infinitecampus-mcp 2.4.5 → 2.5.0

package/dist/bundle.js

@@ -2991,7 +2991,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve.call(this, root, ref);
+      let _sch = resolve2.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -3018,7 +3018,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve(root, ref) {
+    function resolve2(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3649,7 +3649,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve(baseURI, relativeURI, options) {
+    function resolve2(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
       const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
@@ -3933,7 +3933,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve,
+      resolve: resolve2,
       resolveComponent,
       equal,
       serialize,
@@ -9161,7 +9161,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes, createHash } = __require("crypto");
+    var { randomBytes: randomBytes2, createHash } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -9699,7 +9699,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes(16).toString("base64");
+      const key = randomBytes2(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -10593,7 +10593,7 @@ var require_websocket_server = __commonJS({
 });
 
 // src/index.ts
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/zod/v3/helpers/util.js
@@ -32554,7 +32554,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+        await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error51) {
@@ -32571,7 +32571,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const earlyReject = (error51) => {
         reject(error51);
       };
@@ -32649,7 +32649,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve(parseResult.data);
+            resolve2(parseResult.data);
           }
         } catch (error51) {
           reject(error51);
@@ -32910,12 +32910,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve, interval);
+      const timeoutId = setTimeout(resolve2, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -34006,7 +34006,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -34670,20 +34670,95 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const json2 = serializeMessage(message);
       if (this._stdout.write(json2)) {
-        resolve();
+        resolve2();
       } else {
-        this._stdout.once("drain", resolve);
+        this._stdout.once("drain", resolve2);
       }
     });
   }
 };
 
+// node_modules/@chrischall/mcp-utils/dist/errors/index.js
+var McpToolError = class extends Error {
+  /** Actionable remediation text, when one applies. */
+  hint;
+  constructor(message, opts) {
+    super(message, opts?.cause !== void 0 ? { cause: opts.cause } : void 0);
+    this.name = "McpToolError";
+    if (opts?.hint !== void 0)
+      this.hint = opts.hint;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var BEARER_RE = /(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
+var JWT_RE = /\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/g;
+var BASIC_AUTH_RE = /(authorization\s*:\s*basic\s+)[A-Za-z0-9+/=_-]{6,}/gi;
+var SET_COOKIE_RE = /(\bset-cookie\s*:\s*)([^=;,\s]+)=[^;,\s]*/gi;
+var COOKIE_HEADER_RE = /((?<!set-)\bcookie\s*:\s*)((?:[^=;,\s]+=[^;,\s]*)(?:;\s*[^=;,\s]+=[^;,\s]*)*)/gi;
+var API_KEY_RE = new RegExp([
+  "sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])",
+  // OpenAI / Anthropic (incl. sk-ant-…)
+  "gh[pousr]_[A-Za-z0-9]{36,}\\b",
+  // GitHub ghp_/gho_/ghu_/ghs_/ghr_
+  "xox[baprs]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])",
+  // Slack
+  "AIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])",
+  // Google API key (39 chars total)
+  "AKIA[0-9A-Z]{16}\\b",
+  // AWS access key id (20 chars total)
+  "whsec_[A-Za-z0-9]{16,}\\b"
+  // webhook signing secret (Stripe-style)
+].map((p) => `\\b${p}`).join("|"), "g");
+var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
+var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
+function redactSecrets(text) {
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
+}
+
+// node_modules/@chrischall/mcp-utils/dist/response/index.js
+function textResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
+function errorResult(message) {
+  return {
+    content: [{ type: "text", text: redactSecrets(message) }],
+    isError: true
+  };
+}
+
