infinitecampus-mcp 2.3.4 → 2.3.6

package/dist/bundle.js

@@ -13,7 +13,11 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -34685,6 +34689,25 @@ async function runMcp(opts) {
   return server;
 }
 
+// node_modules/@chrischall/mcp-utils/dist/errors/index.js
+var API_KEY_RE = new RegExp([
+  "sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])",
+  // OpenAI / Anthropic (incl. sk-ant-…)
+  "gh[pousr]_[A-Za-z0-9]{36,}\\b",
+  // GitHub ghp_/gho_/ghu_/ghs_/ghr_
+  "xox[baprs]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])",
+  // Slack
+  "AIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])",
+  // Google API key (39 chars total)
+  "AKIA[0-9A-Z]{16}\\b",
+  // AWS access key id (20 chars total)
+  "whsec_[A-Za-z0-9]{16,}\\b"
+  // webhook signing secret (Stripe-style)
+].map((p) => `\\b${p}`).join("|"), "g");
+var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
+
 // node_modules/@chrischall/mcp-utils/dist/response/index.js
 function textResult(data) {
   return {
@@ -34737,23 +34760,38 @@ async function loadDotenvSafely(opts = {}) {
 }
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
-var MAX_AGE_ZERO_RE = /(?:^|;)\s*Max-Age\s*=\s*0\s*(?:;|$)/i;
-var EXPIRES_EPOCH_RE = /(?:^|;)\s*Expires\s*=\s*Thu,\s*01\s*Jan\s*1970/i;
+var MAX_AGE_RE = /(?:^|;)\s*Max-Age\s*=\s*(-?\d+)\s*(?:;|$)/i;
+var EXPIRES_RE = /(?:^|;)\s*Expires\s*=\s*([^;]+)/i;
+var EXPIRES_DELETION_YEAR = 2e3;
+function isDeletionCookie(entry) {
+  const maxAge = MAX_AGE_RE.exec(entry);
+  if (maxAge)
+    return Number(maxAge[1]) <= 0;
+  const expires = EXPIRES_RE.exec(entry);
+  if (expires && expires[1]) {
+    const when = new Date(expires[1].trim());
+    if (!Number.isNaN(when.getTime()))
+      return when.getUTCFullYear() < EXPIRES_DELETION_YEAR;
+  }
+  return false;
+}
+function parseNameValue(entry) {
+  const nameValue = (entry.split(";")[0] ?? "").trim();
+  const eqIdx = nameValue.indexOf("=");
+  if (eqIdx < 1)
+    return null;
+  return { name: nameValue.slice(0, eqIdx).trim(), value: nameValue.slice(eqIdx + 1).trim() };
+}
 function parseCookieJar(setCookieHeaders) {
-  const entries = setCookieHeaders == null ? [] : Array.isArray(setCookieHeaders) ? setCookieHeaders : splitSetCookie(setCookieHeaders);
+  const entries = setCookieEntries(setCookieHeaders);
   const jar = /* @__PURE__ */ new Map();
   for (const entry of entries) {
-    if (MAX_AGE_ZERO_RE.test(entry) || EXPIRES_EPOCH_RE.test(entry))
-      continue;
-    const nameValue = (entry.split(";")[0] ?? "").trim();
-    const eqIdx = nameValue.indexOf("=");
-    if (eqIdx < 1)
+    if (isDeletionCookie(entry))
       continue;
-    const name = nameValue.slice(0, eqIdx).trim();
-    const value = nameValue.slice(eqIdx + 1).trim();
-    if (!value)
+    const pair = parseNameValue(entry);
+    if (!pair || !pair.value)
       continue;
-    jar.set(name, value);
+    jar.set(pair.name, pair.value);
   }
   const cookies = {};
   for (const [k, v] of jar)
@@ -34761,6 +34799,18 @@ function parseCookieJar(setCookieHeaders) {
   const cookieHeader = [...jar.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
   return { cookies, cookieHeader };
 }
+function setCookieEntries(source2) {
+  if (source2 == null)
+    return [];
+  if (Array.isArray(source2))
+    return source2;
+  if (typeof source2 === "string")
+    return splitSetCookie(source2);
+  if (typeof source2.getSetCookie === "function")
+    return source2.getSetCookie();
+  const joined = source2.get("set-cookie");
+  return joined ? splitSetCookie(joined) : [];
+}
 function splitSetCookie(header) {
   return header.split(/,(?=\s*[^;,\s]+\s*=)/).map((s) => s.trim()).filter((s) => s.length > 0);
 }
@@ -34771,6 +34821,8 @@ var NonNegInt = external_exports.number().int().nonnegative();
 var NonEmptyString = external_exports.string().min(1);
 var IsoDate = external_exports.iso.date();
 var IsoTime = external_exports.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/, "must be HH:MM (24h), e.g. 19:30");
+var NumericIdString = external_exports.string().regex(/^\d+$/, "must be a numeric id (digits only)").describe("A numeric id string (digits only), safe to interpolate into a URL path.");
+var SafePathSegment = external_exports.string().min(1).regex(/^[^/?#\s]+$/, 'must not contain "/", "?", "#", or whitespace').refine((v) => !v.includes(".."), 'must not contain ".."').describe('A single URL path segment, safe to interpolate: no "/", "..", "?", "#", or whitespace.');
 var schemaOrigin = external_exports.string().optional().describe("Portal origin (e.g. https://<vendor>.example.co) selecting which active session to use. Optional when only one session is active.");
 var schemaConfirm = external_exports.boolean().optional().describe("Must be true to proceed. Without this, the tool returns a preview.");
 var paginationSchema = {
@@ -35738,10 +35790,20 @@ async function openEncryptedFrame(sessionKey, frame) {
 
