moodle-cli 0.7.0-alpha.3 → 0.7.0-alpha.5

package/dist/worker/worker.js

@@ -3573,7 +3573,7 @@ var require_parse = __commonJS({
     var whitespace = /* @__PURE__ */ new Set([9, 10, 12, 13, 32]);
     var ZERO = "0".charCodeAt(0);
     var NINE = "9".charCodeAt(0);
-    function parse6(formula) {
+    function parse7(formula) {
       formula = formula.trim().toLowerCase();
       if (formula === "even") {
         return [2, 0];
@@ -3625,7 +3625,7 @@ var require_parse = __commonJS({
         }
       }
     }
-    exports.parse = parse6;
+    exports.parse = parse7;
   }
 });
 
@@ -5075,7 +5075,7 @@ var require_html = __commonJS({
         }).join("");
       }
       set innerHTML(content) {
-        const r = parse6(content, this._parseOptions);
+        const r = parse7(content, this._parseOptions);
         const nodes = r.childNodes.length ? r.childNodes : [new text_1.default(content, this)];
         resetParent(nodes, this);
         resetParent(this.childNodes, null);
@@ -5086,7 +5086,7 @@ var require_html = __commonJS({
           content = [content];
         } else if (typeof content == "string") {
           options = Object.assign(Object.assign({}, this._parseOptions), options);
-          const r = parse6(content, options);
+          const r = parse7(content, options);
           content = r.childNodes.length ? r.childNodes : [new text_1.default(r.innerHTML, this)];
         }
         resetParent(this.childNodes, null);
@@ -5100,7 +5100,7 @@ var require_html = __commonJS({
           if (node instanceof node_1.default) {
             return [node];
           } else if (typeof node == "string") {
-            const r = parse6(node, this._parseOptions);
+            const r = parse7(node, this._parseOptions);
             return r.childNodes.length ? r.childNodes : [new text_1.default(node, this)];
           }
           return [];
@@ -5484,7 +5484,7 @@ var require_html = __commonJS({
         if (arguments.length < 2) {
           throw new Error("2 arguments required");
         }
-        const p = parse6(html, this._parseOptions);
+        const p = parse7(html, this._parseOptions);
         if (where === "afterend") {
           this.after(...p.childNodes);
         } else if (where === "afterbegin") {
@@ -5630,7 +5630,7 @@ var require_html = __commonJS({
       }
       /** Clone this Node */
       clone() {
-        return parse6(this.toString(), this._parseOptions).firstChild;
+        return parse7(this.toString(), this._parseOptions).firstChild;
       }
     };
     exports.default = HTMLElement2;
@@ -5832,7 +5832,7 @@ var require_html = __commonJS({
       return stack;
     }
     exports.base_parse = base_parse;
-    function parse6(data, options = {}) {
+    function parse7(data, options = {}) {
       const stack = base_parse(data, options);
       const [root] = stack;
       while (stack.length > 1) {
@@ -5860,7 +5860,7 @@ var require_html = __commonJS({
       }
       return root;
     }
-    exports.parse = parse6;
+    exports.parse = parse7;
     function resolveInsertable(insertable) {
       return insertable.map((val) => {
         if (typeof val === "string") {
@@ -5928,18 +5928,18 @@ var require_dist = __commonJS({
     var parse_1 = __importDefault(require_parse2());
     var valid_1 = __importDefault(require_valid());
     exports.valid = valid_1.default;
-    function parse6(data, options = {}) {
+    function parse7(data, options = {}) {
       return (0, parse_1.default)(data, options);
     }
-    exports.default = parse6;
-    exports.parse = parse6;
-    parse6.parse = parse_1.default;
-    parse6.HTMLElement = html_1.default;
-    parse6.CommentNode = comment_1.default;
-    parse6.valid = valid_1.default;
-    parse6.Node = node_1.default;
-    parse6.TextNode = text_1.default;
-    parse6.NodeType = type_1.default;
+    exports.default = parse7;
+    exports.parse = parse7;
+    parse7.parse = parse_1.default;
+    parse7.HTMLElement = html_1.default;
+    parse7.CommentNode = comment_1.default;
+    parse7.valid = valid_1.default;
+    parse7.Node = node_1.default;
+    parse7.TextNode = text_1.default;
+    parse7.NodeType = type_1.default;
   }
 });
 
@@ -5995,300 +5995,6 @@ function problemResponse(status, code, title, detail, headers) {
   );