 // node_modules/@chrischall/mcp-utils/dist/server/index.js
+function hintResultOrRethrow(err) {
+  if (err instanceof McpToolError && err.hint) {
+    return errorResult(`${err.message}
+
+Hint: ${err.hint}`);
+  }
+  throw err;
+}
+function surfaceToolHints(server) {
+  const register = server.registerTool.bind(server);
+  server.registerTool = (name, config2, cb) => register(name, config2, (...args) => {
+    let result;
+    try {
+      result = cb(...args);
+    } catch (err) {
+      return hintResultOrRethrow(err);
+    }
+    return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
+  });
+}
 async function createMcpServer(opts) {
   const server = new McpServer({ name: opts.name, version: opts.version });
+  if (opts.surfaceHints !== false)
+    surfaceToolHints(server);
   if (opts.banner !== void 0) {
     console.error(opts.banner);
   }
@@ -34728,32 +34803,6 @@ async function runMcp(opts) {
   return server;
 }
 
-// node_modules/@chrischall/mcp-utils/dist/errors/index.js
-var API_KEY_RE = new RegExp([
-  "sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])",
-  // OpenAI / Anthropic (incl. sk-ant-…)
-  "gh[pousr]_[A-Za-z0-9]{36,}\\b",
-  // GitHub ghp_/gho_/ghu_/ghs_/ghr_
-  "xox[baprs]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])",
-  // Slack
-  "AIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])",
-  // Google API key (39 chars total)
-  "AKIA[0-9A-Z]{16}\\b",
-  // AWS access key id (20 chars total)
-  "whsec_[A-Za-z0-9]{16,}\\b"
-  // webhook signing secret (Stripe-style)
-].map((p) => `\\b${p}`).join("|"), "g");
-var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
-var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
-var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
-
-// node_modules/@chrischall/mcp-utils/dist/response/index.js
-function textResult(data) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
-  };
-}
-
 // node_modules/@chrischall/mcp-utils/dist/config/index.js
 var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
 function readEnvVar(key, opts = {}) {
@@ -36047,7 +36096,7 @@ var DEFAULT_BIND_TIMEOUT_MS = 5e3;
 async function electRole(opts) {
   const server = createServer();
   const bindTimeoutMs = opts.bindTimeoutMs ?? DEFAULT_BIND_TIMEOUT_MS;
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let timer;
     const clearBindTimer = () => {
       if (timer) {
@@ -36063,7 +36112,7 @@ async function electRole(opts) {
           server.close();
         } catch {
         }
-        resolve({ role: "peer" });
+        resolve2({ role: "peer" });
       } else {
         reject(e);
       }
@@ -36071,7 +36120,7 @@ async function electRole(opts) {
     const onListening = () => {
       clearBindTimer();
       server.removeListener("error", onError);
-      resolve({ role: "host", server });
+      resolve2({ role: "host", server });
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -36417,8 +36466,8 @@ async function startHost(opts) {
   let rejectOwnSession;
   let ownSessionReady;
   function resetSessionPromise() {
-    ownSessionReady = new Promise((resolve, reject) => {
-      resolveOwnSession = resolve;
+    ownSessionReady = new Promise((resolve2, reject) => {
+      resolveOwnSession = resolve2;
       rejectOwnSession = reject;
     });
     ownSessionReady.catch(() => {
@@ -36639,7 +36688,7 @@ async function startHost(opts) {
     });
   });
   return {
-    close: () => new Promise((resolve) => {
+    close: () => new Promise((resolve2) => {
       for (const client of wss.clients) {
         try {
           client.terminate();
@@ -36647,7 +36696,7 @@ async function startHost(opts) {
         }
       }
       wss.close(() => {
-        opts.httpServer.close(() => resolve());
+        opts.httpServer.close(() => resolve2());
       });
     }),
     sendOwnInner: async (inner) => {
@@ -36677,8 +36726,8 @@ async function startHost(opts) {
 var enc3 = new TextEncoder();
 async function startPeer(opts) {
   const ws = new import_websocket.default(`ws://${opts.host}:${opts.port}`);
-  await new Promise((resolve, reject) => {
-    ws.once("open", () => resolve());
+  await new Promise((resolve2, reject) => {
+    ws.once("open", () => resolve2());
     ws.once("error", reject);
   });
   const hello = await buildServerHello({
@@ -36708,8 +36757,8 @@ async function startPeer(opts) {
   let pendingPairCode = null;