 // node_modules/@fetchproxy/server/dist/election.js
 import { createServer, Server as HttpServer } from "node:http";
+var DEFAULT_BIND_TIMEOUT_MS = 5e3;
 async function electRole(opts) {
   const server = createServer();
+  const bindTimeoutMs = opts.bindTimeoutMs ?? DEFAULT_BIND_TIMEOUT_MS;
   return new Promise((resolve, reject) => {
+    let timer;
+    const clearBindTimer = () => {
+      if (timer) {
+        clearTimeout(timer);
+        timer = void 0;
+      }
+    };
     const onError = (e) => {
+      clearBindTimer();
       server.removeListener("listening", onListening);
       if (e.code === "EADDRINUSE") {
         try {
@@ -35754,11 +35816,25 @@ async function electRole(opts) {
       }
     };
     const onListening = () => {
+      clearBindTimer();
       server.removeListener("error", onError);
       resolve({ role: "host", server });
     };
     server.once("error", onError);
     server.once("listening", onListening);
+    if (bindTimeoutMs > 0) {
+      timer = setTimeout(() => {
+        server.removeListener("error", onError);
+        server.removeListener("listening", onListening);
+        try {
+          server.close();
+        } catch {
+        }
+        reject(new Error(`fetchproxy: bind to ${opts.host}:${opts.port} timed out after ${bindTimeoutMs}ms (port may be in a bad state)`));
+      }, bindTimeoutMs);
+      if (typeof timer.unref === "function")
+        timer.unref();
+    }
     server.listen(opts.port, opts.host);
   });
 }
@@ -35851,6 +35927,44 @@ var SessionState = class {
   }
 };
 
