infinitecampus-mcp 3.1.2 → 3.1.3

package/dist/bundle.js

@@ -4858,7 +4858,7 @@ var require_memoizer = __commonJS({
     var NONE2 = 0;
     var ASSUMED2 = 1;
     var PROVEN2 = 2;
-    function isRecursive2(inst, stack, resolve2) {
+    function isRecursive2(inst, stack, resolve3) {
       const cached2 = recursive2.get(inst);
       if (cached2 !== void 0)
         return cached2 ? PROVEN2 : NONE2;
@@ -4868,7 +4868,7 @@ var require_memoizer = __commonJS({
       let result = NONE2;
       const check2 = (child) => {
         if (result !== PROVEN2 && child?._zod) {
-          const answer = isRecursive2(child, stack, resolve2);
+          const answer = isRecursive2(child, stack, resolve3);
           if (answer > result)
             result = answer;
         }
@@ -4879,7 +4879,7 @@ var require_memoizer = __commonJS({
           const desc = Object.getOwnPropertyDescriptor(sh, key);
           if (spread && !desc.enumerable)
             continue;
-          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve2) : NONE2;
+          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve3) : NONE2;
           if (child > answer)
             answer = child;
         }
@@ -4943,7 +4943,7 @@ var require_memoizer = __commonJS({
           break;
         // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
         case "lazy": {
-          const inner = def._cachedInner ?? (resolve2 ? inst._zod.innerType : void 0);
+          const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
           merge2(inner ? isRecursive2(inner, stack, false) : ASSUMED2);
           break;
         }
@@ -5007,7 +5007,7 @@ var require_memoizer = __commonJS({
       return bucket;
     }
     var handoff2;
-    var open2 = [];
+    var open3 = [];
     var memo3 = {
       alloc(_inst, payload, empty) {
         const bucket = handoff2;
@@ -5016,7 +5016,7 @@ var require_memoizer = __commonJS({
         handoff2 = void 0;
         const entry = { value: empty, issues: null };
         bucket.set(payload.value, entry);
-        open2.push(entry);
+        open3.push(entry);
         return empty;
       },
       guard(inst) {
@@ -5087,10 +5087,10 @@ var require_memoizer = __commonJS({
               return payload;
             }
             handoff2 = bucket;
-            const depth = open2.length;
+            const depth = open3.length;
             const result = base(payload, ctx);
             handoff2 = void 0;
-            const entry = open2.length > depth ? open2.pop() : void 0;
+            const entry = open3.length > depth ? open3.pop() : void 0;
             if (result instanceof Promise) {
               return result.then((r) => {
                 if (entry)
@@ -26497,7 +26497,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open2() {
+          ws.once("open", function open3() {
             duplex._final(callback);
           });
           return;
@@ -26518,7 +26518,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk2, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open2() {
+          ws.once("open", function open3() {
             duplex._write(chunk2, encoding, callback);
           });
           return;
@@ -26980,7 +26980,7 @@ var require_websocket_server = __commonJS({
 });
 
 // src/index.ts
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname3, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/@chrischall/mcp-utils/dist/cancel/index.js
@@ -31399,14 +31399,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve2();
+      resolve3();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -32200,7 +32200,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const earlyReject = (error62) => {
         reject(error62);
       };
@@ -32268,7 +32268,7 @@ var Protocol = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve2(manualInputRequiredValue(decoded));
+          if (options?.allowInputRequired === true) return resolve3(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -32280,11 +32280,11 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve2(this._resolveNonCompleteResult(decoded, flow));
+          return resolve3(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve2(parseResult.data);
+          if (parseResult.success) resolve3(parseResult.data);
           else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -35196,7 +35196,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve2.call(this, root, ref);
+    let _sch = resolve3.call(this, root, ref);