   let resolveFirstReady;
   let rejectFirstReady;
-  const sessionPromise = new Promise((resolve, reject) => {
-    resolveFirstReady = resolve;
+  const sessionPromise = new Promise((resolve2, reject) => {
+    resolveFirstReady = resolve2;
     rejectFirstReady = reject;
   });
   let extensionHello = null;
@@ -36910,6 +36959,17 @@ function classifyBridgeError(err) {
 }
 
 // node_modules/@fetchproxy/server/dist/ws-server.js
+function envWsPort() {
+  const raw = process.env.FETCHPROXY_WS_PORT;
+  if (raw === void 0 || raw.trim() === "")
+    return void 0;
+  if (!/^\d+$/.test(raw.trim()))
+    return void 0;
+  const port = Number(raw.trim());
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    return void 0;
+  return port;
+}
 var FetchproxyProtocolError = class extends Error {
   constructor(message) {
     super(message);
@@ -37157,7 +37217,7 @@ var FetchproxyServer = class {
       }
     }
     this.opts = {
-      port: opts.port ?? 37149,
+      port: opts.port ?? envWsPort() ?? 37149,
       host: opts.host ?? "127.0.0.1",
       serverName: opts.serverName,
       version: opts.version,
@@ -37587,8 +37647,8 @@ var FetchproxyServer = class {
   async _fetchOnceWithTimeout(init) {
     const id = this.nextRequestId++;
     const inner = { type: "request", id, op: "fetch", init };
-    const pending = new Promise((resolve) => {
-      this.pending.set(id, resolve);
+    const pending = new Promise((resolve2) => {
+      this.pending.set(id, resolve2);
     });
     await this.sendInnerFrame(inner);
     const timeoutMs = this.opts.fetchTimeoutMs;
@@ -37599,12 +37659,12 @@ var FetchproxyServer = class {
     try {
       return await Promise.race([
         pending,
-        new Promise((resolve) => {
+        new Promise((resolve2) => {
           timer = setTimeout(() => {
             this.pending.delete(id);
             const elapsedMs = Date.now() - start;
             const error51 = `fetchproxy: ${init.url} did not respond within ${timeoutMs}ms`;
-            resolve({
+            resolve2({
               ok: false,
               error: error51,
               kind: "timeout",
@@ -37966,8 +38026,8 @@ var FetchproxyServer = class {
       const tabUrl = `https://${host}/`;
       inner = { type: "request", id, op: "read_cookies", init: { tabUrl } };
     }
-    const pending = new Promise((resolve) => {
-      this.pendingReadCookies.set(id, resolve);
+    const pending = new Promise((resolve2) => {
+      this.pendingReadCookies.set(id, resolve2);
     });
     await this.sendInnerFrame(inner);
     const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
@@ -38025,8 +38085,8 @@ var FetchproxyServer = class {
         ...cookiePath !== void 0 ? { path: cookiePath } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingWriteCookies.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingWriteCookies.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingWriteCookies, id, `https://${host}`);
@@ -38088,8 +38148,8 @@ var FetchproxyServer = class {
         ...opts.pointers ? { pointers: { ...opts.pointers } } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingStorage.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, `https://${host}`);
@@ -38193,8 +38253,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingCapture.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingCapture.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingCapture, id, `https://${opts.host}${opts.path ?? "/*"}`);
@@ -38278,8 +38338,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingRedirect.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingRedirect.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingRedirect, id, `https://${opts.host}${opts.path ?? "/*"}`);
@@ -38360,8 +38420,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingDownload.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingDownload.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingDownload, id, opts.url);
@@ -38408,8 +38468,8 @@ var FetchproxyServer = class {
         keys: [...opts.keys]
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingIdb.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingIdb.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
@@ -38448,8 +38508,8 @@ var FetchproxyServer = class {
       op: "read_dom",
