   * the consumer to run its own `throwIfNotOk` / `throwIfSignInPage`
+   * over `result`.
+   *
+   * Bridge-level failures (no signed-in tab, SW down, timeout) still
+   * throw the typed errors via `request()`, exactly like the verb
+   * helpers — only successful round-trips (any HTTP status) return.
+   */
+  async requestJson(method, path, opts = {}) {
+    const isGet = method.toUpperCase() === "GET";
+    const sendBody = !isGet && opts.body !== void 0;
+    const headers = {
+      Accept: "application/json",
+      ...sendBody && !this.hasContentType(opts.headers ?? {}) ? { "Content-Type": "application/json" } : {},
+      ...opts.headers ?? {}
+    };
+    const response = await this.request(method, path, {
+      headers,
+      body: sendBody ? JSON.stringify(opts.body) : void 0,
+      ...opts.subdomain !== void 0 ? { subdomain: opts.subdomain } : {},
+      ...opts.domain !== void 0 ? { domain: opts.domain } : {}
+    });
+    const result = {
+      ok: true,
+      status: response.status,
+      url: response.url,
+      body: response.body
+    };
+    if (response.status === 204 || response.body === "") {
+      return { data: null, result };
+    }
+    let data;
+    try {
+      data = JSON.parse(response.body);
+    } catch (e) {
+      throw new Error(`fetchproxy ${method} ${path} \u2014 response was not JSON: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    return { data, result };
+  }
+  /**
+   * 0.11.0+: run a single healthcheck probe through `fetchFn`, measure
+   * the elapsed round-trip, classify any thrown error, and project the
+   * post-probe `bridgeHealth()` into a snake-cased `bridge` sub-object.
+   *
+   * This is the transport half of the probe loop zillow/redfin/homes
+   * had duplicated verbatim in `src/tools/healthcheck.ts`. The MCP
+   * supplies its own probe call (`(path) => client.fetchHtml(path)`)
+   * and probe path (e.g. `'/robots.txt'`); the tool registration and
+   * the site-specific plain-English hint text STAY in the consumer.
+   *
+   * `bridgeHealth()` is read AFTER the probe so its freshness counters
+   * (`lastSuccessAt` / `consecutiveFailures` / …) reflect this very
+   * round-trip rather than a stale pre-probe snapshot.
+   */
+  async runProbe(fetchFn, probePath) {
+    const start = Date.now();
+    let ok = false;
+    let error51;
+    try {
+      await fetchFn(probePath);
+      ok = true;
+    } catch (e) {
+      error51 = {
+        kind: classifyBridgeError(e),
+        message: e instanceof Error ? e.message : String(e)
+      };
+    }
+    const elapsed_ms = Date.now() - start;
+    const health = this.bridgeHealth();
+    return {
+      ok,
+      elapsed_ms,
+      bridge: {
+        role: health.role,
+        port: health.port,
+        server_version: health.serverVersion,
+        fetch_timeout_ms: health.fetchTimeoutMs,
+        last_success_at: health.lastSuccessAt,
+        last_failure_at: health.lastFailureAt,
+        last_failure_reason: health.lastFailureReason,
+        consecutive_failures: health.consecutiveFailures
+      },
+      ...error51 ? { error: error51 } : {}
+    };
+  }
   /**
    * Snapshot the user's non-HttpOnly cookies for the chosen domain.
    *
@@ -36623,12 +37233,12 @@ var FetchproxyServer = class {
   /**
    * 0.3.0+: snapshot the next outgoing request's named header. Single-
    * shot: the extension registers a one-time `webRequest` listener
-   * filtered on `urlPattern`, captures the named header on the first
-   * match, removes itself, and resolves with the value. Times out
-   * after `timeoutMs` (default 30s on the extension).
+   * filtered on `https://${host}${path ?? '/*'}`, captures the named
+   * header on the first match, removes itself, and resolves with the
+   * value. Times out after `timeoutMs` (default 30s on the extension).
    *
-   * `(urlPattern, headerName)` must exactly match a declared entry in
-   * `FetchproxyServerOpts.captureHeaders`.
+   * `(host, path?, headerName)` must match a declared entry in
+   * `FetchproxyServerOpts.captureHeaders` (omitted path ≡ `/*`).