     if (_sch === void 0) {
       const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
@@ -35222,7 +35222,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve2(root, ref) {
+  function resolve3(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -35672,47 +35672,47 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     else if (typeof uri === "object") uri = parse3(serialize(uri, options), options);
     return uri;
   }
-  function resolve2(baseURI, relativeURI, options) {
+  function resolve3(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
-  function resolveComponent(base, relative, options, skipNormalization) {
+  function resolveComponent(base, relative2, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
       base = parse3(serialize(base, options), options);
-      relative = parse3(serialize(relative, options), options);
+      relative2 = parse3(serialize(relative2, options), options);
     }
     options = options || {};
-    if (!options.tolerant && relative.scheme) {
-      target.scheme = relative.scheme;
-      target.userinfo = relative.userinfo;
-      target.host = relative.host;
-      target.port = relative.port;
-      target.path = removeDotSegments(relative.path || "");
-      target.query = relative.query;
+    if (!options.tolerant && relative2.scheme) {
+      target.scheme = relative2.scheme;
+      target.userinfo = relative2.userinfo;
+      target.host = relative2.host;
+      target.port = relative2.port;
+      target.path = removeDotSegments(relative2.path || "");
+      target.query = relative2.query;
     } else {
-      if (relative.userinfo !== void 0 || relative.host !== void 0 || relative.port !== void 0) {
-        target.userinfo = relative.userinfo;
-        target.host = relative.host;
-        target.port = relative.port;
-        target.path = removeDotSegments(relative.path || "");
-        target.query = relative.query;
+      if (relative2.userinfo !== void 0 || relative2.host !== void 0 || relative2.port !== void 0) {
+        target.userinfo = relative2.userinfo;
+        target.host = relative2.host;
+        target.port = relative2.port;
+        target.path = removeDotSegments(relative2.path || "");
+        target.query = relative2.query;
       } else {
-        if (!relative.path) {
+        if (!relative2.path) {
           target.path = base.path;
-          if (relative.query !== void 0) target.query = relative.query;
+          if (relative2.query !== void 0) target.query = relative2.query;
           else target.query = base.query;
         } else {
-          if (relative.path[0] === "/") target.path = removeDotSegments(relative.path);
+          if (relative2.path[0] === "/") target.path = removeDotSegments(relative2.path);
           else {
-            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative.path;
-            else if (!base.path) target.path = relative.path;
-            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
+            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative2.path;
+            else if (!base.path) target.path = relative2.path;
+            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative2.path;
             target.path = removeDotSegments(target.path);
           }
-          target.query = relative.query;
+          target.query = relative2.query;
         }
         target.userinfo = base.userinfo;
         target.host = base.host;
@@ -35720,7 +35720,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       }
       target.scheme = base.scheme;
     }
-    target.fragment = relative.fragment;
+    target.fragment = relative2.fragment;
     return target;
   }
   function equal(uriA, uriB, options) {
@@ -35846,7 +35846,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize,
-    resolve: resolve2,
+    resolve: resolve3,
     resolveComponent,
     equal,
     serialize,
@@ -41219,7 +41219,7 @@ var StdioServerTransport = class {
   }
   send(message) {
     if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const json2 = serializeMessage(message);
       let settled = false;
       const onError = (error62) => {
@@ -41234,14 +41234,14 @@ var StdioServerTransport = class {
         settled = true;
         this._stdout.off("error", onError);
         this._stdout.off("drain", onDrain);
-        resolve2();
+        resolve3();
       };
       this._stdout.once("error", onError);
       if (this._stdout.write(json2)) {