       init: { origin, names: [...opts.names] }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingStorage.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
@@ -38494,8 +38554,8 @@ var FetchproxyServer = class {
         ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingGraphql.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingGraphql.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingGraphql, id, opts.name);
@@ -38985,7 +39045,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "infinitecampus-mcp",
-  version: "2.4.5",
+  version: "2.5.0",
   mcpName: "io.github.chrischall/infinitecampus-mcp",
   description: "Infinite Campus (Campus Parent) MCP server \u2014 multi-district read + message/document write",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -39017,17 +39077,20 @@ var package_default = {
     ".claude-plugin",
     "skills",
     ".mcp.json",
-    "server.json"
+    "server.json",
+    "mint.yaml"
   ],
   scripts: {
     build: "tsc && npm run bundle",
     bundle: `esbuild src/index.ts --bundle --platform=node --format=esm --external:dotenv --banner:js='import { createRequire as __createRequire } from "module"; const require = __createRequire(import.meta.url);' --outfile=dist/bundle.js`,
     dev: "node --env-file=.env dist/index.js",
-    test: "vitest run",
-    "test:watch": "vitest"
+    test: "npm run typecheck && vitest run",
+    "test:coverage": "npm run typecheck && vitest run --coverage",
+    "test:watch": "vitest",
+    typecheck: "tsc -p tsconfig.json --noEmit"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.14.0",
+    "@chrischall/mcp-utils": "^0.18.0",
     "@fetchproxy/bootstrap": "^2.0.0",
     "@fetchproxy/server": "^2.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -39138,10 +39201,128 @@ async function liftBrowserSession(account2) {
 
 // src/client.ts
 import { writeFile as writeFile3, stat } from "fs/promises";
-import { dirname } from "path";
+import { dirname as dirname2 } from "path";
 
 // node_modules/@chrischall/mcp-utils/dist/session/index.js
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
+import { dirname, join as join3, resolve } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { randomBytes, createHmac } from "node:crypto";
+function bindingDigest(secret, salt) {
+  return createHmac("sha256", salt).update(secret).digest("hex").slice(0, 32);
+}
+function isEnvelope(raw) {
+  return raw !== null && typeof raw === "object" && raw.v === 1 && "state" in raw;
+}
+var StatePersistenceError = class extends Error {
+  cause;
+  constructor(cause) {
+    super(cause instanceof Error ? cause.message : String(cause));
+    this.name = "StatePersistenceError";
+    this.cause = cause;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+function createFileStatePersistence(opts) {
+  const { filePath, validate } = opts;
+  const secret = opts.boundTo;
+  return {
+    load() {
+      if (!existsSync(filePath))
+        return null;
+      try {
+        const raw = JSON.parse(readFileSync(filePath, "utf8"));
+        let state;
+        if (isEnvelope(raw)) {
+          const b = raw.boundTo;
+          if (secret === void 0) {
+            if (b !== void 0)
+              return null;
+          } else {
+            if (b === void 0)
+              return null;
+            if (bindingDigest(secret, b.salt) !== b.digest)
+              return null;
+          }
+          state = raw.state;
+        } else {
+          if (secret !== void 0)
+            return null;
+          state = raw;
+        }
+        if (validate !== void 0)
+          return validate(state);
+        return state;
+      } catch {
+        return null;
+      }
+    },
+    save(state) {
+      const dir = dirname(filePath);
+      const tmp = `${filePath}.tmp-${randomBytes(6).toString("hex")}`;
+      const dirExisted = existsSync(dir);
+      try {
+        mkdirSync(dir, { recursive: true, mode: 448 });
+        if (!dirExisted)
+          chmodSync(dir, 448);
+        let boundTo;
+        if (secret !== void 0) {
+          const salt = randomBytes(16).toString("hex");
+          boundTo = { salt, digest: bindingDigest(secret, salt) };
+        }
+        const envelope = { v: 1, ...boundTo !== void 0 ? { boundTo } : {}, state };
+        writeFileSync(tmp, JSON.stringify(envelope, null, 2), { mode: 384 });