    */
   async captureRequestHeader(opts) {
     if (!this.opts.capabilities.includes("capture_request_header")) {
@@ -36637,24 +37247,25 @@ var FetchproxyServer = class {
     await this.ensureConnected();
     this.throwIfPendingPair();
     const decls = this.opts.captureHeaders;
+    const normPath = (p) => p ?? "/*";
     let resolved;
-    if (opts?.urlPattern !== void 0 && opts?.headerName !== void 0) {
-      const found = decls.find((d) => d.urlPattern === opts.urlPattern && d.headerName === opts.headerName);
+    if (opts?.host !== void 0 && opts?.headerName !== void 0) {
+      const found = decls.find((d) => d.host === opts.host && normPath(d.path) === normPath(opts.path) && d.headerName === opts.headerName);
       if (!found) {
-        throw new Error(`FetchproxyServer.captureRequestHeader: (urlPattern=${JSON.stringify(opts.urlPattern)}, headerName=${JSON.stringify(opts.headerName)}) not declared in captureHeaders`);
+        throw new Error(`FetchproxyServer.captureRequestHeader: (host=${JSON.stringify(opts.host)}, path=${JSON.stringify(normPath(opts.path))}, headerName=${JSON.stringify(opts.headerName)}) not declared in captureHeaders`);
       }
       resolved = found;
-    } else if (opts?.urlPattern === void 0 && opts?.headerName === void 0) {
+    } else if (opts?.host === void 0 && opts?.headerName === void 0) {
       if (decls.length === 0) {
-        throw new Error("FetchproxyServer.captureRequestHeader: no captureHeaders declared on this server \u2014 declare at least one entry in FetchproxyServerOpts.captureHeaders, or pass {urlPattern, headerName} explicitly");
+        throw new Error("FetchproxyServer.captureRequestHeader: no captureHeaders declared on this server \u2014 declare at least one entry in FetchproxyServerOpts.captureHeaders, or pass {host, headerName} explicitly");
       }
       if (decls.length > 1) {
-        const list = decls.map((d) => `${JSON.stringify(d.urlPattern)}/${JSON.stringify(d.headerName)}`).join(", ");
-        throw new Error(`FetchproxyServer.captureRequestHeader: multiple captureHeaders declared (${decls.length}: ${list}); pass {urlPattern, headerName} to disambiguate`);
+        const list = decls.map((d) => `${JSON.stringify(d.host)}${JSON.stringify(normPath(d.path))}/${JSON.stringify(d.headerName)}`).join(", ");
+        throw new Error(`FetchproxyServer.captureRequestHeader: multiple captureHeaders declared (${decls.length}: ${list}); pass {host, headerName} to disambiguate`);
       }
       resolved = decls[0];
     } else {
-      throw new Error("FetchproxyServer.captureRequestHeader: pass both urlPattern AND headerName, or neither (which defaults to the single declared entry)");
+      throw new Error("FetchproxyServer.captureRequestHeader: pass both host AND headerName, or neither (which defaults to the single declared entry)");
     }
     const callOpts = { ...resolved, ...opts?.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {} };
     try {
@@ -36667,11 +37278,14 @@ var FetchproxyServer = class {
         this.recordFailure(`capture_request_header: ${err.message ?? String(err)}`);
         throw err;
       }
+      this.lastEvictionDetectedAt = Date.now();
       const reviveMs = this.opts.bridgeReviveDelayMs ?? 0;
       if (reviveMs > 0) {
+        this.lazyReviveAttempts += 1;
         await new Promise((r) => setTimeout(r, reviveMs));
         try {
           const result = await this._captureRequestHeaderOnce(callOpts);
+          this.lazyReviveSuccesses += 1;
           this.recordSuccess();
           return result;
         } catch (retryErr) {
@@ -36685,7 +37299,7 @@ var FetchproxyServer = class {
             originalError: retryErr.message,
             retryAttempted: true,
             op: "capture_request_header",
-            url: resolved.urlPattern,
+            url: `https://${resolved.host}${resolved.path ?? "/*"}`,
             role: this.role,
             port: this.opts.port
           });
@@ -36696,7 +37310,7 @@ var FetchproxyServer = class {
         originalError: err.message,
         retryAttempted: false,
         op: "capture_request_header",
-        url: resolved.urlPattern,
+        url: `https://${resolved.host}${resolved.path ?? "/*"}`,
         role: this.role,
         port: this.opts.port
       });
@@ -36709,7 +37323,8 @@ var FetchproxyServer = class {
       id,
       op: "capture_request_header",
       init: {
-        urlPattern: opts.urlPattern,
+        host: opts.host,
+        ...opts.path !== void 0 ? { path: opts.path } : {},
         headerName: opts.headerName,
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
@@ -36724,6 +37339,181 @@ var FetchproxyServer = class {
     }
     return pending;
   }
+  /**
+   * Snapshot the redirect target URL of the next request the browser
+   * makes to `(host, path?)`. Single-shot: the extension registers a
+   * one-time `chrome.webRequest.onBeforeRedirect` listener filtered on
+   * `https://${host}${path ?? '/*'}`, captures `details.redirectUrl` on
+   * the first match, removes itself, and resolves with the URL. Times out
+   * after `timeoutMs` (default 30s on the extension).
+   *
+   * Use case: a Cloudflare-walled endpoint that 302-redirects cross-origin
+   * to a presigned URL — a page-level fetch sees only an opaque redirect,
+   * but `onBeforeRedirect` exposes the target. Capture is limited to the
+   * MCP's own declared `domains`; no per-entry declared scope is required.
+   */
+  async captureRedirect(opts) {
+    if (!this.opts.capabilities.includes("capture_redirect")) {
+      throw new Error('FetchproxyServer.captureRedirect(): MCP did not declare "capture_redirect" in capabilities');
+    }
+    await this.ensureConnected();
+    this.throwIfPendingPair();
+    try {
+      const result = await this._captureRedirectOnce(opts);
+      this.recordSuccess();
+      return result;
+    } catch (err) {
+      const swDown = err instanceof FetchproxyProtocolError && classifyFetchError(err.message) === "content_script_unreachable";
+      if (!swDown) {
+        this.recordFailure(`capture_redirect: ${err.message ?? String(err)}`);
+        throw err;
+      }
+      this.lastEvictionDetectedAt = Date.now();
+      const reviveMs = this.opts.bridgeReviveDelayMs ?? 0;
+      if (reviveMs > 0) {
+        this.lazyReviveAttempts += 1;
+        await new Promise((r) => setTimeout(r, reviveMs));
+        try {
+          const result = await this._captureRedirectOnce(opts);
+          this.lazyReviveSuccesses += 1;
+          this.recordSuccess();
+          return result;
+        } catch (retryErr) {
+          const stillDown = retryErr instanceof FetchproxyProtocolError && classifyFetchError(retryErr.message) === "content_script_unreachable";
+          if (!stillDown) {
+            this.recordFailure(`capture_redirect: ${retryErr.message ?? String(retryErr)}`);
+            throw retryErr;
+          }
+          this.recordFailure(`capture_redirect bridge-down: ${retryErr.message}`);
+          throw new FetchproxyBridgeDownError({
+            originalError: retryErr.message,
+            retryAttempted: true,
+            op: "capture_redirect",
+            url: `https://${opts.host}${opts.path ?? "/*"}`,
+            role: this.role,
+            port: this.opts.port
+          });
+        }
+      }
+      this.recordFailure(`capture_redirect bridge-down: ${err.message}`);
+      throw new FetchproxyBridgeDownError({
+        originalError: err.message,
+        retryAttempted: false,
+        op: "capture_redirect",
+        url: `https://${opts.host}${opts.path ?? "/*"}`,
+        role: this.role,
+        port: this.opts.port
+      });
+    }
+  }
+  async _captureRedirectOnce(opts) {
+    const id = this.nextRequestId++;
+    const inner = {
+      type: "request",
+      id,
+      op: "capture_redirect",
+      init: {
+        host: opts.host,
+        ...opts.path !== void 0 ? { path: opts.path } : {},
+        ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
+      }
+    };
+    const pending = new Promise((resolve, reject) => {
+      this.pendingRedirect.set(id, { resolve, reject });
+    });
+    if (this.hostHandle) {
+      await this.hostHandle.sendOwnInner(inner);
+    } else if (this.peerHandle) {
+      await this.peerHandle.sendInner(inner);
+    }
+    return pending;
+  }
+  /**
+   * Download `url` through the BROWSER's own network stack via
+   * `chrome.downloads` (real cookies + TLS/JA3 fingerprint). Unlike a
+   * page-level `fetch()` (cors mode), this clears a Cloudflare bot-challenge
+   * on the endpoint and follows the cross-origin redirect to the final file.