         if (settled) return;
         settled = true;
         this._stdout.off("error", onError);
-        resolve2();
+        resolve3();
       } else if (!settled) this._stdout.once("drain", onDrain);
     });
   }
@@ -41295,14 +41295,14 @@ var StdioConnectionChannel = class {
   */
   async whenRequestsAnswered(timeoutMs) {
     if (this._closed || this._pendingRequests.size === 0) return true;
-    return await new Promise((resolve2) => {
+    return await new Promise((resolve3) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve2(true);
+        resolve3(true);
       };
       const timer = setTimeout(() => {
         this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-        resolve2(false);
+        resolve3(false);
       }, timeoutMs);
       this._drainWaiters.push(waiter);
     });
@@ -46735,7 +46735,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve2) {
+function isRecursive(inst, stack, resolve3) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -46745,7 +46745,7 @@ function isRecursive(inst, stack, resolve2) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve2);
+      const answer = isRecursive(child, stack, resolve3);
       if (answer > result)
         result = answer;
     }
@@ -46756,7 +46756,7 @@ function isRecursive(inst, stack, resolve2) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve2) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -46820,7 +46820,7 @@ function isRecursive(inst, stack, resolve2) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve2 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -63317,7 +63317,7 @@ var DEFAULT_BIND_TIMEOUT_MS = 5e3;
 async function electRole(opts) {
   const server = createServer();
   const bindTimeoutMs = opts.bindTimeoutMs ?? DEFAULT_BIND_TIMEOUT_MS;
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let timer;
     const clearBindTimer = () => {
       if (timer) {
@@ -63333,7 +63333,7 @@ async function electRole(opts) {
           server.close();
         } catch {
         }
-        resolve2({ role: "peer" });
+        resolve3({ role: "peer" });
       } else {
         reject(e);
       }
@@ -63341,7 +63341,7 @@ async function electRole(opts) {
     const onListening = () => {
       clearBindTimer();
       server.removeListener("error", onError);
-      resolve2({ role: "host", server });
+      resolve3({ role: "host", server });
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -63990,8 +63990,8 @@ async function startHost(opts) {
   let rejectOwnSession;
   let ownSessionReady;
   function resetSessionPromise() {
-    ownSessionReady = new Promise((resolve2, reject) => {
-      resolveOwnSession = resolve2;
+    ownSessionReady = new Promise((resolve3, reject) => {
+      resolveOwnSession = resolve3;
       rejectOwnSession = reject;
     });
     ownSessionReady.catch(() => {
@@ -64393,7 +64393,7 @@ async function startHost(opts) {
     });
   });
   return {
-    close: () => new Promise((resolve2) => {
+    close: () => new Promise((resolve3) => {
       for (const client of wss.clients) {
         try {
           client.terminate();
@@ -64401,7 +64401,7 @@ async function startHost(opts) {
         }
       }
       wss.close(() => {
-        opts.httpServer.close(() => resolve2());
+        opts.httpServer.close(() => resolve3());
       });
     }),
     sendOwnInner: async (inner) => {
@@ -64441,11 +64441,11 @@ async function startPeer(opts) {
     maxPayload: opts.maxPayloadBytes ?? MAX_PAYLOAD_BYTES
   });
   const dialTimeoutMs = opts.dialTimeoutMs ?? PEER_DIAL_TIMEOUT_MS;
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve3, reject) => {
     let timer;
     const onOpen = () => {
       cleanup();
-      resolve2();
+      resolve3();
     };
     const onError = (e) => {
       cleanup();
@@ -64533,10 +64533,10 @@ async function startPeer(opts) {
   let sessionPromiseSettled = false;
   function resetSessionPromise() {
     sessionPromiseSettled = false;
-    sessionPromise = new Promise((resolve2, reject) => {
+    sessionPromise = new Promise((resolve3, reject) => {
       resolveFirstReady = (st) => {
         sessionPromiseSettled = true;
-        resolve2(st);
+        resolve3(st);
       };
       rejectFirstReady = (e) => {
         sessionPromiseSettled = true;
@@ -65686,8 +65686,8 @@ var FetchproxyServer = class {
   async _fetchOnceWithTimeout(init, fetchOpts = {}) {
     const id = this.nextRequestId++;