+        chmodSync(tmp, 384);
+        renameSync(tmp, filePath);
+        chmodSync(filePath, 384);
+      } catch (err) {
+        try {
+          if (existsSync(tmp))
+            unlinkSync(tmp);
+        } catch {
+        }
+        throw err;
+      }
+    },
+    clear() {
+      try {
+        if (existsSync(filePath))
+          unlinkSync(filePath);
+      } catch {
+      }
+    }
+  };
+}
+function homeOf(env) {
+  return readEnvVar("HOME", { env }) ?? homedir2();
+}
+function resolveStateDir(opts = {}) {
+  const env = opts.env;
+  return join3(readEnvVar("MCP_DATA_DIR", { env }) ?? homeOf(env), opts.subdir ?? "");
+}
+function resolveStateFile(opts) {
+  const override = opts.envVar !== void 0 ? readEnvVar(opts.envVar, { env: opts.env }) : void 0;
+  if (override !== void 0) {
+    if (override === "~")
+      return homeOf(opts.env);
+    if (override.startsWith("~/"))
+      return join3(homeOf(opts.env), override.slice(2));
+    return resolve(override);
+  }
+  const dirOpts = { env: opts.env };
+  if (opts.subdir !== void 0)
+    dirOpts.subdir = opts.subdir;
+  return join3(resolveStateDir(dirOpts), opts.fileName);
+}
 var TOKEN_REFRESH_SKEW_MS = 5 * 60 * 1e3;
+function isPersistedCookieSession(raw) {
+  if (raw === null || typeof raw !== "object")
+    return false;
+  const r = raw;
+  if (typeof r.sessionAt !== "number" || !Number.isFinite(r.sessionAt))
+    return false;
+  return typeof r.session === "object" && r.session !== null;
+}
 var CookieSessionManager = class {
   session;
   inFlight;
@@ -39155,6 +39336,17 @@ var CookieSessionManager = class {
   maxAgeMs;
   now;
   onReplayLoginErrorFn;
+  persistence;
+  onPersistErrorFn;
+  /** Persistence is consulted once per process; a miss must not be re-read. */
+  persistenceRead = false;
+  /**
+   * Serializes persistence writes. `seed()` and `invalidate()` are synchronous
+   * by contract and so fire-and-forget their save/clear; with an async backend a
+   * slow save could otherwise land AFTER the clear that followed it and leave an
+   * invalidated session on disk.
+   */
+  persistChain = Promise.resolve();
   constructor(opts) {
     this.loginFn = opts.login;
     this.isExpiredFn = opts.isExpired ?? (() => false);
@@ -39162,6 +39354,8 @@ var CookieSessionManager = class {
     this.maxAgeMs = opts.maxAgeMs;
     this.now = opts.now ?? Date.now;
     this.onReplayLoginErrorFn = opts.onReplayLoginError;
+    this.persistence = opts.persistence;
+    this.onPersistErrorFn = opts.onPersistError;
   }
   /** The current session, or `undefined` before the first successful login. */
   get current() {
@@ -39210,6 +39404,8 @@ var CookieSessionManager = class {
     this.session = session;
     this.sessionAt = this.now();
     this.inFlight = void 0;
+    this.persistenceRead = true;
+    void this.persist(session, this.sessionAt);
   }
   /**
    * One login attempt. Self-clears `inFlight` on settle so a rejected login
@@ -39221,13 +39417,25 @@ var CookieSessionManager = class {
     const holder = {};
     holder.p = (async () => {
       try {
+        const restored = this.persistence !== void 0 && !this.persistenceRead ? await this.restoreFromPersistence() : null;
+        if (restored !== null) {
+          if (this.inFlight === holder.p) {
+            this.session = restored.session;
+            this.sessionAt = restored.sessionAt;
+          }
+          return restored.session;
+        }
         const session = await this.loginFn();
+        const at = this.now();
         if (this.inFlight === holder.p) {
           this.session = session;
-          this.sessionAt = this.now();
+          this.sessionAt = at;
         }
+        await this.persist(session, at);
         return session;
       } catch (err) {
+        if (err instanceof StatePersistenceError)
+          throw err.cause;
         if (this.isPermanentErrorFn(err))
           this.permanentError = err;
         throw err;
@@ -39247,6 +39455,71 @@ var CookieSessionManager = class {
   invalidate() {
     this.session = void 0;
     this.inFlight = void 0;
+    void this.clearPersisted();
+  }
+  /**
+   * The persisted session, if there is one worth using. Read at most once per
+   * process — after that the in-memory session (or its absence) is the truth,
+   * so an invalidate() cannot be undone by a stale file.