+   * Resolves the saved local file path + size; the bridge is loopback-only /
+   * single-host, so the MCP reads the bytes from the same disk. Requires
+   * `'download'` in capabilities and the `url` host to be a declared `domain`.
+   */
+  async download(opts) {
+    if (!this.opts.capabilities.includes("download")) {
+      throw new Error('FetchproxyServer.download(): MCP did not declare "download" in capabilities');
+    }
+    assertUrlInDomains("download url", opts.url, this.opts.domains);
+    await this.ensureConnected();
+    this.throwIfPendingPair();
+    try {
+      const result = await this._downloadOnce(opts);
+      this.recordSuccess();
+      return result;
+    } catch (err) {
+      const swDown = err instanceof FetchproxyProtocolError && classifyFetchError(err.message) === "content_script_unreachable";
+      if (!swDown) {
+        this.recordFailure(`download: ${err.message ?? String(err)}`);
+        throw err;
+      }
+      this.lastEvictionDetectedAt = Date.now();
+      const reviveMs = this.opts.bridgeReviveDelayMs ?? 0;
+      if (reviveMs > 0) {
+        this.lazyReviveAttempts += 1;
+        await new Promise((r) => setTimeout(r, reviveMs));
+        try {
+          const result = await this._downloadOnce(opts);
+          this.lazyReviveSuccesses += 1;
+          this.recordSuccess();
+          return result;
+        } catch (retryErr) {
+          const stillDown = retryErr instanceof FetchproxyProtocolError && classifyFetchError(retryErr.message) === "content_script_unreachable";
+          if (!stillDown) {
+            this.recordFailure(`download: ${retryErr.message ?? String(retryErr)}`);
+            throw retryErr;
+          }
+          this.recordFailure(`download bridge-down: ${retryErr.message}`);
+          throw new FetchproxyBridgeDownError({
+            originalError: retryErr.message,
+            retryAttempted: true,
+            op: "download",
+            url: opts.url,
+            role: this.role,
+            port: this.opts.port
+          });
+        }
+      }
+      this.recordFailure(`download bridge-down: ${err.message}`);
+      throw new FetchproxyBridgeDownError({
+        originalError: err.message,
+        retryAttempted: false,
+        op: "download",
+        url: opts.url,
+        role: this.role,
+        port: this.opts.port
+      });
+    }
+  }
+  async _downloadOnce(opts) {
+    const id = this.nextRequestId++;
+    const inner = {
+      type: "request",
+      id,
+      op: "download",
+      init: {
+        url: opts.url,
+        ...opts.filename !== void 0 ? { filename: opts.filename } : {},
+        ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
+      }
+    };
+    const pending = new Promise((resolve, reject) => {
+      this.pendingDownload.set(id, { resolve, reject });
+    });
+    if (this.hostHandle) {
+      await this.hostHandle.sendOwnInner(inner);
+    } else if (this.peerHandle) {
+      await this.peerHandle.sendInner(inner);
+    }
+    return pending;
+  }
   /**
    * 0.4.0+: read declared IndexedDB keys from the user's signed-in
    * tab. Requires `'read_indexed_db'` in capabilities AND the
@@ -36871,6 +37661,20 @@ var FetchproxyServer = class {
       }
       return;
     }
+    const redirectCb = this.pendingRedirect.get(inner.id);
+    if (redirectCb) {
+      this.pendingRedirect.delete(inner.id);
+      if (inner.ok) {
+        if (inner.op === "capture_redirect" && typeof inner.value === "string") {
+          redirectCb.resolve(inner.value);
+        } else {
+          redirectCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on capture_redirect awaiter`));
+        }
+      } else {
+        redirectCb.reject(new FetchproxyProtocolError(inner.error));
+      }
+      return;
+    }
     const idbCb = this.pendingIdb.get(inner.id);
     if (idbCb) {
       this.pendingIdb.delete(inner.id);
@@ -36885,6 +37689,20 @@ var FetchproxyServer = class {
       }
       return;
     }
+    const downloadCb = this.pendingDownload.get(inner.id);
+    if (downloadCb) {
+      this.pendingDownload.delete(inner.id);
+      if (inner.ok) {
+        if (inner.op === "download" && inner.value && typeof inner.value === "object") {
+          downloadCb.resolve({ ...inner.value });
+        } else {
+          downloadCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on download awaiter`));
+        }
+      } else {
+        downloadCb.reject(new FetchproxyProtocolError(inner.error));
+      }
+      return;
+    }
     const cookiesCb = this.pendingReadCookies.get(inner.id);
     if (cookiesCb) {
       this.pendingReadCookies.delete(inner.id);
@@ -36927,9 +37745,15 @@ var FetchproxyServer = class {
     for (const { reject } of this.pendingCapture.values())
       reject(err);
     this.pendingCapture.clear();
+    for (const { reject } of this.pendingRedirect.values())
+      reject(err);
+    this.pendingRedirect.clear();
     for (const { reject } of this.pendingIdb.values())
       reject(err);
     this.pendingIdb.clear();
+    for (const { reject } of this.pendingDownload.values())
+      reject(err);
+    this.pendingDownload.clear();
   }
   /**
    * 0.5.2+: read the current pair-pending pair code from whichever handle
@@ -36964,6 +37788,8 @@ var FetchproxyServer = class {
    * twice in a row.