     const inner = { type: "request", id, op: "fetch", init };
-    const pending = this.guardPending(new Promise((resolve2) => {
-      this.pending.set(id, resolve2);
+    const pending = this.guardPending(new Promise((resolve3) => {
+      this.pending.set(id, resolve3);
     }));
     try {
       await this.sendInnerFrame(inner, {
@@ -65710,12 +65710,12 @@ var FetchproxyServer = class {
     try {
       return await Promise.race([
         pending,
-        new Promise((resolve2) => {
+        new Promise((resolve3) => {
           timer = setTimeout(() => {
             this.pending.delete(id);
             const elapsedMs = Date.now() - start;
             const error62 = `fetchproxy: ${init.url} did not respond within ${timeoutMs}ms`;
-            resolve2({
+            resolve3({
               ok: false,
               error: error62,
               kind: "timeout",
@@ -65859,9 +65859,9 @@ var FetchproxyServer = class {
     if (opts.subdomain !== void 0)
       assertSubdomainLabel(opts.subdomain);
     const baseDomain = this.resolveBaseDomain(opts.domain);
-    const isAbsolute3 = path.startsWith("http://") || path.startsWith("https://");
+    const isAbsolute5 = path.startsWith("http://") || path.startsWith("https://");
     let host;
-    if (isAbsolute3) {
+    if (isAbsolute5) {
       try {
         host = new URL(path).host;
       } catch {
@@ -65870,7 +65870,7 @@ var FetchproxyServer = class {
     } else {
       host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
     }
-    const url4 = isAbsolute3 ? path : `https://${host}${path}`;
+    const url4 = isAbsolute5 ? path : `https://${host}${path}`;
     assertUrlInDomains("request url", url4, this.opts.domains);
     let tabUrl = `https://${host}/`;
     if (opts.viaTab !== void 0) {
@@ -66135,8 +66135,8 @@ var FetchproxyServer = class {
       const tabUrl = `https://${host}/`;
       inner = { type: "request", id, op: "read_cookies", init: { tabUrl } };
     }
-    const pending = this.guardPending(new Promise((resolve2) => {
-      this.pendingReadCookies.set(id, resolve2);
+    const pending = this.guardPending(new Promise((resolve3) => {
+      this.pendingReadCookies.set(id, resolve3);
     }));
     await this.sendInnerFrame(inner);
     const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
@@ -66194,8 +66194,8 @@ var FetchproxyServer = class {
         ...cookiePath !== void 0 ? { path: cookiePath } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingWriteCookies.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve3, reject) => {
+      this.pendingWriteCookies.set(id, { resolve: resolve3, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -66265,8 +66265,8 @@ var FetchproxyServer = class {
         ...opts.pointers ? { pointers: { ...opts.pointers } } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingStorage.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve3, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve3, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, `https://${host}`);
@@ -66324,8 +66324,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingCapture.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve3, reject) => {
+      this.pendingCapture.set(id, { resolve: resolve3, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -66372,8 +66372,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingRedirect.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve3, reject) => {
+      this.pendingRedirect.set(id, { resolve: resolve3, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -66468,8 +66468,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingDownload.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve3, reject) => {
+      this.pendingDownload.set(id, { resolve: resolve3, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -66529,8 +66529,8 @@ var FetchproxyServer = class {
         keys: [...opts.keys]
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingIdb.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve3, reject) => {
+      this.pendingIdb.set(id, { resolve: resolve3, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
@@ -66569,8 +66569,8 @@ var FetchproxyServer = class {
       op: "read_dom",
       init: { origin, names: [...opts.names] }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingStorage.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve3, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve3, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