+   */
+  async restoreFromPersistence() {
+    if (this.persistence === void 0 || this.persistenceRead)
+      return null;
+    this.persistenceRead = true;
+    try {
+      let raw = null;
+      await this.enqueuePersist(async () => {
+        raw = await this.persistence?.load();
+      });
+      if (!isPersistedCookieSession(raw))
+        return null;
+      if (this.maxAgeMs !== void 0 && this.now() - raw.sessionAt >= this.maxAgeMs)
+        return null;
+      return raw;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Append a persistence op to the chain, preserving call order.
+   *
+   * The RETURNED promise can reject — that is the whole `StatePersistenceError`
+   * path, and the awaited login write depends on it. Only the retained chain is
+   * swallowed, so one failed write cannot poison every later one.
+   */
+  enqueuePersist(op) {
+    const next = this.persistChain.then(op);
+    this.persistChain = next.catch(() => void 0);
+    return next;
+  }
+  /** Write the session. Silent unless `onPersistError` throws. */
+  persist(session, sessionAt) {
+    return this.enqueuePersist(async () => {
+      if (this.persistence === void 0)
+        return;
+      try {
+        await this.persistence.save({ session, sessionAt });
+      } catch (err) {
+        if (this.onPersistErrorFn === void 0)
+          return;
+        try {
+          this.onPersistErrorFn(err);
+        } catch (hookErr) {
+          throw new StatePersistenceError(hookErr);
+        }
+      }
+    });
+  }
+  /** Discard the persisted session. Never throws. */
+  clearPersisted() {
+    return this.enqueuePersist(async () => {
+      if (this.persistence?.clear === void 0)
+        return;
+      try {
+        await this.persistence.clear();
+      } catch {
+      }
+    });
   }
   /**
    * Run an authenticated `call` with the current session and reactive
@@ -39283,6 +39556,46 @@ function createCookieSessionManager(opts) {
   return new CookieSessionManager(opts);
 }
 
+// src/session-cache.ts
+function sessionCachePath(env = process.env, district) {
+  const seg = (district ?? "").trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "_").slice(0, 64);
+  return resolveStateFile({
+    env,
+    envVar: "IC_SESSION_FILE",
+    subdir: ".infinitecampus-mcp",
+    fileName: seg === "" ? "session.json" : `session-${seg}.json`
+  });
+}
+function isStored(raw) {
+  if (raw === null || typeof raw !== "object") return false;
+  const r = raw;
+  if (typeof r.sessionAt !== "number") return false;
+  const s = r.session;
+  if (s === null || typeof s !== "object") return false;
+  if (typeof s.cookieHeader !== "string" || s.cookieHeader === "") return false;
+  return typeof s.xsrfToken === "string";
+}
+function createSessionCache(opts) {
+  const env = opts.env ?? process.env;
+  if (!parseBoolEnv("IC_SESSION_CACHE", { env, default: true })) return null;
+  const username = opts.username ?? readEnvVar("IC_USERNAME", { env });
+  const password = opts.password ?? readEnvVar("IC_PASSWORD", { env });
+  if (opts.browserBacked === true) return null;
+  const boundTo = username && password ? ["login", opts.baseUrl, username.trim().toLowerCase(), password].join("\0") : null;
+  if (boundTo === null) return null;
+  return createFileStatePersistence({
+    filePath: sessionCachePath(env, opts.district),
+    boundTo,
+    validate: (raw) => isStored(raw) ? raw : null
+  });
+}
+function reportCacheWriteFailure(err) {
+  const detail = err instanceof Error ? err.message : String(err);
+  console.error(
+    `[infinitecampus-mcp] could not cache the session (${detail}); continuing without the cache \u2014 every restart will authenticate again until this is fixed.`
+  );
+}
+
 // src/client.ts
 var SESSION_TTL_MS = 5 * 60 * 60 * 1e3;
 var ICClient = class {
@@ -39308,6 +39621,32 @@ var ICClient = class {
    * first call to `ensureDiscovery()`.