    */
   async close() {
+    this.closing = true;
+    this.stopKeepalive();
     this.rejectAllPending();
     if (this.connectingPromise) {
       await this.connectingPromise.catch(() => void 0);
@@ -36979,19 +37805,6 @@ var FetchproxyServer = class {
   }
 };
 
-// node_modules/@fetchproxy/server/dist/classify-bridge-error.js
-function classifyBridgeError(err) {
-  if (err instanceof FetchproxyTimeoutError)
-    return "timeout";
-  if (err instanceof FetchproxyBridgeDownError)
-    return "bridge_down";
-  if (err instanceof FetchproxyHttpError)
-    return "http";
-  if (err instanceof FetchproxyProtocolError)
-    return "protocol";
-  return "other";
-}
-
 // node_modules/@fetchproxy/bootstrap/dist/index.js
 var defaultFactory = (opts) => new FetchproxyServer(opts);
 async function bootstrap(opts) {
@@ -37023,7 +37836,7 @@ async function bootstrap(opts) {
   const sessionStorageKeys = new Set(opts.declare.sessionStorage);
   for (const p of sessionStoragePointers)
     sessionStorageKeys.add(p.storageKey);
-  const server2 = factory({
+  const server = factory({
     serverName: opts.serverName,
     version: opts.version,
     domains: [...opts.domains],
@@ -37058,10 +37871,10 @@ async function bootstrap(opts) {
   if (opts.storageSubdomain !== void 0)
     storageDomainOpts.subdomain = opts.storageSubdomain;
   try {
-    await server2.listen();
+    await server.listen();
     const cookies = {};
     if (opts.declare.cookies.length > 0) {
-      const joined = await server2.readCookies({
+      const joined = await server.readCookies({
         keys: opts.declare.cookies,
         ...storageDomainOpts
       });
@@ -37081,7 +37894,7 @@ async function bootstrap(opts) {
       for (const p of localStoragePointers) {
         pointers[p.outputKey] = { storageKey: p.storageKey, jsonPointer: p.jsonPointer };
       }
-      localStorage = await server2.readLocalStorage({
+      localStorage = await server.readLocalStorage({
         keys: allKeys,
         ...storageDomainOpts,
         ...localStoragePointers.length > 0 ? { pointers } : {}
@@ -37094,7 +37907,7 @@ async function bootstrap(opts) {
       for (const p of sessionStoragePointers) {
         pointers[p.outputKey] = { storageKey: p.storageKey, jsonPointer: p.jsonPointer };
       }
-      sessionStorage = await server2.readSessionStorage({
+      sessionStorage = await server.readSessionStorage({
         keys: allKeys,
         ...storageDomainOpts,
         ...sessionStoragePointers.length > 0 ? { pointers } : {}
@@ -37103,21 +37916,17 @@ async function bootstrap(opts) {
     const capturedHeaders = {};
     for (const h of opts.declare.captureHeaders) {
       if (opts.onWaiting) {
-        try {
-          const url2 = new URL(h.urlPattern.replace(/\*+/g, "placeholder"));
-          opts.onWaiting(`waiting for next request to ${url2.host} to capture ${h.headerName} \u2014 interact with the page in your browser`);
-        } catch {
-          opts.onWaiting(`waiting to capture ${h.headerName} \u2014 interact with the page in your browser`);
-        }
+        opts.onWaiting(`waiting for next request to ${h.host} to capture ${h.headerName} \u2014 interact with the page in your browser`);
       }
-      capturedHeaders[h.headerName] = await server2.captureRequestHeader({
-        urlPattern: h.urlPattern,
+      capturedHeaders[h.headerName] = await server.captureRequestHeader({
+        host: h.host,
+        ...h.path !== void 0 ? { path: h.path } : {},
         headerName: h.headerName
       });
     }
     const indexedDbBucket = {};
     for (const d of indexedDb) {
-      const values = await server2.readIndexedDb({
+      const values = await server.readIndexedDb({
         database: d.database,
         store: d.store,
         keys: [...d.keys],
@@ -37134,7 +37943,7 @@ async function bootstrap(opts) {
     };
   } finally {
     try {
-      await server2.close();
+      await server.close();
     } catch {
     }
   }
@@ -37152,13 +37961,7 @@ var BootstrapDisabledError = class extends Error {
 
 // src/config.ts
 function readVar(env, key) {
-  const raw = env[key];
-  if (typeof raw !== "string") return void 0;
-  const trimmed = raw.trim();
-  if (trimmed.length === 0) return void 0;
-  if (trimmed === "undefined" || trimmed === "null") return void 0;
-  if (/^\$\{[^}]*\}$/.test(trimmed)) return void 0;
-  return trimmed;
+  return readEnvVar(key, { env });
 }
 function loadAccount(env = process.env) {
   const baseUrl = readVar(env, "IC_BASE_URL");
@@ -37197,7 +38000,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "infinitecampus-mcp",
-  version: "2.3.1",
+  version: "2.3.3",
   mcpName: "io.github.chrischall/infinitecampus-mcp",