@@ -66615,8 +66615,8 @@ var FetchproxyServer = class {
       op: "read_dom_list",
       init: { origin, name: opts.name }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingDomList.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve3, reject) => {
+      this.pendingDomList.set(id, { resolve: resolve3, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingDomList, id, origin);
@@ -66661,8 +66661,8 @@ var FetchproxyServer = class {
         ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve2, reject) => {
-      this.pendingGraphql.set(id, { resolve: resolve2, reject });
+    const pending = this.guardPending(new Promise((resolve3, reject) => {
+      this.pendingGraphql.set(id, { resolve: resolve3, reject });
     }));
     const retrySafe = opts.retryOnTimeout === true;
     await this.sendInnerFrame(inner, { resendable: retrySafe });
@@ -67422,6 +67422,8 @@ function registerCredentialHealthcheckTool(args) {
 }
 
 // src/config.ts
+import { homedir as homedir2 } from "node:os";
+import { isAbsolute as isAbsolute3, join as join3 } from "node:path";
 function readVar(env, key) {
   return readEnvVar(key, { env });
 }
@@ -67458,11 +67460,18 @@ function loadAccount(env = process.env) {
     password: password ?? ""
   };
 }
+function resolveDownloadDir(env = process.env) {
+  const dir = readVar(env, "IC_DOWNLOAD_DIR") ?? join3(homedir2(), "Downloads");
+  if (!isAbsolute3(dir)) {
+    throw new Error(`IC_DOWNLOAD_DIR must be an absolute path, got: '${dir}'`);
+  }
+  return dir;
+}
 
 // package.json
 var package_default = {
   name: "infinitecampus-mcp",
-  version: "3.1.2",
+  version: "3.1.3",
   mcpName: "io.github.chrischall/infinitecampus-mcp",
   description: "Infinite Campus (Campus Parent) MCP server \u2014 multi-district read + message/document write",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -67618,13 +67627,14 @@ async function liftBrowserSession(account2) {
 }
 
 // src/client.ts
-import { writeFile as writeFile3, stat } from "fs/promises";
-import { dirname as dirname2 } from "path";
+import { open as open2, lstat as lstat2, realpath } from "fs/promises";
+import { constants as fsConstants } from "fs";
+import { basename, dirname as dirname2, isAbsolute as isAbsolute4, join as join5, relative, resolve as resolve2, sep } from "path";
 
 // node_modules/@chrischall/mcp-utils/dist/session/index.js
 import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
-import { dirname, join as join3, resolve } from "node:path";
-import { homedir as homedir2 } from "node:os";
+import { dirname, join as join4, resolve } from "node:path";
+import { homedir as homedir3 } from "node:os";
 import { randomBytes as randomBytes3, createHmac } from "node:crypto";
 function bindingDigest(secret, salt) {
   return createHmac("sha256", salt).update(secret).digest("hex").slice(0, 32);
@@ -67712,11 +67722,11 @@ function createFileStatePersistence(opts) {
   };
 }
 function homeOf(env) {
-  return readEnvVar("HOME", { env }) ?? homedir2();
+  return readEnvVar("HOME", { env }) ?? homedir3();
 }
 function resolveStateDir(opts = {}) {
   const env = opts.env;
-  return join3(readEnvVar("MCP_DATA_DIR", { env }) ?? homeOf(env), opts.subdir ?? "");
+  return join4(readEnvVar("MCP_DATA_DIR", { env }) ?? homeOf(env), opts.subdir ?? "");
 }
 function resolveStateFile(opts) {
   const override = opts.envVar !== void 0 ? readEnvVar(opts.envVar, { env: opts.env }) : void 0;
@@ -67724,13 +67734,13 @@ function resolveStateFile(opts) {
     if (override === "~")
       return homeOf(opts.env);
     if (override.startsWith("~/"))
-      return join3(homeOf(opts.env), override.slice(2));
+      return join4(homeOf(opts.env), override.slice(2));
     return resolve(override);
   }
   const dirOpts = { env: opts.env };
   if (opts.subdir !== void 0)
     dirOpts.subdir = opts.subdir;
-  return join3(resolveStateDir(dirOpts), opts.fileName);
+  return join4(resolveStateDir(dirOpts), opts.fileName);
 }
 var TOKEN_REFRESH_SKEW_MS = 5 * 60 * 1e3;
 function isPersistedCookieSession(raw) {
@@ -68194,14 +68204,28 @@ var ICClient = class {
     return data;
   }
   async request(district, path, opts = {}) {
+    const account2 = await this.resolveAccount(district);
+    await this.managers.get(account2.name).ensure();
+    return this.doRequest(account2, path, opts);
+  }
+  /**
+   * The account for `district`, running CUPS discovery once on a miss.