    */
   fetchproxyMode = false;
+  /**
+   * Whether CUPS linked-district discovery has run IN THIS PROCESS. Not "is
+   * there a session" — a session restored from the on-disk cache is real while
+   * discovery has not run, and conflating the two leaves linked districts
+   * invisible. See {@link InfiniteCampusClient.ensureDiscovery}.
+   */
+  discoveryDone = false;
+  /**
+   * The in-flight discovery, so concurrent callers await the SAME one.
+   *
+   * A bare boolean is not enough: `discoveryDone` flips as soon as the CUPS
+   * probe answers, but `accounts`/`linkedTo` are only populated further down.
+   * A second request for a linked district landing in that window would read
+   * the flag as done, find `accounts` still empty, and throw
+   * UnknownDistrictError for a district that was moments from existing.
+   */
+  discoveryInFlight = null;
+  /**
+   * The session the last discovery attempt used.
+   *
+   * `login()` runs discovery on every fresh mint. If that probe fails without
+   * latching, `ensureDiscovery` would immediately re-probe with the very same
+   * session and fail identically — two requests for one answer. Retrying is
+   * right; retrying the same session inside one call is not.
+   */
+  lastDiscoverySession = null;
   /**
    * fetchproxy lift. Called by the primary manager's login — on the first
    * request AND on every renewal, which is what keeps the path alive past
@@ -39328,11 +39667,11 @@ var ICClient = class {
   constructor(account2, opts = {}) {
     this.accounts.set(account2.name, account2);
     this.primaryName = account2.name;
-    this.managers.set(account2.name, this.makeManager(account2));
     if (opts.refreshSession) {
       this.refreshSession = opts.refreshSession;
       this.fetchproxyMode = true;
     }
+    this.managers.set(account2.name, this.makeManager(account2));
   }
   /**
    * Build the per-district CookieSessionManager.
@@ -39352,8 +39691,17 @@ var ICClient = class {
    *   bookkeeping used to provide.