+// node_modules/@fetchproxy/server/dist/session-ready.js
+var SESSION_READY_TIMEOUT_MS = 3e4;
+var FetchproxySessionNotReadyError = class extends Error {
+  reason;
+  pairCode;
+  mcpId;
+  hint;
+  constructor(info) {
+    const pairing = info.pairCode !== null && info.pairCode !== "";
+    const hint = pairing ? `Open the Transporter extension popup and approve pair code ${info.pairCode} for "${info.mcpId}", then retry.` : `The extension is connected but hasn't confirmed a session for "${info.mcpId}" \u2014 sign in to the target site in that browser (and approve the requested scope if it changed), then retry.`;
+    super(`fetchproxy: ${pairing ? "pairing not yet approved" : "no confirmed browser session"} for "${info.mcpId}". ${hint}`);
+    this.name = "FetchproxySessionNotReadyError";
+    this.reason = pairing ? "pair-required" : "not-ready";
+    this.pairCode = pairing ? info.pairCode : null;
+    this.mcpId = info.mcpId;
+    this.hint = hint;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+async function awaitSessionReady(ready, opts) {
+  const ms = opts.timeoutMs ?? SESSION_READY_TIMEOUT_MS;
+  if (ms <= 0)
+    return ready;
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      reject(new FetchproxySessionNotReadyError({ mcpId: opts.mcpId, pairCode: opts.pendingPairCode() }));
+    }, ms);
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([ready, timeout]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+
 // node_modules/@fetchproxy/server/dist/host.js
 var PUBLIC_ORIGIN_RE = /^https?:\/\/(?!(127\.0\.0\.1|localhost)(:|$))/i;
 var enc2 = new TextEncoder();
@@ -35938,6 +36052,29 @@ async function startHost(opts) {
           return;
         }
         if (frame.type === "hello" && frame.role === "server") {
+          const peerEdPub = fromB64(frame.identityEd25519Pub);
+          const peerSigMsg = concatBytes(enc2.encode(frame.mcpId), fromB64(frame.sessionNonce));
+          const peerSig = fromB64(frame.sessionSig);
+          let peerSigOk = false;
+          try {
+            peerSigOk = await ed25519Verify(peerEdPub, peerSigMsg, peerSig);
+          } catch {
+            peerSigOk = false;
+          }
+          if (!peerSigOk) {
+            console.warn("[fetchproxy] peer hello signature invalid \u2014 refusing registration (possible squatter)");
+            ws.close(1008, "peer hello signature invalid");
+            return;
+          }
+          const existing = peers.get(frame.mcpId);
+          if (existing && existing.ws !== ws) {
+            const existingEdPub = existing.helloFrame.identityEd25519Pub;
+            if (existingEdPub !== frame.identityEd25519Pub) {
+              console.warn("[fetchproxy] peer mcpId already mapped to a different identity \u2014 refusing (mcpId squatting)");
+              ws.close(1008, "mcpId already registered to another identity");
+              return;
+            }
+          }
           identified = "peer";
           peerMcpId = frame.mcpId;
           peers.set(frame.mcpId, { ws, helloFrame: frame });
@@ -36030,8 +36167,10 @@ async function startHost(opts) {
         resetSessionPromise();
         disconnectListeners.forEach((cb) => cb());
       }
-      if (identified === "peer" && peerMcpId)
-        peers.delete(peerMcpId);
+      if (identified === "peer" && peerMcpId) {
+        if (peers.get(peerMcpId)?.ws === ws)
+          peers.delete(peerMcpId);
+      }
     });
   });
   return {
@@ -36047,7 +36186,10 @@ async function startHost(opts) {
       });
     }),
     sendOwnInner: async (inner) => {
-      const session = await ownSessionReady;
+      const session = await awaitSessionReady(ownSessionReady, {
+        mcpId: opts.ownMcpId,
+        pendingPairCode: () => ownPendingPairCode
+      });
       if (!extensionWs)
         throw new Error("host: no extension connected");
       const sealed = await sealInnerFrame(session.sessionKey, opts.ownMcpId, session.nextOutboundSeq(), inner);
@@ -36152,7 +36294,10 @@ async function startPeer(opts) {
     ws,
     session: sessionPromise,
     sendInner: async (inner) => {
-      await sessionPromise;
+      await awaitSessionReady(sessionPromise, {
+        mcpId: opts.mcpId,
+        pendingPairCode: () => pendingPairCode
+      });
       const s = session;
       const sealed = await sealInnerFrame(s.sessionKey, opts.mcpId, s.nextOutboundSeq(), inner);
       ws.send(JSON.stringify(sealed));
@@ -36818,6 +36963,35 @@ var FetchproxyServer = class {
       this.keepAliveTimer = null;
     }
   }
+  /**
+   * Send an inner request frame via whichever bridge handle is active. If the
+   * send throws (e.g. `FetchproxySessionNotReadyError` — the session never
+   * confirmed), the frame never reached the bridge, so no reply will arrive:
+   * drop the just-registered pending resolver for this id (it lives in exactly
+   * one of the op maps — request ids are unique) so it doesn't leak until the
+   * server closes, then rethrow.
+   */
+  async sendInnerFrame(inner) {
+    try {
+      if (this.hostHandle) {
+        await this.hostHandle.sendOwnInner(inner);
+      } else if (this.peerHandle) {
+        await this.peerHandle.sendInner(inner);
+      }
+    } catch (err) {
+      if ("id" in inner && typeof inner.id === "number") {
+        const { id } = inner;
+        this.pending.delete(id);
+        this.pendingReadCookies.delete(id);
+        this.pendingStorage.delete(id);
+        this.pendingCapture.delete(id);
+        this.pendingRedirect.delete(id);
+        this.pendingDownload.delete(id);
+        this.pendingIdb.delete(id);
+      }
+      throw err;
+    }
+  }
   /**
    * Single bridge round-trip, wrapped by `fetchTimeoutMs` when set.
    * On timeout returns the `{ok:false, kind:'timeout'}` envelope —
@@ -36829,11 +37003,7 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve) => {
       this.pending.set(id, resolve);
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
+    await this.sendInnerFrame(inner);
     const timeoutMs = this.opts.fetchTimeoutMs;
     if (timeoutMs === void 0 || timeoutMs <= 0)
       return pending;
@@ -36862,6 +37032,51 @@ var FetchproxyServer = class {
         clearTimeout(timer);
     }
   }
+  /**
+   * FP-B2: bound a non-`fetch` verb's reply wait by `fetchTimeoutMs`.
+   *
+   * Before this, only `fetch()` raced its `pending` reply against a timer
+   * (`_fetchOnceWithTimeout`); `readCookies`, the storage reads,
+   * `capture_request_header`, `capture_redirect`, `download`, and
+   * `read_indexed_db` awaited their `pending` promise with no race, so a
+   * wedged extension hung the tool call indefinitely.
+   *
+   * `pending` is the already-registered reply promise. `pendingMap`/`id`
+   * point at the op-specific map entry so we can drop it on expiry exactly
+   * as `_fetchOnceWithTimeout` does — otherwise a late bridge reply would
+   * resolve into a stale resolver / leak. On timeout we reject with a
+   * `FetchproxyTimeoutError` (the same throwable the convenience methods
+   * already surface for fetch timeouts). `0`/unset opts out (unbounded),
+   * matching the fetch path.
+   */
+  async _withVerbTimeout(pending, pendingMap, id, url2) {
+    const timeoutMs = this.opts.fetchTimeoutMs;
+    if (timeoutMs === void 0 || timeoutMs <= 0)
+      return pending;
+    let timer;
+    const start = Date.now();
+    try {
+      return await Promise.race([
+        pending,
+        new Promise((_resolve, reject) => {
+          timer = setTimeout(() => {
+            pendingMap.delete(id);
+            reject(new FetchproxyTimeoutError({
+              url: url2,
+              timeoutMs,
+              role: this.role,
+              port: this.opts.port,
+              elapsedMs: Date.now() - start,
+              retryAttempted: false
+            }));
+          }, timeoutMs);
+        })
+      ]);
+    } finally {
+      if (timer)
+        clearTimeout(timer);
+    }
+  }
   /**
    * Map an `ok:false` fetch result to its typed throwable. Centralizes
    * the kind-to-error-class switch so `request()` and (via the same
@@ -37152,12 +37367,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve) => {
       this.pendingReadCookies.set(id, resolve);
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    const result = await pending;
+    await this.sendInnerFrame(inner);
+    const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
     if (!result.ok) {
       throw new FetchproxyProtocolError(result.error);
     }
@@ -37223,12 +37434,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingStorage.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingStorage, id, `https://${host}`);
   }
   /**
    * 0.3.0+: snapshot the next outgoing request's named header. Single-
@@ -37332,12 +37539,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingCapture.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingCapture, id, `https://${opts.host}${opts.path ?? "/*"}`);
   }
   /**
    * Snapshot the redirect target URL of the next request the browser
@@ -37421,12 +37624,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingRedirect.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingRedirect, id, `https://${opts.host}${opts.path ?? "/*"}`);
   }
   /**
    * Download `url` through the BROWSER's own network stack via
@@ -37507,12 +37706,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingDownload.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingDownload, id, opts.url);
   }
   /**
    * 0.4.0+: read declared IndexedDB keys from the user's signed-in
@@ -37559,12 +37754,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingIdb.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
   }
   assertScopeSubset(requested, declared, label) {
     const undeclared = undeclaredKeys(requested, declared);
@@ -38000,7 +38191,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "infinitecampus-mcp",
-  version: "2.3.4",
+  version: "2.3.6",
   mcpName: "io.github.chrischall/infinitecampus-mcp",