+   *
+   * Cold-start: linked districts are only added to the accounts map after
+   * primary login + CUPS discovery. If the caller asks for a linked district
+   * before any other request triggered login, we'd otherwise throw
+   * UnknownDistrictError despite the district being valid. Shared by request()
+   * and download() — download() once looked the map up directly, so a linked
+   * district's document failed on a cold start (fleet-audit#142).
+   */
+  async resolveAccount(district) {
     let account2 = this.accounts.get(district);
     if (!account2) {
       await this.ensureDiscovery();
       account2 = this.accounts.get(district);
       if (!account2) throw new UnknownDistrictError(district, [...this.accounts.keys()]);
     }
-    await this.managers.get(account2.name).ensure();
-    return this.doRequest(account2, path, opts);
+    return account2;
   }
   async login(account2) {
     const primaryName = this.linkedTo.get(account2.name);
@@ -68374,34 +68398,31 @@ var ICClient = class {
     }
   }
   async download(district, path, destinationPath, opts = {}) {
+    const target = await confinedDestination(destinationPath);
     let destStat = null;
     try {
-      destStat = await stat(destinationPath);
+      destStat = await lstat2(target.real);
     } catch {
     }
+    if (destStat?.isSymbolicLink()) throw new InvalidPathError(destinationPath, "is a symlink");
     if (destStat?.isDirectory()) throw new InvalidPathError(destinationPath);
     if (destStat && !opts.overwrite) throw new FileExistsError(destinationPath);
-    const parent = dirname2(destinationPath);
-    try {
-      await stat(parent);
-    } catch {
-      throw new ParentDirectoryMissingError(parent);
-    }
-    const account2 = this.accounts.get(district);
-    if (!account2) throw new UnknownDistrictError(district, [...this.accounts.keys()]);
-    const session = await this.managers.get(account2.name).ensure();
-    const url4 = /^https?:\/\//i.test(path) ? path : `${account2.baseUrl}${path}`;
-    const res = await fetch(url4, {
-      headers: {
-        Cookie: session.cookieHeader,
-        ...session.xsrfToken ? { "X-XSRF-TOKEN": session.xsrfToken } : {}
-      }
-    });
+    const account2 = await this.resolveAccount(district);
+    const url4 = documentUrl(account2, path);
+    const res = await this.managers.get(account2.name).withSession(
+      async (session) => fetch(url4, {
+        headers: {
+          Cookie: session.cookieHeader,
+          ...session.xsrfToken ? { "X-XSRF-TOKEN": session.xsrfToken } : {}
+        }
+      })
+    );
+    if (res.status === 401) throw new SessionExpiredError(account2.name);
     if (!res.ok) throw new Error(`IC download ${res.status} for ${path}`);
     const buf = new Uint8Array(await res.arrayBuffer());
-    await writeFile3(destinationPath, buf);
+    await writeConfined(target.real, destinationPath, buf, !!opts.overwrite);
     return {
-      path: destinationPath,
+      path: target.requested,
       bytes: buf.byteLength,
       contentType: res.headers.get("content-type") ?? "application/octet-stream"
     };
@@ -68433,6 +68454,60 @@ var ICClient = class {
     return text ? JSON.parse(text) : null;
   }
 };
+async function writeConfined(real, requested, buf, overwrite) {
+  const { O_WRONLY, O_CREAT, O_TRUNC, O_EXCL, O_NOFOLLOW } = fsConstants;
+  const flags = O_WRONLY | O_CREAT | O_NOFOLLOW | (overwrite ? O_TRUNC : O_EXCL);
+  let handle;
+  try {
+    handle = await open2(real, flags, 438);
+  } catch (e) {
+    const code = e.code;
+    if (code === "ELOOP") throw new InvalidPathError(requested, "is a symlink");
+    if (code === "EEXIST") throw new FileExistsError(requested);
+    throw e;
+  }
+  try {
+    await handle.writeFile(buf);