    */
   makeManager(account2) {
+    const cache = account2.name === this.primaryName ? createSessionCache({
+      district: account2.name,
+      baseUrl: account2.baseUrl,
+      username: account2.username,
+      password: account2.password,
+      browserBacked: this.fetchproxyMode
+    }) : null;
     return createCookieSessionManager({
       login: () => this.login(account2),
+      persistence: cache ?? void 0,
+      onPersistError: reportCacheWriteFailure,
       isExpired: (res) => this.detectExpiredSession(account2.name, res),
       isPermanentError: (e) => e instanceof AuthFailedError && e.permanent,
       maxAgeMs: SESSION_TTL_MS,
@@ -39385,7 +39733,24 @@ var ICClient = class {
   }
   async ensureDiscovery() {
     const session = await this.managers.get(this.primaryName).ensure();
-    void session;
+    if (this.discoveryDone) return;
+    if (this.discoveryInFlight !== null) {
+      await this.discoveryInFlight;
+      return;
+    }
+    const primary = this.accounts.get(this.primaryName);
+    const manager = this.managers.get(this.primaryName);
+    this.discoveryInFlight = (async () => {
+      if (this.lastDiscoverySession === session) {
+        await manager.ensure();
+        return;
+      }
+      if (await this.discoverLinkedDistricts(primary, session)) return;
+      await manager.ensure();
+    })().finally(() => {
+      this.discoveryInFlight = null;
+    });
+    await this.discoveryInFlight;
   }
   listDistricts() {
     return [...this.accounts.values()].map((a) => ({
@@ -39483,7 +39848,14 @@ var ICClient = class {
     await this.discoverLinkedDistricts(account2, session);
     return session;
   }
+  /**
+   * @returns whether the CUPS probe ANSWERED. `false` means the session was
+   * rejected (and has been invalidated), so the caller can mint a fresh one and
+   * try once more — without that, recovery lands a call too late and the first
+   * `ic_list_districts` after a restart silently omits linked districts.
+   */
   async discoverLinkedDistricts(account2, session) {
+    this.lastDiscoverySession = session;
     try {
       const baseHeaders = {
         Cookie: session.cookieHeader,
@@ -39497,14 +39869,23 @@ var ICClient = class {
         `${account2.baseUrl}/campus/api/campus/authentication/cups/linkedAccounts`,
         { headers: baseHeaders }
       );
-      if (!laRes.ok) return;
+      if (!laRes.ok) {
+        if (laRes.status === 401 || laRes.status === 403) {
+          this.managers.get(account2.name)?.invalidate();
+          return false;
+        }
+        return true;
+      }
       const laData = await laRes.json();
-      if (!laData.accounts?.length) return;
+      if (!laData.accounts?.length) {
+        this.discoveryDone = true;
+        return true;
+      }
       const [origRes, currRes] = await Promise.all([
         fetch(`${account2.baseUrl}/campus/api/campus/user/userAccountSwitch/originalDistrict`, { headers: baseHeaders }),
         fetch(`${account2.baseUrl}/campus/api/campus/districts/current`, { headers: baseHeaders })
       ]);
-      if (!origRes.ok || !currRes.ok) return;
+      if (!origRes.ok || !currRes.ok) return true;
       const origData = await origRes.json();
       const currData = await currRes.json();
       for (const linked of laData.accounts) {
@@ -39567,8 +39948,11 @@ var ICClient = class {
           console.error(`[ic] CUPS flow failed for ${linked.districtName}: ${e instanceof Error ? e.message : e}`);
         }
       }
+      this.discoveryDone = true;
+      return true;
     } catch (e) {
       console.error(`[ic] Linked district discovery failed: ${e instanceof Error ? e.message : e}`);
+      return true;
     }
   }
   async download(district, path, destinationPath, opts = {}) {
@@ -39579,7 +39963,7 @@ var ICClient = class {
     }
     if (destStat?.isDirectory()) throw new InvalidPathError(destinationPath);
     if (destStat && !opts.overwrite) throw new FileExistsError(destinationPath);
-    const parent = dirname(destinationPath);
+    const parent = dirname2(destinationPath);
     try {
       await stat(parent);
     } catch {
@@ -40605,7 +40989,7 @@ function registerFeaturesTools(server, client) {
 
 // src/index.ts
 await loadDotenvSafely({
-  path: join3(dirname2(fileURLToPath(import.meta.url)), "..", ".env"),
+  path: join4(dirname3(fileURLToPath(import.meta.url)), "..", ".env"),
   override: false
 });
 var AI_NOTICE = "[infinitecampus-mcp] Developed and maintained by AI (Claude). Use at your own discretion.";
@@ -40623,7 +41007,7 @@ try {
 }
 var COMMON = {
   name: "infinitecampus",
-  version: "2.4.5"
+  version: "2.5.0"
   // x-release-please-version
 };
 if (account) {