 }
 
-// src/version.ts
-var VERSION = "0.7.0-alpha.3";
-
-// src/worker/http.ts
-var HEALTH_PATH = "/healthz";
-var READY_PATH = "/readyz";
-var MCP_PATH = "/mcp";
-var SESSION_PATH = "/session";
-var SESSION_TOUCH_PATH = "/session/touch";
-var WORKER_SERVICE_ID = "moodle-mcp";
-var WORKER_SERVICE_VERSION = VERSION;
-function createWorkerHandler(dependencies) {
-  return {
-    async fetch(request, env) {
-      const url2 = new URL(request.url);
-      const authorityProblem = validateRequestAuthority(request, url2, env.EXPECTED_HOST);
-      if (authorityProblem) return authorityProblem;
-      if (hasQueryCredential(url2)) return unauthorized("Bearer credentials are not accepted in the query string.");
-      if (url2.pathname === HEALTH_PATH && request.method === "GET") {
-        return Response.json(
-          { status: "pass", serviceId: WORKER_SERVICE_ID, version: WORKER_SERVICE_VERSION },
-          { headers: { "content-type": "application/health+json; charset=utf-8" } }
-        );
-      }
-      if (url2.pathname === MCP_PATH && request.method !== "POST") {
-        return problemResponse(405, "METHOD_NOT_ALLOWED", "Method Not Allowed", "The MCP transport accepts POST requests only.", {
-          allow: "POST"
-        });
-      }
-      if (url2.pathname === MCP_PATH) {
-        if (!await verifyBearerToken(request.headers.get("authorization"), [
-          env.MCP_ACCESS_TOKEN_DIGEST,
-          activePreviousDigest(env.MCP_ACCESS_TOKEN_PREVIOUS_DIGEST, env.TOKEN_OVERLAP_EXPIRES_AT)
-        ])) {
-          return unauthorized();
-        }
-        const server = typeof dependencies.mcpServer === "function" ? dependencies.mcpServer(env) : dependencies.mcpServer;
-        return handleMcpRequest(request, server);
-      }
-      if (url2.pathname === READY_PATH && request.method === "GET") {
-        if (!await authorizeSessionSync(request, env)) return unauthorized();
-        const broker = resolveBroker(dependencies, env);
-        if (broker instanceof Response) return broker;
-        return broker.ready();
-      }
-      if (url2.pathname === SESSION_PATH && request.method === "PUT") {
-        if (!await authorizeSessionSync(request, env)) return unauthorized();
-        const broker = resolveBroker(dependencies, env);
-        if (broker instanceof Response) return broker;
-        return broker.replaceSession(request);
-      }
-      if (url2.pathname === SESSION_TOUCH_PATH && request.method === "POST") {
-        if (!await authorizeSessionSync(request, env)) return unauthorized();
-        const broker = resolveBroker(dependencies, env);
-        if (broker instanceof Response) return broker;
-        return broker.touch();
-      }
-      if (url2.pathname === READY_PATH || url2.pathname === SESSION_PATH || url2.pathname === SESSION_TOUCH_PATH) {
-        const method = url2.pathname === READY_PATH ? "GET" : url2.pathname === SESSION_PATH ? "PUT" : "POST";
-        return problemResponse(405, "METHOD_NOT_ALLOWED", "Method Not Allowed", "The session route does not accept this method.", {
-          allow: method
-        });
-      }
-      return problemResponse(404, "NOT_FOUND", "Not Found", "The requested route does not exist.");
-    }
-  };
-}
-function createDurableObjectBrokerApi(namespace) {
-  const stub = namespace.get(namespace.idFromName("primary"));
-  return {
-    async handleMcp(body, context) {
-      const response = await stub.fetch(new Request("https://session-broker/mcp", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ request: body, context })
-      }));
-      if (!response.ok) {
-        const problem = await safeProblem(response);
-        throw new SessionBrokerMcpError(response.status, problem?.code);
-      }
-      const envelope = await response.json();
-      return envelope.response ?? null;
-    },
-    ready: () => stub.fetch(new Request("https://session-broker/readyz")),
-    async replaceSession(request) {
-      return stub.fetch(new Request("https://session-broker/session", {
-        method: "PUT",
-        headers: { "content-type": request.headers.get("content-type") ?? "application/json" },
-        body: await request.arrayBuffer()
-      }));
-    },
-    touch: () => stub.fetch(new Request("https://session-broker/session/touch", { method: "POST" }))