   description: "Infinite Campus (Campus Parent) MCP server \u2014 multi-district read + message/document write",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -38042,16 +38233,16 @@ var package_default = {
     "test:watch": "vitest"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.5.0",
+    "@chrischall/mcp-utils": "^0.12.0",
     "@fetchproxy/bootstrap": "^1.0.0",
     "@fetchproxy/server": "^1.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
-    "node-html-parser": "^7.1.0",
+    "node-html-parser": "^8.0.2",
     zod: "^4.4.3"
   },
   devDependencies: {
-    "@types/node": "^25.9.1",
+    "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.7",
     esbuild: "^0.28.0",
     typescript: "^6.0.3",
@@ -38130,10 +38321,163 @@ async function resolveAuth() {
 // src/client.ts
 import { writeFile as writeFile2, stat } from "fs/promises";
 import { dirname } from "path";
+
+// node_modules/@chrischall/mcp-utils/dist/session/index.js
+var TOKEN_REFRESH_SKEW_MS = 5 * 60 * 1e3;
+var CookieSessionManager = class {
+  session;
+  inFlight;
+  /** A cached *permanent* config error: once set, every `ensure` rethrows it. */
+  permanentError;
+  /** When the current session was minted (login) or installed (seed) — for maxAgeMs. */
+  sessionAt = 0;
+  loginFn;
+  isExpiredFn;
+  isPermanentErrorFn;
+  maxAgeMs;
+  now;
+  onReplayLoginErrorFn;
+  constructor(opts) {
+    this.loginFn = opts.login;
+    this.isExpiredFn = opts.isExpired ?? (() => false);
+    this.isPermanentErrorFn = opts.isPermanentError ?? (() => false);
+    this.maxAgeMs = opts.maxAgeMs;
+    this.now = opts.now ?? Date.now;
+    this.onReplayLoginErrorFn = opts.onReplayLoginError;
+  }
+  /** The current session, or `undefined` before the first successful login. */
+  get current() {
+    return this.session;
+  }
+  /** True when {@link CookieSessionManagerOptions.maxAgeMs} says the session is too old. */
+  isStale() {
+    return this.maxAgeMs !== void 0 && this.now() - this.sessionAt >= this.maxAgeMs;
+  }
+  /**
+   * Return the current session, or single-flight a login if there is none.
+   *
+   * Concurrent callers share one in-flight login; the in-flight promise is
+   * cleared on settle (success OR failure) so a rejected login never sticks and
+   * the next call retries. A login error classified permanent by
+   * {@link CookieSessionManagerOptions.isPermanentError} is cached and rethrown
+   * on every later call; a transient error is not cached (next call retries).
+   * With {@link CookieSessionManagerOptions.maxAgeMs} set, a session past its
+   * TTL is invalidated first, so the call falls through to a (single-flight)
+   * re-login.
+   */
+  async ensure() {
+    if (this.session !== void 0) {
+      if (!this.isStale())
+        return this.session;
+      this.invalidate();
+    }
+    if (this.permanentError !== void 0)
+      throw this.permanentError;
+    if (this.inFlight === void 0) {
+      this.inFlight = this.runLogin();
+    }
+    return this.inFlight;
+  }
+  /**
+   * Install an externally-minted session (e.g. infinitecampus's CUPS linked-
+   * district discovery, which mints sessions outside {@link
+   * CookieSessionManagerOptions.login}). The seed becomes the current session
+   * with a fresh {@link CookieSessionManagerOptions.maxAgeMs} clock, and any
+   * in-flight login is DETACHED: its waiters still receive its result, but a
+   * late resolution will not overwrite the seed. A cached permanent config
+   * error is left intact — the login path is still misconfigured, and the next
+   * post-seed re-login should keep saying so.
+   */
+  seed(session) {
+    this.session = session;
+    this.sessionAt = this.now();
+    this.inFlight = void 0;
+  }
+  /**
+   * One login attempt. Self-clears `inFlight` on settle so a rejected login
+   * never sticks, and stamps the resulting session only while it's still the
+   * live attempt (an `invalidate()` mid-flight cleared `inFlight` — a stale
+   * resolution must not re-stamp the dropped session over the new state).
+   */
+  runLogin() {
+    const holder = {};
+    holder.p = (async () => {
+      try {
+        const session = await this.loginFn();
+        if (this.inFlight === holder.p) {
+          this.session = session;
+          this.sessionAt = this.now();
+        }
+        return session;
+      } catch (err) {
+        if (this.isPermanentErrorFn(err))
+          this.permanentError = err;
+        throw err;
+      } finally {
+        if (this.inFlight === holder.p)
+          this.inFlight = void 0;
+      }
+    })();
+    return holder.p;
+  }
+  /**
+   * Drop the current session (and any in-flight login) so the next
+   * {@link ensure} re-runs {@link CookieSessionManagerOptions.login}. Does NOT
+   * clear a cached permanent config error — that only clears on a fresh process
+   * (new config). Used to recover from a detected session expiry.
+   */
+  invalidate() {
+    this.session = void 0;
+    this.inFlight = void 0;
+  }
+  /**
+   * Run an authenticated `call` with the current session and reactive
+   * expiry-replay. `call` receives the session and returns a `Response`. If
+   * {@link CookieSessionManagerOptions.isExpired} flags the response, the
+   * session is invalidated, a single-flight re-login runs, and `call` is
+   * replayed EXACTLY once. A persistent expiry surfaces the (second) response
+   * rather than looping. If the re-login itself fails, the original
+   * (expired-looking) response is returned so the caller can surface a clean
+   * sign-in error rather than the login failure.
+   *
+   * `call` resolves to `R` (the generic response type, default {@link Response});
+   * the manager passes it untouched to {@link CookieSessionManagerOptions.isExpired}
+   * and returns it untouched, so a custom transport type flows through cleanly.
+   */
+  async withSession(call) {
+    const session = await this.ensure();
+    const res = await call(session);
+    if (!await this.isExpiredFn(res))
+      return res;
+    if (this.current === session)
+      this.invalidate();
+    let fresh;
+    try {
+      fresh = await this.ensure();
+    } catch (err) {
+      this.onReplayLoginErrorFn?.(err);
+      return res;
+    }
+    return call(fresh);
+  }
+};
+function createCookieSessionManager(opts) {
+  return new CookieSessionManager(opts);
+}
+
+// src/client.ts
 var SESSION_TTL_MS = 5 * 60 * 60 * 1e3;
 var ICClient = class {
   accounts = /* @__PURE__ */ new Map();
-  sessions = /* @__PURE__ */ new Map();
+  /**
+   * One CookieSessionManager per district (primary + each discovered linked
+   * district). The manager owns the session lifecycle: single-flight login,
+   * `withSession` exactly-one 401 replay, `invalidate()`, permanent-error
+   * caching, proactive `maxAgeMs` (SESSION_TTL_MS) expiry, and — for linked
+   * districts — the CUPS-minted session installed via `seed()` during
+   * discovery.
+   */
+  managers = /* @__PURE__ */ new Map();
   linkedTo = /* @__PURE__ */ new Map();
   // linkedDistrictName → primaryDistrictName
   primaryName;
@@ -38147,6 +38491,8 @@ var ICClient = class {
    */
   fetchproxyMode = false;
   fetchproxyDiscoveryRan = false;
+  /** fetchproxy cookies, consumed by the primary manager's first login. */
+  preloaded = null;
   /**
    * `preloaded` is the fetchproxy escape hatch: when set, the client treats
    * the supplied cookies as a freshly-completed login on the primary account.
@@ -38159,21 +38505,66 @@ var ICClient = class {
   constructor(account2, opts = {}) {
     this.accounts.set(account2.name, account2);
     this.primaryName = account2.name;
+    this.managers.set(account2.name, this.makeManager(account2));
     if (opts.preloaded) {
-      this.sessions.set(account2.name, {
-        cookie: opts.preloaded.cookieHeader,
-        xsrfToken: opts.preloaded.xsrfToken,
-        loggedInAt: Date.now(),
-        loginInFlight: null
-      });
+      this.preloaded = opts.preloaded;
       this.fetchproxyMode = true;
     }
   }
+  /**
+   * Build the per-district CookieSessionManager.
+   *
+   * - `maxAgeMs: SESSION_TTL_MS` makes `ensure()` proactively invalidate and
+   *   re-login a session older than 5h (single-flight), replacing IC's old
+   *   hand-rolled `ensureFresh` wrapper. `now` reads `Date.now` at call time so
+   *   the clock stays mockable in tests.
+   * - `isPermanentError` caches the one config error the process can never
+   *   recover from (fetchproxy no-creds) so `ensure()` fails fast instead of
+   *   pointlessly retrying a login that can never succeed.
+   * - `onReplayLoginError` rethrows the re-login failure from `withSession`'s
+   *   expiry-replay path. By default that failure is swallowed and the stale
+   *   401 returned; rethrowing surfaces the actionable error (e.g. fetchproxy's
+   *   "sign back into your IC portal in the browser") to the caller instead of
+   *   a generic SessionExpiredError — the behavior IC's `lastLoginError`
+   *   bookkeeping used to provide.
+   */
+  makeManager(account2) {
+    return createCookieSessionManager({
+      login: () => this.login(account2),
+      isExpired: (res) => this.detectExpiredSession(account2.name, res),
+      isPermanentError: (e) => e instanceof AuthFailedError && e.permanent,
+      maxAgeMs: SESSION_TTL_MS,
+      now: () => Date.now(),
+      onReplayLoginError: (err) => {
+        throw err;
+      }
+    });
+  }
+  /**
+   * `isExpired` predicate for `withSession`: a 401 means the session died.
+   * Side effect for linked districts: the shared CUPS SSO umbrella died with
+   * it, so drop the primary and every *sibling* linked session too — the
+   * linked district's re-login (via `login()`'s linked branch) then re-logs
+   * the primary in, whose discovery re-establishes all of them. `withSession`
+   * invalidates the requesting district itself. Mirrors the old hand-rolled
+   * doRequest 401 handling.
+   */
+  detectExpiredSession(district, res) {
+    if (res.status !== 401) return false;