   description: "Infinite Campus (Campus Parent) MCP server \u2014 multi-district read + message/document write",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -37239,10 +38042,12 @@ var package_default = {
     "test:watch": "vitest"
   },
   dependencies: {
-    "@fetchproxy/bootstrap": "^0.8.0",
-    "@fetchproxy/server": "^0.8.0",
+    "@chrischall/mcp-utils": "^0.5.0",
+    "@fetchproxy/bootstrap": "^1.0.0",
+    "@fetchproxy/server": "^1.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
+    "node-html-parser": "^7.1.0",
     zod: "^4.4.3"
   },
   devDependencies: {
@@ -37255,19 +38060,8 @@ var package_default = {
 };
 
 // src/auth.ts
-function readEnv(key) {
-  const raw = process.env[key];
-  if (typeof raw !== "string") return void 0;
-  const trimmed = raw.trim();
-  if (trimmed.length === 0) return void 0;
-  if (trimmed === "undefined" || trimmed === "null") return void 0;
-  if (/^\$\{[^}]*\}$/.test(trimmed)) return void 0;
-  return trimmed;
-}
 function fetchproxyDisabled() {
-  const raw = readEnv("IC_DISABLE_FETCHPROXY");
-  if (raw === void 0) return false;
-  return ["1", "true", "yes", "on"].includes(raw.toLowerCase());
+  return parseBoolEnv("IC_DISABLE_FETCHPROXY", { default: false });
 }
 async function resolveAuth() {
   const account2 = loadAccount();
@@ -37438,6 +38232,20 @@ var ICClient = class {
     }
   }
   async login(account2) {
+    const primaryName = this.linkedTo.get(account2.name);
+    if (primaryName) {
+      this.sessions.delete(account2.name);
+      const primaryAccount = this.accounts.get(primaryName);
+      await this.ensureSession(primaryAccount);
+      if (!this.sessions.has(account2.name)) {
+        throw new AuthFailedError(
+          account2.name,
+          "linked-district session could not be re-established via the primary district",
+          { credentialHint: false }
+        );
+      }
+      return;
+    }
     if (!account2.username || !account2.password) {
       throw new AuthFailedError(
         account2.name,
@@ -37445,8 +38253,17 @@ var ICClient = class {
       );
     }
     const postRes = await fetch(
-      `${account2.baseUrl}/campus/verify.jsp?nonBrowser=true&username=${encodeURIComponent(account2.username)}&password=${encodeURIComponent(account2.password)}&appName=${encodeURIComponent(account2.district)}&portalLoginPage=parents`,
-      { method: "POST" }
+      `${account2.baseUrl}/campus/verify.jsp?nonBrowser=true`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          username: account2.username,
+          password: account2.password,
+          appName: account2.district,
+          portalLoginPage: "parents"
+        }).toString()
+      }
     );
     if (postRes.status >= 500) throw new PortalUnreachableError(account2.name, postRes.status);
     const body = await postRes.text();
@@ -37469,9 +38286,7 @@ var ICClient = class {
     session.cookie = cookies.cookieHeader;
     session.xsrfToken = cookies.xsrfToken;
     session.loggedInAt = Date.now();
-    if (!this.linkedTo.has(account2.name)) {
-      await this.discoverLinkedDistricts(account2);
-    }
+    await this.discoverLinkedDistricts(account2);
   }
   async discoverLinkedDistricts(account2) {
     try {
@@ -37635,22 +38450,9 @@ var ICClient = class {
 };
 function parseSetCookies(headers) {
   const raw = headers.getSetCookie?.() ?? [];
-  const headerStrings = raw.length > 0 ? raw : splitFallback(headers.get("set-cookie"));
-  const jar = /* @__PURE__ */ new Map();
-  let xsrfToken = "";
-  for (const entry of headerStrings) {
-    if (/Max-Age=0/i.test(entry)) continue;
-    const nameValue = entry.split(";")[0].trim();
-    const eqIdx = nameValue.indexOf("=");
-    if (eqIdx < 1) continue;
-    const name = nameValue.substring(0, eqIdx);
-    const value = nameValue.substring(eqIdx + 1);
-    if (!value) continue;
-    jar.set(name, value);
-    if (name === "XSRF-TOKEN") xsrfToken = value;
-  }
-  const cookieHeader = [...jar.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
-  return { cookieHeader, xsrfToken };
+  const entries = raw.length > 0 ? raw : splitFallback(headers.get("set-cookie"));
+  const { cookies, cookieHeader } = parseCookieJar(entries);
+  return { cookieHeader, xsrfToken: cookies["XSRF-TOKEN"] ?? "" };
 }
 function splitFallback(header) {
   if (!header) return [];
@@ -37667,11 +38469,16 @@ var UnknownDistrictError = class extends Error {
   available;
 };
 var AuthFailedError = class extends Error {
-  constructor(district, reason) {
+  /**
+   * @param opts.credentialHint When `false`, the message omits the
+   *   "Check IC_USERNAME and IC_PASSWORD" suffix — used for failures where the
+   *   credentials are known-good (e.g. a linked-district CUPS/SSO re-discovery
+   *   failure) and pointing the user at their creds would be misleading.