-  };
-}
-var SessionBrokerMcpError = class extends Error {
-  constructor(status, code) {
-    super("The session broker could not complete the MCP request.");
-    this.status = status;
-    this.code = code;
-    this.name = "SessionBrokerMcpError";
-  }
-  status;
-  code;
-};
-function resolveBroker(dependencies, env) {
-  if (dependencies.broker) return dependencies.broker(env);
-  if (env.SESSION_BROKER) return createDurableObjectBrokerApi(env.SESSION_BROKER);
-  return problemResponse(503, "SESSION_BROKER_UNAVAILABLE", "Service Unavailable", "The session broker is unavailable.");
-}
-function validateRequestAuthority(request, url2, configuredHost) {
-  const expectedHost = (configuredHost ?? url2.host).toLowerCase();
-  const requestHost = (request.headers.get("host") ?? url2.host).toLowerCase();
-  if (requestHost !== expectedHost) {
-    return problemResponse(403, "INVALID_HOST", "Forbidden", "The request Host is not allowed.");
-  }
-  const origin = request.headers.get("origin");
-  if (!origin) return null;
-  try {
-    const parsed = new URL(origin);
-    if (parsed.origin !== url2.origin || parsed.host.toLowerCase() !== expectedHost) {
-      return problemResponse(403, "INVALID_ORIGIN", "Forbidden", "The request Origin is not allowed.");
-    }
-  } catch {
-    return problemResponse(403, "INVALID_ORIGIN", "Forbidden", "The request Origin is not allowed.");
-  }
-  return null;
-}
-function unauthorized(detail = "A valid Bearer token is required.") {
-  return problemResponse(401, "INVALID_BEARER_TOKEN", "Unauthorized", detail, {
-    "www-authenticate": 'Bearer realm="moodle-mcp"'
-  });
-}
-async function handleMcpRequest(request, server) {
-  if (!request.headers.get("content-type")?.toLowerCase().startsWith("application/json")) {
-    return problemResponse(415, "UNSUPPORTED_MEDIA_TYPE", "Unsupported Media Type", "MCP requests must use application/json.");
-  }
-  let body;
-  try {
-    body = await request.json();
-  } catch {
-    return problemResponse(400, "INVALID_JSON", "Bad Request", "The request body is not valid JSON.");
-  }
-  const protocolVersion = request.headers.get("mcp-protocol-version");
-  const metadataProblem = validateProtocolMetadata(request.headers, body, protocolVersion);
-  if (metadataProblem) return metadataProblem;
-  try {
-    const response = await server.handle(body, {
-      protocolVersion,
-      method: request.headers.get("mcp-method") ?? void 0,
-      toolName: request.headers.get("mcp-name") ?? void 0
-    });
-    if (response === null) return new Response(null, { status: 202 });
-    if (request.headers.get("accept")?.toLowerCase().includes("text/event-stream")) {
-      return new Response(`event: message
-data: ${JSON.stringify(response)}
-
-`, {
-        headers: {
-          "cache-control": "private, no-store",
-          "content-type": "text/event-stream; charset=utf-8"
-        }
-      });
-    }
-    return Response.json(response, { headers: { "cache-control": "private, no-store" } });
-  } catch (error51) {
-    if (error51 instanceof SessionBrokerMcpError) {
-      const status = error51.status === 503 ? 503 : 500;
-      const code = error51.code === "SESSION_MISSING" || error51.code === "SESSION_EXPIRED" ? error51.code : "SESSION_UNAVAILABLE";
-      return problemResponse(status, code, "Service Unavailable", "The Moodle session is not ready.");
-    }
-    if (error51 instanceof Error && error51.name === "UnsupportedProtocolVersionError") {
-      return problemResponse(400, "UNSUPPORTED_PROTOCOL_VERSION", "Unsupported Protocol Version", "The requested MCP protocol version is not supported.");
-    }
-    return problemResponse(500, "MCP_REQUEST_FAILED", "Internal Server Error", "The MCP request could not be completed.");
-  }
-}
-async function safeProblem(response) {
-  try {
-    const value = await response.json();
-    return isRecord(value) && (value.code === void 0 || typeof value.code === "string") ? value : null;
-  } catch {
-    return null;
-  }
-}
-function validateProtocolMetadata(headers, body, protocolVersion) {
-  if (!protocolVersion) {
-    return problemResponse(400, "MCP_PROTOCOL_METADATA_INVALID", "Bad Request", "MCP-Protocol-Version is required.");
-  }