+    const primaryName = this.linkedTo.get(district);
+    if (primaryName) {
+      this.managers.get(primaryName).invalidate();
+      for (const linked of this.linkedTo.keys()) {
+        if (linked !== district) this.managers.get(linked).invalidate();
+      }
+    }
+    return true;
+  }
   async ensureDiscovery() {
-    await this.ensureSession(this.accounts.get(this.primaryName));
+    const session = await this.managers.get(this.primaryName).ensure();
     if (this.fetchproxyMode && !this.fetchproxyDiscoveryRan) {
       this.fetchproxyDiscoveryRan = true;
-      await this.discoverLinkedDistricts(this.accounts.get(this.primaryName));
+      await this.discoverLinkedDistricts(this.accounts.get(this.primaryName), session);
     }
   }
   listDistricts() {
@@ -38206,50 +38597,37 @@ var ICClient = class {
       account2 = this.accounts.get(district);
       if (!account2) throw new UnknownDistrictError(district, [...this.accounts.keys()]);
     }
-    await this.ensureSession(account2);
+    const session = await this.managers.get(account2.name).ensure();
     if (this.fetchproxyMode && !this.fetchproxyDiscoveryRan && account2.name === this.primaryName) {
       this.fetchproxyDiscoveryRan = true;
-      await this.discoverLinkedDistricts(account2);
-    }
-    return this.doRequest(account2, path, opts, false);
-  }
-  async ensureSession(account2) {
-    let s = this.sessions.get(account2.name);
-    if (s && Date.now() - s.loggedInAt < SESSION_TTL_MS) return;
-    if (s?.loginInFlight) {
-      await s.loginInFlight;
-      return;
-    }
-    if (!s) {
-      s = { cookie: "", xsrfToken: "", loggedInAt: 0, loginInFlight: null };
-      this.sessions.set(account2.name, s);
-    }
-    s.loginInFlight = this.login(account2);
-    try {
-      await s.loginInFlight;
-    } finally {
-      s.loginInFlight = null;
+      await this.discoverLinkedDistricts(account2, session);
     }
+    return this.doRequest(account2, path, opts);
   }
   async login(account2) {
     const primaryName = this.linkedTo.get(account2.name);
     if (primaryName) {
-      this.sessions.delete(account2.name);
-      const primaryAccount = this.accounts.get(primaryName);
-      await this.ensureSession(primaryAccount);
-      if (!this.sessions.has(account2.name)) {
+      await this.managers.get(primaryName).ensure();
+      const restored = this.managers.get(account2.name).current;
+      if (!restored) {
         throw new AuthFailedError(
           account2.name,
           "linked-district session could not be re-established via the primary district",
           { credentialHint: false }
         );
       }
-      return;
+      return restored;
+    }
+    if (this.preloaded) {
+      const { cookieHeader, xsrfToken } = this.preloaded;
+      this.preloaded = null;
+      return { cookieHeader, xsrfToken };
     }
     if (!account2.username || !account2.password) {
       throw new AuthFailedError(
         account2.name,
-        "session expired and no IC_USERNAME/IC_PASSWORD set \u2014 sign back into your IC portal in the browser and restart the MCP"
+        "session expired and no IC_USERNAME/IC_PASSWORD set \u2014 sign back into your IC portal in the browser and restart the MCP",
+        { permanent: true }
       );
     }
     const postRes = await fetch(
@@ -38282,17 +38660,17 @@ var ICClient = class {
     if (!cookies.cookieHeader) {
       throw new AuthFailedError(account2.name, "login response missing session cookies");
     }
-    const session = this.sessions.get(account2.name);
-    session.cookie = cookies.cookieHeader;
-    session.xsrfToken = cookies.xsrfToken;
-    session.loggedInAt = Date.now();
-    await this.discoverLinkedDistricts(account2);
+    const session = {
+      cookieHeader: cookies.cookieHeader,
+      xsrfToken: cookies.xsrfToken
+    };
+    await this.discoverLinkedDistricts(account2, session);
+    return session;
   }
-  async discoverLinkedDistricts(account2) {
+  async discoverLinkedDistricts(account2, session) {
     try {
-      const session = this.sessions.get(account2.name);
       const baseHeaders = {
-        Cookie: session.cookie,
+        Cookie: session.cookieHeader,
         Accept: "application/json",
         "Content-Type": "application/json",
         Referer: `${account2.baseUrl}/campus/nav-wrapper/`,
@@ -38360,13 +38738,14 @@ var ICClient = class {
             password: "(linked)"
           };
           this.accounts.set(linked.districtName, syntheticAccount);
-          this.sessions.set(linked.districtName, {
-            cookie: switchCookies.cookieHeader,
-            xsrfToken: switchCookies.xsrfToken,
-            loggedInAt: Date.now(),
-            loginInFlight: null
-          });
           this.linkedTo.set(linked.districtName, account2.name);
+          if (!this.managers.has(linked.districtName)) {
+            this.managers.set(linked.districtName, this.makeManager(syntheticAccount));
+          }
+          this.managers.get(linked.districtName).seed({
+            cookieHeader: switchCookies.cookieHeader,
+            xsrfToken: switchCookies.xsrfToken
+          });
           console.error(`[ic] Linked district discovered: ${linked.districtName} (${linked.appName})`);
         } catch (e) {
           console.error(`[ic] CUPS flow failed for ${linked.districtName}: ${e instanceof Error ? e.message : e}`);
@@ -38392,12 +38771,11 @@ var ICClient = class {
     }
     const account2 = this.accounts.get(district);
     if (!account2) throw new UnknownDistrictError(district, [...this.accounts.keys()]);
-    await this.ensureSession(account2);
-    const session = this.sessions.get(account2.name);
+    const session = await this.managers.get(account2.name).ensure();
     const url2 = /^https?:\/\//i.test(path) ? path : `${account2.baseUrl}${path}`;
     const res = await fetch(url2, {
       headers: {
-        Cookie: session.cookie,
+        Cookie: session.cookieHeader,
         ...session.xsrfToken ? { "X-XSRF-TOKEN": session.xsrfToken } : {}
       }
     });
@@ -38410,34 +38788,23 @@ var ICClient = class {
       contentType: res.headers.get("content-type") ?? "application/octet-stream"
     };
   }
-  async doRequest(account2, path, opts, isRetry) {
-    const session = this.sessions.get(account2.name);
+  async doRequest(account2, path, opts) {
+    const mgr = this.managers.get(account2.name);
     const accept = opts.responseType === "text" ? "text/html, text/plain, */*" : "application/json";
-    const res = await fetch(`${account2.baseUrl}${path}`, {
-      method: opts.method ?? "GET",
-      headers: {
-        Cookie: session.cookie,
-        Accept: accept,
-        ...session.xsrfToken ? { "X-XSRF-TOKEN": session.xsrfToken } : {},
-        ...opts.headers ?? {}
-      },
-      body: opts.body
-    });
+    const res = await mgr.withSession(
+      async (session) => fetch(`${account2.baseUrl}${path}`, {
+        method: opts.method ?? "GET",
+        headers: {
+          Cookie: session.cookieHeader,
+          Accept: accept,
+          ...session.xsrfToken ? { "X-XSRF-TOKEN": session.xsrfToken } : {},
+          ...opts.headers ?? {}
+        },
+        body: opts.body
+      })
+    );
     if (res.status === 401) {
-      if (isRetry) throw new SessionExpiredError(account2.name);
-      this.sessions.delete(account2.name);
-      const primaryName = this.linkedTo.get(account2.name);
-      if (primaryName) {
-        this.sessions.delete(primaryName);
-        for (const [linked] of this.linkedTo) {
-          this.sessions.delete(linked);
-        }
-        const primaryAccount = this.accounts.get(primaryName);
-        await this.ensureSession(primaryAccount);
-      } else {
-        await this.ensureSession(account2);
-      }
-      return this.doRequest(account2, path, opts, true);
+      throw new SessionExpiredError(account2.name);
     }
     if (res.status >= 500) throw new PortalUnreachableError(account2.name, res.status);
     if (!res.ok) throw new Error(`IC ${res.status} ${res.statusText} for ${path}`);
@@ -38450,14 +38817,11 @@ var ICClient = class {
 };
 function parseSetCookies(headers) {
   const raw = headers.getSetCookie?.() ?? [];
-  const entries = raw.length > 0 ? raw : splitFallback(headers.get("set-cookie"));
-  const { cookies, cookieHeader } = parseCookieJar(entries);
+  const { cookies, cookieHeader } = parseCookieJar(
+    raw.length > 0 ? raw : headers.get("set-cookie")
+  );
   return { cookieHeader, xsrfToken: cookies["XSRF-TOKEN"] ?? "" };
 }
-function splitFallback(header) {
-  if (!header) return [];
-  return header.split(",").map((s) => s.trim());
-}
 var UnknownDistrictError = class extends Error {
   constructor(district, available) {
     super(`Unknown district '${district}'. Configured: [${available.join(", ")}]`);
@@ -38474,6 +38838,7 @@ var AuthFailedError = class extends Error {
    *   "Check IC_USERNAME and IC_PASSWORD" suffix — used for failures where the
    *   credentials are known-good (e.g. a linked-district CUPS/SSO re-discovery
    *   failure) and pointing the user at their creds would be misleading.
+   * @param opts.permanent See {@link AuthFailedError.permanent}.
    */
   constructor(district, reason, opts) {
     const detail = reason ? ` (${reason})` : "";
@@ -38482,9 +38847,17 @@ var AuthFailedError = class extends Error {
     this.district = district;
     this.reason = reason;
     this.name = "AuthFailedError";
+    this.permanent = opts?.permanent ?? false;
   }
   district;
   reason;
+  /**
+   * A *permanent* configuration failure: retrying the login inside this
+   * process can never succeed (e.g. fetchproxy mode with no creds — the user
+   * must re-sign-in in the browser and restart). CookieSessionManager caches
+   * and rethrows permanent errors instead of retrying.
+   */
+  permanent;
 };
 var PortalUnreachableError = class extends Error {
   constructor(district, status) {
@@ -38529,40 +38902,6 @@ var FileExistsError = class extends Error {
   path;
 };
 