+   */
+  constructor(district, reason, opts) {
     const detail = reason ? ` (${reason})` : "";
-    super(
-      `Login failed for district '${district}'${detail}. Check IC_USERNAME and IC_PASSWORD; if those are correct, the account may be locked or the portal may be down.`
-    );
+    const remedy = opts?.credentialHint === false ? "Sign in again at the IC portal in your browser, then restart the MCP." : "Check IC_USERNAME and IC_PASSWORD; if those are correct, the account may be locked or the portal may be down.";
+    super(`Login failed for district '${district}'${detail}. ${remedy}`);
     this.district = district;
     this.reason = reason;
     this.name = "AuthFailedError";
@@ -37724,7 +38531,7 @@ var FileExistsError = class extends Error {
 
 // src/tools/_shared.ts
 function textContent(data) {
-  return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+  return textResult(data);
 }
 function is404(e) {
   return e instanceof Error && e.message.startsWith("IC 404 ");
@@ -37757,8 +38564,8 @@ function toArray(value) {
 }
 
 // src/tools/districts.ts
-function registerDistrictTools(server2, client) {
-  server2.registerTool("ic_list_districts", {
+function registerDistrictTools(server, client) {
+  server.registerTool("ic_list_districts", {
     description: "List Infinite Campus districts configured for this MCP server. Returns names + base URLs (no credentials).",
     annotations: { readOnlyHint: true }
   }, async () => {
@@ -37772,8 +38579,8 @@ function registerDistrictTools(server2, client) {
 var argsSchema = external_exports.object({
   district: external_exports.string().describe("District name from ic_list_districts")
 });
-function registerStudentTools(server2, client) {
-  server2.registerTool("ic_list_students", {
+function registerStudentTools(server, client) {
+  server.registerTool("ic_list_students", {
     description: "List students enrolled under the parent account for a given district.",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema.shape
@@ -37791,8 +38598,8 @@ var argsSchema2 = external_exports.object({
   date: external_exports.string().describe("YYYY-MM-DD; defaults to today").optional(),
   termFilter: external_exports.string().describe("Term name or ID; optional").optional()
 });
-function registerScheduleTools(server2, client) {
-  server2.registerTool("ic_get_schedule", {
+function registerScheduleTools(server, client) {
+  server.registerTool("ic_get_schedule", {
     description: "Get a student's class schedule for a given date (default: today).",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema2.shape
@@ -37813,8 +38620,8 @@ var argsSchema3 = external_exports.object({
   until: external_exports.string().describe("YYYY-MM-DD; filters dueDate <= until (client-side)").optional(),
   missingOnly: external_exports.boolean().describe("Only return assignments flagged missing by the teacher").optional()
 });
-function registerAssignmentTools(server2, client) {
-  server2.registerTool("ic_list_assignments", {
+function registerAssignmentTools(server, client) {
+  server.registerTool("ic_list_assignments", {
     description: "List a student's assignments. The IC endpoint returns the full term history (~hundreds of items); date and missing filters are applied client-side. For a single course, pass courseId (the sectionID from ic_get_schedule).",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema3.shape
@@ -37848,8 +38655,8 @@ var argsSchema4 = external_exports.object({
   studentId: external_exports.string(),
   termId: external_exports.string().optional()
 });
-function registerGradeTools(server2, client) {
-  server2.registerTool("ic_list_grades", {
+function registerGradeTools(server, client) {
+  server.registerTool("ic_list_grades", {
     description: "List a student's term grades and in-progress course grades.",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema4.shape
@@ -37892,8 +38699,8 @@ function processList(list, since, until) {
   if (list === void 0) return list;
   return toArray(list).filter((e) => inRange(e.date, since, until)).map(trimEntry);
 }
-function registerAttendanceTools(server2, client) {
-  server2.registerTool("ic_list_attendance", {
+function registerAttendanceTools(server, client) {
+  server.registerTool("ic_list_attendance", {
     description: "List a student's absences and tardies (per-course summary grouped by term). Auto-resolves enrollmentID from the student record.",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema5.shape
@@ -37941,8 +38748,8 @@ var argsSchema6 = external_exports.object({
   since: external_exports.string().optional(),
   until: external_exports.string().optional()
 });
-function registerBehaviorTools(server2, client) {
-  server2.registerTool("ic_list_behavior", {
+function registerBehaviorTools(server, client) {
+  server.registerTool("ic_list_behavior", {
     description: "List a student's behavior events / referrals. Returns FeatureDisabled if the district has the behavior module turned off (detected via displayOptions or a 404 backstop).",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema6.shape
@@ -37973,8 +38780,8 @@ var argsSchema7 = external_exports.object({
   until: external_exports.string().optional()
 });
 var EMPTY_FOOD = { balance: null, transactions: [] };
-function registerFoodServiceTools(server2, client) {
-  server2.registerTool("ic_list_food_service", {
+function registerFoodServiceTools(server, client) {
+  server.registerTool("ic_list_food_service", {
     description: "List a student's lunch balance and recent food-service transactions. Returns FeatureDisabled if the district has the module turned off (detected via displayOptions or a 404 backstop).",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema7.shape
@@ -38005,6 +38812,29 @@ function registerFoodServiceTools(server2, client) {
   });
 }
 
+// node_modules/@chrischall/mcp-utils/dist/html/index.js
+var NAMED_ENTITIES = {
+  nbsp: " ",
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'"
+};
+function extractPlainTextFromHtml(html) {
+  if (!html)
+    return "";
+  let text = html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ");
+  text = text.replace(/<[^>]+>/g, " ");
+  text = text.replace(/&#(\d+);/g, (_, d) => String.fromCodePoint(Number(d)));
+  text = text.replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16)));
+  text = text.replace(/&([a-zA-Z]+);/g, (whole, name) => {