-  const params = isRecord(body.params) ? body.params : void 0;
-  const metadata = params && isRecord(params._meta) ? params._meta : void 0;
-  const bodyVersion = metadata?.["io.modelcontextprotocol/protocolVersion"];
-  if (bodyVersion !== void 0 && bodyVersion !== protocolVersion) {
-    return problemResponse(400, "MCP_PROTOCOL_METADATA_MISMATCH", "Bad Request", "MCP protocol metadata does not match the HTTP headers.");
-  }
-  if (typeof body.method !== "string") {
-    return problemResponse(400, "MCP_PROTOCOL_METADATA_INVALID", "Bad Request", "The JSON-RPC method is required.");
-  }
-  const headerMethod = headers.get("mcp-method");
-  const headerName = headers.get("mcp-name") ?? void 0;
-  const paramsName = params && typeof params.name === "string" ? params.name : void 0;
-  if (headerMethod !== body.method || headerName !== paramsName) {
-    return problemResponse(400, "MCP_PROTOCOL_METADATA_MISMATCH", "Bad Request", "MCP method metadata does not match the JSON-RPC request.");
-  }
-  return null;
-}
-function authorizeSessionSync(request, env) {
-  return verifyBearerToken(request.headers.get("authorization"), [
-    env.SESSION_SYNC_TOKEN_DIGEST,
-    activePreviousDigest(env.SESSION_SYNC_TOKEN_PREVIOUS_DIGEST, env.TOKEN_OVERLAP_EXPIRES_AT)
-  ]);
-}
-function activePreviousDigest(digest, expiresAt2) {
-  if (!digest || !expiresAt2) return void 0;
-  const expiration = Number(expiresAt2);
-  return Number.isFinite(expiration) && Date.now() < expiration ? digest : void 0;
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// src/worker/crypto.ts
-async function createEncryptionKeyring(currentSecret, previousSecret) {
-  if (!currentSecret) throw new Error("SESSION_ENCRYPTION_KEY is required.");
-  const current = await deriveEncryptionKey(currentSecret);
-  const keys = /* @__PURE__ */ new Map([[current.id, current.key]]);
-  if (previousSecret) {
-    const previous = await deriveEncryptionKey(previousSecret);
-    keys.set(previous.id, previous.key);
-  }
-  return { current, keys };
-}
-async function encryptValue(value, keyring) {
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const ciphertext = await crypto.subtle.encrypt(
-    { name: "AES-GCM", iv },
-    keyring.current.key,
-    new TextEncoder().encode(value)
-  );
-  return JSON.stringify({
-    version: 1,
-    keyId: keyring.current.id,
-    iv: toBase64Url(iv),
-    ciphertext: toBase64Url(new Uint8Array(ciphertext))
-  });
-}
-async function decryptValue(encrypted, keyring) {
-  const envelope = parseEnvelope(encrypted);
-  const key = keyring.keys.get(envelope.keyId);
-  if (!key) throw new Error("The session encryption key is unavailable.");
-  const plaintext = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv: fromBase64Url(envelope.iv) },
-    key,
-    fromBase64Url(envelope.ciphertext)
-  );
-  return {
-    value: new TextDecoder().decode(plaintext),
-    keyId: envelope.keyId,
-    needsRotation: envelope.keyId !== keyring.current.id
-  };
-}
-async function deriveEncryptionKey(secret) {
-  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret)));
-  const key = await crypto.subtle.importKey("raw", digest, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
-  const id = Array.from(digest.slice(0, 8), (byte) => byte.toString(16).padStart(2, "0")).join("");
-  return { id, key };
-}
-function parseEnvelope(value) {
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    throw new Error("The encrypted session record is invalid.");
-  }
-  if (!isRecord2(parsed) || parsed.version !== 1 || typeof parsed.keyId !== "string" || typeof parsed.iv !== "string" || typeof parsed.ciphertext !== "string") {
-    throw new Error("The encrypted session record is invalid.");
-  }
-  return parsed;
-}
-function toBase64Url(bytes) {
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}
-function fromBase64Url(value) {
-  const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
-  const binary = atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "="));
-  const bytes = new Uint8Array(binary.length);
-  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
-  return bytes;
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 // node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -20678,131 +20384,553 @@ function convertBaseSchema(schema2, ctx) {