+  } finally {
+    await handle.close();
+  }
+}
+async function confinedDestination(destinationPath) {
+  const root = resolveDownloadDir();
+  let rootReal;
+  try {
+    rootReal = await realpath(root);
+  } catch {
+    throw new DownloadDirMissingError(root);
+  }
+  const requested = resolve2(root, destinationPath);
+  const parent = dirname2(requested);
+  let parentReal;
+  try {
+    parentReal = await realpath(parent);
+  } catch {
+    throw new ParentDirectoryMissingError(parent);
+  }
+  const real = join5(parentReal, basename(requested));
+  const rel = relative(rootReal, real);
+  if (isAbsolute4(rel) || rel.split(sep)[0] === "..") {
+    throw new PathOutsideDownloadDirError(destinationPath, root);
+  }
+  return { requested, real };
+}
+function documentUrl(account2, path) {
+  const raw = /^[a-z][a-z0-9+.-]*:/i.test(path) ? path : `${account2.baseUrl}${path}`;
+  let parsed = null;
+  try {
+    parsed = new URL(raw);
+  } catch {
+  }
+  const allowed = new URL(account2.baseUrl).origin;
+  if (!parsed || parsed.protocol !== "https:" || parsed.origin !== allowed) {
+    throw new DocumentOriginNotAllowedError(path, allowed);
+  }
+  return parsed.href;
+}
 function parseSetCookies(headers) {
   const raw = headers.getSetCookie?.() ?? [];
   const { cookies, cookieHeader } = parseCookieJar(
@@ -68495,14 +68570,46 @@ var SessionExpiredError = class extends Error {
   }
   district;
 };
+var DocumentOriginNotAllowedError = class extends Error {
+  constructor(documentId, allowedOrigin) {
+    super(
+      `DocumentOriginNotAllowed: refusing to send the IC session to '${documentId}'. Documents are only downloaded over https from ${allowedOrigin} \u2014 pass the url field from ic_list_documents for this district.`
+    );
+    this.documentId = documentId;
+    this.allowedOrigin = allowedOrigin;
+    this.name = "DocumentOriginNotAllowedError";
+  }
+  documentId;
+  allowedOrigin;
+};
 var InvalidPathError = class extends Error {
-  constructor(path) {
-    super(`InvalidPath: destinationPath must be a filename, not a directory: ${path}`);
+  constructor(path, reason = "is a directory") {
+    super(`InvalidPath: destinationPath must be a regular filename, but ${path} ${reason}`);
     this.path = path;
     this.name = "InvalidPathError";
   }
   path;
 };
+var PathOutsideDownloadDirError = class extends Error {
+  constructor(path, downloadDir) {
+    super(
+      `PathOutsideDownloadDir: ${path} is outside the download directory ${downloadDir}. Documents are only written inside it \u2014 pass a path under it (or a relative one), or set IC_DOWNLOAD_DIR to change it.`
+    );
+    this.path = path;
+    this.downloadDir = downloadDir;
+    this.name = "PathOutsideDownloadDirError";
+  }
+  path;
+  downloadDir;
+};
+var DownloadDirMissingError = class extends Error {
+  constructor(path) {
+    super(`DownloadDirMissing: the download directory ${path} does not exist. Create it or set IC_DOWNLOAD_DIR.`);
+    this.path = path;
+    this.name = "DownloadDirMissingError";
+  }
+  path;
+};
 var ParentDirectoryMissingError = class extends Error {
   constructor(path) {
     super(`ParentDirectoryMissing: ${path}`);
@@ -68607,13 +68714,11 @@ function registerStudentTools(server, client) {
 // src/tools/schedule.ts
 var argsSchema2 = external_exports.object({
   district: external_exports.string().describe("District name from ic_list_districts"),
-  studentId: external_exports.string().describe("Student personID from ic_list_students"),
-  date: external_exports.string().describe("YYYY-MM-DD; defaults to today").optional(),
-  termFilter: external_exports.string().describe("Term name or ID; optional").optional()
+  studentId: external_exports.string().describe("Student personID from ic_list_students")