+    const decoded = NAMED_ENTITIES[name.toLowerCase()];
+    return decoded ?? whole;
+  });
+  return text.replace(/\s+/g, " ").trim();
+}
+
 // src/tools/messages.ts
 var listArgs = external_exports.object({
   district: external_exports.string(),
@@ -38051,10 +38881,7 @@ function parseMessageHtml(html, url2) {
   const titleMatch = html.match(/<title>([^<]*)<\/title>/i);
   let subject = titleMatch ? titleMatch[1].trim() : "";
   subject = subject.replace(/^Message\s*--\s*/i, "");
-  let text = html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ");
-  text = text.replace(/<[^>]+>/g, " ");
-  text = text.replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
-  text = text.replace(/\s+/g, " ").trim();
+  const text = extractPlainTextFromHtml(html);
   const dateMatch = text.match(/Date:\s*(\d{1,2}\/\d{1,2}\/\d{2,4})/);
   const date5 = dateMatch ? dateMatch[1] : null;
   let body = text;
@@ -38064,8 +38891,8 @@ function parseMessageHtml(html, url2) {
   }
   return { subject, date: date5, body, url: url2 };
 }
-function registerMessageTools(server2, client) {
-  server2.registerTool("ic_list_messages", {
+function registerMessageTools(server, client) {
+  server.registerTool("ic_list_messages", {
     description: "List all parent-visible messages from three IC sources combined: (1) prism notifications (assignment alerts, grade postings, attendance alerts), (2) Messenger 2.0 inbox (teacher messages, district announcements with newMessage/actionRequired flags), and (3) portal userNotice announcements. Each section has its own count and items; if any source errors, that section contains an error field and the others still return normally. The `limit` arg caps the prism notifications only (the high-volume source). Note: listing inbox messages does not mark them as read in normal portal behavior, but some district configurations may update read-tracking; use ic_get_message for the full HTML body.",
     annotations: { readOnlyHint: true },
     inputSchema: listArgs.shape
@@ -38103,7 +38930,7 @@ function registerMessageTools(server2, client) {
     const [notifications, inbox, announcements] = await Promise.all([prismPromise, inboxPromise, noticePromise]);
     return textContent({ notifications, inbox, announcements });
   });
-  server2.registerTool("ic_get_message", {
+  server.registerTool("ic_get_message", {
     description: "Fetch the HTML body of an inbox message and return it parsed into { subject, date, body, url }. Takes a `messageUrl` which is the `url` field from an item returned by ic_list_messages' inbox section (e.g. 'portal/messageView.xsl?x=messenger.MessengerEngine-getMessageRecipientView&messageID=...'). Relative and /campus/-prefixed URLs are both accepted. Note: fetching the HTML body may mark the message as read on some district configurations; probe against an empty inbox could not confirm the side effect.",
     annotations: { readOnlyHint: true },
     inputSchema: getArgs.shape
@@ -38127,8 +38954,8 @@ var downloadArgs = external_exports.object({
   destinationPath: external_exports.string().describe("Absolute path where the PDF should be written"),
   overwrite: external_exports.boolean().optional()
 });
-function registerDocumentTools(server2, client) {
-  server2.registerTool("ic_list_documents", {
+function registerDocumentTools(server, client) {
+  server.registerTool("ic_list_documents", {
     description: "List a student's available documents (report cards, transcripts, schedules). Returns metadata only \u2014 use ic_download_document to fetch the file. Returns FeatureDisabled if the district has the module turned off.",
     annotations: { readOnlyHint: true },
     inputSchema: listArgs2.shape
@@ -38158,7 +38985,7 @@ function registerDocumentTools(server2, client) {
       throw e;
     }
   });
-  server2.registerTool("ic_download_document", {
+  server.registerTool("ic_download_document", {
     description: "Download a student's document (PDF) to disk. documentId is the url field returned by ic_list_documents. Returns FeatureDisabled if the district has the module turned off.",
     annotations: { destructiveHint: true },
     inputSchema: downloadArgs.shape
@@ -38185,8 +39012,8 @@ var argsSchema8 = external_exports.object({
   since: external_exports.string().describe("YYYY-MM-DD; include only days on or after this date").optional(),
   until: external_exports.string().describe("YYYY-MM-DD; include only days on or before this date").optional()
 });
-function registerCalendarTools(server2, client) {
-  server2.registerTool("ic_list_school_days", {
+function registerCalendarTools(server, client) {
+  server.registerTool("ic_list_school_days", {
     description: "List a student's school days (instructional calendar) grouped by term. Returns one entry per enrollment, with term boundaries (Q1-Q4 start/end dates) and the school days inside each term \u2014 including comments like 'Teacher Workday' or 'Spring Break'. Use since/until to narrow the range.",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema8.shape
@@ -38281,8 +39108,8 @@ function trimEvent(e) {
   }
   return out;
 }
-function registerAttendanceEventsTools(server2, client) {
-  server2.registerTool("ic_list_attendance_events", {
+function registerAttendanceEventsTools(server, client) {
+  server.registerTool("ic_list_attendance_events", {
     description: "List individual attendance events (absences, tardies, early releases) for a student. Each event has a code, description, excuse reason, and optional human-readable comments. Auto-resolves enrollmentID from the student record. Use since/until to filter by date and excusedOnly to show only excused events.",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema9.shape
@@ -38353,8 +39180,8 @@ function defaultSinceDate(now) {
   d.setUTCDate(d.getUTCDate() - 14);
   return d.toISOString().substring(0, 10);
 }
-function registerRecentGradesTools(server2, client) {
-  server2.registerTool("ic_list_recent_grades", {
+function registerRecentGradesTools(server, client) {
+  server.registerTool("ic_list_recent_grades", {
     description: "List recently-graded assignments for a student. Server-side filtered by scoreModifiedDate. Pass since=YYYY-MM-DD to set the cutoff; defaults to 14 days ago.",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema10.shape
@@ -38404,8 +39231,8 @@ function trimRecord(raw) {