-// src/tools/_shared.ts
-function textContent(data) {
-  return textResult(data);
-}
-function is404(e) {
-  return e instanceof Error && e.message.startsWith("IC 404 ");
-}
-function featureDisabled(feature, district, data = []) {
-  return textContent({ warning: "FeatureDisabled", feature, district, data });
-}
-async function findStudent(client, district, studentId) {
-  const students = await client.request(district, "/campus/api/portal/students");
-  return students.find((s) => String(s.personID) === studentId) ?? null;
-}
-function studentNotFound(studentId) {
-  return textContent({ error: "StudentNotFound", studentId });
-}
-async function checkFeatureDisabled(client, district, studentId, student, flag, toolName, emptyData = []) {
-  const structureID = student.enrollments?.[0]?.structureID;
-  if (!structureID) return null;
-  try {
-    const features = await client.getFeatures(district, structureID, studentId);
-    if (features[flag] === false) return featureDisabled(toolName, district, emptyData);
-    return null;
-  } catch (e) {
-    console.error(`[ic] displayOptions check failed for ${district}/${flag}: ${e instanceof Error ? e.message : e}`);
-    return null;
-  }
-}
-function toArray(value) {
-  if (value === null || value === void 0) return [];
-  return Array.isArray(value) ? value : [value];
-}
-
 // src/tools/districts.ts
 function registerDistrictTools(server, client) {
   server.registerTool("ic_list_districts", {
@@ -38571,7 +38910,7 @@ function registerDistrictTools(server, client) {
   }, async () => {
     await client.ensureDiscovery();
     const data = client.listDistricts();
-    return textContent(data);
+    return textResult(data);
   });
 }
 