 });
 function registerScheduleTools(server, client) {
   server.registerTool("ic_get_schedule", {
-    description: "Get a student's class schedule for a given date (default: today).",
+    description: "Get a student's class roster: every course with its section placements, across every term of the current enrollment. Not filtered by date or term \u2014 each placement carries its own term, so narrow the result yourself.",
     annotations: { readOnlyHint: true },
     inputSchema: external_exports.object({ ...argsSchema2.shape, view: viewArg() })
   }, async (rawArgs) => {
@@ -68880,24 +68985,24 @@ function extractPlainTextFromHtml(html) {
 }
 function stripElementContent(html, tag) {
   const lower = asciiLower(html);
-  const open2 = `<${tag}`;
+  const open3 = `<${tag}`;
   const close = `</${tag}>`;
   let out = "";
   let i = 0;
   for (; ; ) {
-    const start = lower.indexOf(open2, i);
+    const start = lower.indexOf(open3, i);
     if (start < 0) {
       out += html.slice(i);
       return out;
     }
-    const after = lower[start + open2.length];
+    const after = lower[start + open3.length];
     if (after !== void 0 && after !== ">" && after !== " " && after !== "	" && after !== "\n" && after !== "\r" && after !== "\f" && after !== "/") {
-      out += html.slice(i, start + open2.length);
-      i = start + open2.length;
+      out += html.slice(i, start + open3.length);
+      i = start + open3.length;
       continue;
     }
     out += html.slice(i, start) + " ";
-    const closeAt = lower.indexOf(close, start + open2.length);
+    const closeAt = lower.indexOf(close, start + open3.length);
     if (closeAt < 0)
       return out;
     i = closeAt + close.length;
@@ -69029,7 +69134,9 @@ var listArgs2 = external_exports.object({
 var downloadArgs = external_exports.object({
   district: external_exports.string(),
   documentId: external_exports.string().describe("The url field returned by ic_list_documents"),
-  destinationPath: external_exports.string().describe("Absolute path where the PDF should be written"),
+  destinationPath: external_exports.string().describe(
+    "Where to write the PDF. Must be inside the download directory (IC_DOWNLOAD_DIR, default ~/Downloads); a relative path resolves against it."
+  ),
   overwrite: external_exports.boolean().optional()
 });
 function registerDocumentTools(server, client) {
@@ -69064,7 +69171,7 @@ function registerDocumentTools(server, client) {
     }
   });
   server.registerTool("ic_download_document", {
-    description: "Download a student's document (PDF) to disk. documentId is the url field returned by ic_list_documents. Returns FeatureDisabled if the district has the module turned off.",
+    description: "Download a student's document (PDF) to disk, inside the download directory (IC_DOWNLOAD_DIR, default ~/Downloads). documentId is the url field returned by ic_list_documents. Will not overwrite an existing file unless overwrite is true. Returns FeatureDisabled if the district has the module turned off.",
     annotations: { destructiveHint: true },
     inputSchema: downloadArgs
   }, async (rawArgs) => {
@@ -69463,7 +69570,7 @@ function registerFeaturesTools(server, client) {
 
 // src/index.ts
 await loadDotenvSafely({
-  path: join4(dirname3(fileURLToPath(import.meta.url)), "..", ".env"),
+  path: join6(dirname3(fileURLToPath(import.meta.url)), "..", ".env"),
   override: false
 });
 var AI_NOTICE = "[infinitecampus-mcp] Developed and maintained by AI (Claude). Use at your own discretion.";
@@ -69481,7 +69588,7 @@ try {
 }
 var COMMON = {
   name: "infinitecampus",
-  version: "3.1.2"
+  version: "3.1.3"
   // x-release-please-version
 };
 var healthState = { account, source, configError, client: null };