   }
   return out;
 }
-function registerTeacherTools(server2, client) {
-  server2.registerTool("ic_list_teachers", {
+function registerTeacherTools(server, client) {
+  server.registerTool("ic_list_teachers", {
     description: "List a student's teachers (per enrolled section) and assigned counselor(s). Combines two endpoints (section/contacts and studentCounselor/byUser). Response field shapes may vary slightly by district \u2014 core fields (firstName, lastName, email) are consistent; additional fields are passed through.",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema11.shape
@@ -38438,8 +39265,8 @@ var argsSchema12 = external_exports.object({
   district: external_exports.string(),
   studentId: external_exports.string().describe("Student personID from ic_list_students")
 });
-function registerAssessmentTools(server2, client) {
-  server2.registerTool("ic_list_assessments", {
+function registerAssessmentTools(server, client) {
+  server.registerTool("ic_list_assessments", {
     description: "List a student's standardized test scores (state, national, district tests). Auto-resolves calendarID from each of the student's enrollments and returns one entry per enrollment. The shape of individual test records varies by district and test type \u2014 fields are passed through unchanged.",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema12.shape
@@ -38489,8 +39316,8 @@ var argsSchema13 = external_exports.object({
   district: external_exports.string(),
   studentId: external_exports.string().describe("Student personID from ic_list_students")
 });
-function registerFeeTools(server2, client) {
-  server2.registerTool("ic_list_fees", {
+function registerFeeTools(server, client) {
+  server.registerTool("ic_list_fees", {
     description: "List a student's fee assignments (charges owed) and running balance/surplus. Combines two endpoints: fee assignments and totalSurplus. Returns FeatureDisabled only if both endpoints 404; if only one works, returns that side with warning: 'PartialSuccess' and an issues[] explaining which endpoint failed.",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema13.shape
@@ -38533,8 +39360,8 @@ var argsSchema14 = external_exports.object({
   district: external_exports.string(),
   studentId: external_exports.string().describe("Student personID from ic_list_students")
 });
-function registerFeaturesTools(server2, client) {
-  server2.registerTool("ic_get_features", {
+function registerFeaturesTools(server, client) {
+  server.registerTool("ic_get_features", {
     description: "List the district's displayOptions feature-flag allow-list for each of a student's enrollments. Each enrollment's `features` object is a map of ~90 flag names (attendance, behavior, assessment, documents, grades, schedule, etc.) to booleans. A `false` value means the district has that feature disabled for this enrollment; `true` or missing means it's available. Used internally by other tools to short-circuit disabled features, but exposed here so the LLM can answer capability questions directly.",
     annotations: { readOnlyHint: true },
     inputSchema: argsSchema14.shape
@@ -38557,12 +39384,11 @@ function registerFeaturesTools(server2, client) {
 }
 
 // src/index.ts
-try {
-  const { config: config2 } = await import("dotenv");
-  const __dirname = dirname2(fileURLToPath(import.meta.url));
-  config2({ path: join2(__dirname, "..", ".env"), override: false, quiet: true });
-} catch {
-}
+await loadDotenvSafely({
+  path: join2(dirname2(fileURLToPath(import.meta.url)), "..", ".env"),
+  override: false
+});
+var AI_NOTICE = "[infinitecampus-mcp] Developed and maintained by AI (Claude). Use at your own discretion.";
 var account = null;
 var preloaded;
 var source;
@@ -38575,32 +39401,39 @@ try {
 } catch (e) {
   configError = e;
 }
-var server = new McpServer({ name: "infinitecampus", version: "2.3.1" });
+var COMMON = {
+  name: "infinitecampus",
+  version: "2.3.3"
+  // x-release-please-version
+};
 if (account) {
   const client = new ICClient(account, { preloaded });
-  registerDistrictTools(server, client);
-  registerStudentTools(server, client);
-  registerScheduleTools(server, client);
-  registerAssignmentTools(server, client);
-  registerGradeTools(server, client);
-  registerAttendanceTools(server, client);
-  registerBehaviorTools(server, client);
-  registerFoodServiceTools(server, client);
-  registerMessageTools(server, client);
-  registerDocumentTools(server, client);
-  registerCalendarTools(server, client);
-  registerAttendanceEventsTools(server, client);
-  registerRecentGradesTools(server, client);
-  registerTeacherTools(server, client);
-  registerAssessmentTools(server, client);
-  registerFeeTools(server, client);
-  registerFeaturesTools(server, client);
+  const tools = [
+    registerDistrictTools,
+    registerStudentTools,
+    registerScheduleTools,
+    registerAssignmentTools,
+    registerGradeTools,
+    registerAttendanceTools,
+    registerBehaviorTools,
+    registerFoodServiceTools,
+    registerMessageTools,
+    registerDocumentTools,
+    registerCalendarTools,
+    registerAttendanceEventsTools,
+    registerRecentGradesTools,
+    registerTeacherTools,
+    registerAssessmentTools,
+    registerFeeTools,
+    registerFeaturesTools
+  ];
   const suffix = source === "fetchproxy" ? " [via fetchproxy]" : "";
-  console.error(`[infinitecampus-mcp] District: ${account.name} (${account.baseUrl})${suffix}`);
+  const districtLine = `[infinitecampus-mcp] District: ${account.name} (${account.baseUrl})${suffix}`;
+  await runMcp({ ...COMMON, deps: client, tools, banner: `${districtLine}
+${AI_NOTICE}` });
 } else {
-  console.error(`[infinitecampus-mcp] Not configured: ${configError?.message ?? "unknown error"}`);
-  console.error("[infinitecampus-mcp] Server is running with no tools registered. Set the required env vars and reinstall.");
+  const notConfigured = `[infinitecampus-mcp] Not configured: ${configError?.message ?? "unknown error"}
+[infinitecampus-mcp] Server is running with no tools registered. Set the required env vars and reinstall.`;
+  await runMcp({ ...COMMON, tools: [], banner: `${notConfigured}
+${AI_NOTICE}` });
 }
-console.error("[infinitecampus-mcp] Developed and maintained by AI (Claude). Use at your own discretion.");
-var transport = new StdioServerTransport();
-await server.connect(transport);