@@ -38587,7 +38926,7 @@ function registerStudentTools(server, client) {
   }, async (rawArgs) => {
     const args = argsSchema.parse(rawArgs);
     const data = await client.request(args.district, "/campus/api/portal/students");
-    return textContent(data);
+    return textResult(data);
   });
 }
 
@@ -38607,7 +38946,7 @@ function registerScheduleTools(server, client) {
     const args = argsSchema2.parse(rawArgs);
     const params = new URLSearchParams({ personID: args.studentId });
     const data = await client.request(args.district, `/campus/resources/portal/roster?${params}`);
-    return textContent(data);
+    return textResult(data);
   });
 }
 
@@ -38645,7 +38984,7 @@ function registerAssignmentTools(server, client) {
     if (args.missingOnly) {
       data = data.filter((a) => a.missing);
     }
-    return textContent(data);
+    return textResult(data);
   });
 }
 
@@ -38665,10 +39004,41 @@ function registerGradeTools(server, client) {
     const params = new URLSearchParams({ personID: args.studentId });
     if (args.termId) params.set("termID", args.termId);
     const data = await client.request(args.district, `/campus/resources/portal/grades?${params}`);
-    return textContent(data);
+    return textResult(data);
   });
 }
 
+// src/tools/_shared.ts
+function is404(e) {
+  return e instanceof Error && e.message.startsWith("IC 404 ");
+}
+function featureDisabled(feature, district, data = []) {
+  return textResult({ warning: "FeatureDisabled", feature, district, data });
+}
+async function findStudent(client, district, studentId) {
+  const students = await client.request(district, "/campus/api/portal/students");
+  return students.find((s) => String(s.personID) === studentId) ?? null;
+}
+function studentNotFound(studentId) {
+  return textResult({ error: "StudentNotFound", studentId });
+}
+async function checkFeatureDisabled(client, district, studentId, student, flag, toolName, emptyData = []) {
+  const structureID = student.enrollments?.[0]?.structureID;
+  if (!structureID) return null;
+  try {
+    const features = await client.getFeatures(district, structureID, studentId);
+    if (features[flag] === false) return featureDisabled(toolName, district, emptyData);
+    return null;
+  } catch (e) {
+    console.error(`[ic] displayOptions check failed for ${district}/${flag}: ${e instanceof Error ? e.message : e}`);
+    return null;
+  }
+}
+function toArray(value) {
+  if (value === null || value === void 0) return [];
+  return Array.isArray(value) ? value : [value];
+}
+
 // src/tools/attendance.ts
 var argsSchema5 = external_exports.object({
   district: external_exports.string(),
@@ -38733,7 +39103,7 @@ function registerAttendanceTools(server, client) {
           results.push({ ...entry, terms: trimmedTerms });
         }
       }
-      return textContent(results);
+      return textResult(results);
     } catch (e) {
       if (is404(e)) return featureDisabled("attendance", args.district);
       throw e;
@@ -38764,7 +39134,7 @@ function registerBehaviorTools(server, client) {
     if (args.until) params.set("endDate", args.until);
     try {
       const data = await client.request(args.district, `/campus/resources/portal/behavior?${params}`);
-      return textContent(data);
+      return textResult(data);
     } catch (e) {
       if (is404(e)) return featureDisabled("behavior", args.district);
       throw e;
@@ -38804,7 +39174,7 @@ function registerFoodServiceTools(server, client) {
     if (args.until) params.set("endDate", args.until);
     try {
       const data = await client.request(args.district, `/campus/resources/portal/foodService?${params}`);
-      return textContent(data);
+      return textResult(data);
     } catch (e) {
       if (is404(e)) return featureDisabled("foodService", args.district, EMPTY_FOOD);
       throw e;
@@ -38824,16 +39194,50 @@ var NAMED_ENTITIES = {
 function extractPlainTextFromHtml(html) {
   if (!html)
     return "";
-  let text = html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ");
+  let text = stripElementContent(stripElementContent(html, "script"), "style");
   text = text.replace(/<[^>]+>/g, " ");
-  text = text.replace(/&#(\d+);/g, (_, d) => String.fromCodePoint(Number(d)));
-  text = text.replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16)));
+  text = text.replace(/&#(\d+);/g, (whole, d) => codePointOr(Number(d), whole));
+  text = text.replace(/&#x([0-9a-fA-F]+);/g, (whole, h) => codePointOr(parseInt(h, 16), whole));
   text = text.replace(/&([a-zA-Z]+);/g, (whole, name) => {
     const decoded = NAMED_ENTITIES[name.toLowerCase()];
     return decoded ?? whole;
   });
   return text.replace(/\s+/g, " ").trim();
 }
+function stripElementContent(html, tag) {
+  const lower = html.toLowerCase();
+  const open = `<${tag}`;
+  const close = `</${tag}>`;
+  let out = "";
+  let i = 0;
+  for (; ; ) {
+    const start = lower.indexOf(open, i);
+    if (start < 0) {
+      out += html.slice(i);
+      return out;
+    }
+    const after = lower[start + open.length];
+    if (after !== void 0 && after !== ">" && after !== " " && after !== "	" && after !== "\n" && after !== "\r" && after !== "\f" && after !== "/") {
+      out += html.slice(i, start + open.length);
+      i = start + open.length;
+      continue;
+    }
+    out += html.slice(i, start) + " ";
+    const closeAt = lower.indexOf(close, start + open.length);
+    if (closeAt < 0)
+      return out;
+    i = closeAt + close.length;
+  }
+}
+function codePointOr(code, raw) {
+  if (!Number.isInteger(code) || code < 0 || code > 1114111)
+    return raw;
+  try {
+    return String.fromCodePoint(code);
+  } catch {
+    return raw;
+  }
+}
 
 // src/tools/messages.ts
 var listArgs = external_exports.object({
@@ -38928,7 +39332,7 @@ function registerMessageTools(server, client) {
       return { count: 0, items: [], error: e instanceof Error ? e.message : String(e) };
     });
     const [notifications, inbox, announcements] = await Promise.all([prismPromise, inboxPromise, noticePromise]);
-    return textContent({ notifications, inbox, announcements });
+    return textResult({ notifications, inbox, announcements });
   });
   server.registerTool("ic_get_message", {
     description: "Fetch the HTML body of an inbox message and return it parsed into { subject, date, body, url }. Takes a `messageUrl` which is the `url` field from an item returned by ic_list_messages' inbox section (e.g. 'portal/messageView.xsl?x=messenger.MessengerEngine-getMessageRecipientView&messageID=...'). Relative and /campus/-prefixed URLs are both accepted. Note: fetching the HTML body may mark the message as read on some district configurations; probe against an empty inbox could not confirm the side effect.",
@@ -38939,7 +39343,7 @@ function registerMessageTools(server, client) {
     const path = normalizeMessageUrl(args.messageUrl);
     const html = await client.request(args.district, path, { responseType: "text" });
     const parsed = parseMessageHtml(html ?? "", path);
-    return textContent(parsed);
+    return textResult(parsed);
   });
 }
 
@@ -38979,7 +39383,7 @@ function registerDocumentTools(server, client) {
         if (d.endYear !== void 0) out.endYear = d.endYear;
         return out;
       });
-      return textContent(trimmed);
+      return textResult(trimmed);
     } catch (e) {
       if (is404(e)) return featureDisabled("documents", args.district);
       throw e;
@@ -38995,10 +39399,10 @@ function registerDocumentTools(server, client) {
       const meta3 = await client.download(args.district, args.documentId, args.destinationPath, {
         overwrite: args.overwrite ?? false
       });
-      return textContent(meta3);
+      return textResult(meta3);
     } catch (e) {
       if (e instanceof Error && e.message.startsWith("IC download 404")) {
-        return textContent({ warning: "FeatureDisabled", feature: "documents", district: args.district });
+        return textResult({ warning: "FeatureDisabled", feature: "documents", district: args.district });
       }
       throw e;
     }
@@ -39054,7 +39458,7 @@ function registerCalendarTools(server, client) {
         terms: trimmedTerms
       });
     }
-    return textContent(result);
+    return textResult(result);
   });
 }
 
@@ -39145,7 +39549,7 @@ function registerAttendanceEventsTools(server, client) {
           results.push(trimmed);
         }
       }
-      return textContent(results);
+      return textResult(results);
     } catch (e) {
       if (is404(e)) return featureDisabled("attendance_events", args.district);
       throw e;
@@ -39201,7 +39605,7 @@ function registerRecentGradesTools(server, client) {
       }
       return out;
     });
-    return textContent(trimmed);
+    return textResult(trimmed);
   });
 }
 
@@ -39256,7 +39660,7 @@ function registerTeacherTools(server, client) {
     const [teachersRaw, counselorsRaw] = await Promise.all([teachersPromise, counselorsPromise]);
     const teachers = toArray(teachersRaw).map((t) => trimRecord(t));
     const counselors = toArray(counselorsRaw).map((c) => trimRecord(c));
-    return textContent({ counselors, teachers });
+    return textResult({ counselors, teachers });
   });
 }
 
@@ -39307,7 +39711,7 @@ function registerAssessmentTools(server, client) {
     if (feature404 && result.length === 0) {
       return featureDisabled("assessments", args.district);
     }
-    return textContent(result);
+    return textResult(result);
   });
 }
 
@@ -39351,7 +39755,7 @@ function registerFeeTools(server, client) {
       feeAssignments: assignments.ok ? assignments.value : [],
       ...issues.length > 0 ? { issues } : {}
     };
-    return textContent(response);
+    return textResult(response);
   });
 }
 
@@ -39379,7 +39783,7 @@ function registerFeaturesTools(server, client) {
         features
       });
     }
-    return textContent(result);
+    return textResult(result);
   });
 }
 
@@ -39403,7 +39807,7 @@ try {
 }
 var COMMON = {
   name: "infinitecampus",
-  version: "2.3.4"
+  version: "2.3.6"
   // x-release-please-version
 };
 if (account) {