         if (typeof schema2.maxItems === "number") {
           arraySchema = arraySchema.max(schema2.maxItems);
         }
-        zodSchema = arraySchema;
-      } else {
-        zodSchema = z.array(z.any());
+        zodSchema = arraySchema;
+      } else {
+        zodSchema = z.array(z.any());
+      }
+      break;
+    }
+    default:
+      throw new Error(`Unsupported type: ${type}`);
+  }
+  return zodSchema;
+}
+function convertSchema(schema2, ctx) {
+  if (typeof schema2 === "boolean") {
+    return schema2 ? z.any() : z.never();
+  }
+  let baseSchema = convertBaseSchema(schema2, ctx);
+  const hasExplicitType = schema2.type || schema2.enum !== void 0 || schema2.const !== void 0;
+  if (schema2.anyOf && Array.isArray(schema2.anyOf)) {
+    const options = schema2.anyOf.map((s) => convertSchema(s, ctx));
+    const anyOfUnion = z.union(options);
+    baseSchema = hasExplicitType ? z.intersection(baseSchema, anyOfUnion) : anyOfUnion;
+  }
+  if (schema2.oneOf && Array.isArray(schema2.oneOf)) {
+    const options = schema2.oneOf.map((s) => convertSchema(s, ctx));
+    const oneOfUnion = z.xor(options);
+    baseSchema = hasExplicitType ? z.intersection(baseSchema, oneOfUnion) : oneOfUnion;
+  }
+  if (schema2.allOf && Array.isArray(schema2.allOf)) {
+    if (schema2.allOf.length === 0) {
+      baseSchema = hasExplicitType ? baseSchema : z.any();
+    } else {
+      let result = hasExplicitType ? baseSchema : convertSchema(schema2.allOf[0], ctx);
+      const startIdx = hasExplicitType ? 0 : 1;
+      for (let i = startIdx; i < schema2.allOf.length; i++) {
+        result = z.intersection(result, convertSchema(schema2.allOf[i], ctx));
+      }
+      baseSchema = result;
+    }
+  }
+  if (schema2.nullable === true && ctx.version === "openapi-3.0") {
+    baseSchema = z.nullable(baseSchema);
+  }
+  if (schema2.readOnly === true) {
+    baseSchema = z.readonly(baseSchema);
+  }
+  if (schema2.default !== void 0) {
+    baseSchema = baseSchema.default(schema2.default);
+  }
+  const extraMeta = {};
+  const coreMetadataKeys = ["$id", "id", "$comment", "$anchor", "$vocabulary", "$dynamicRef", "$dynamicAnchor"];
+  for (const key of coreMetadataKeys) {
+    if (key in schema2) {
+      extraMeta[key] = schema2[key];
+    }
+  }
+  const contentMetadataKeys = ["contentEncoding", "contentMediaType", "contentSchema"];
+  for (const key of contentMetadataKeys) {
+    if (key in schema2) {
+      extraMeta[key] = schema2[key];
+    }
+  }
+  for (const key of Object.keys(schema2)) {
+    if (!RECOGNIZED_KEYS.has(key)) {
+      extraMeta[key] = schema2[key];
+    }
+  }
+  if (Object.keys(extraMeta).length > 0) {
+    ctx.registry.add(baseSchema, extraMeta);
+  }
+  if (schema2.description) {
+    baseSchema = baseSchema.describe(schema2.description);
+  }
+  return baseSchema;
+}
+function fromJSONSchema(schema2, params) {
+  if (typeof schema2 === "boolean") {
+    return schema2 ? z.any() : z.never();
+  }
+  let normalized;
+  try {
+    normalized = JSON.parse(JSON.stringify(schema2));
+  } catch {
+    throw new Error("fromJSONSchema input is not valid JSON (possibly cyclic); use $defs/$ref for recursive schemas");
+  }
+  const version2 = detectVersion(normalized, params?.defaultTarget);
+  const defs = normalized.$defs || normalized.definitions || {};
+  const ctx = {
+    version: version2,
+    defs,
+    refs: /* @__PURE__ */ new Map(),
+    processing: /* @__PURE__ */ new Set(),
+    rootSchema: normalized,
+    registry: params?.registry ?? globalRegistry
+  };
+  return convertSchema(normalized, ctx);
+}
+
+// node_modules/zod/v4/classic/coerce.js
+var coerce_exports = {};
+__export(coerce_exports, {
+  bigint: () => bigint3,
+  boolean: () => boolean3,
+  date: () => date4,
+  number: () => number3,
+  string: () => string3
+});
+function string3(params) {
+  return _coercedString(ZodString, params);
+}
+function number3(params) {
+  return _coercedNumber(ZodNumber, params);
+}
+function boolean3(params) {
+  return _coercedBoolean(ZodBoolean, params);
+}
+function bigint3(params) {
+  return _coercedBigint(ZodBigInt, params);
+}
+function date4(params) {
+  return _coercedDate(ZodDate, params);
+}
+
+// node_modules/zod/v4/classic/external.js
+config(en_default());
+
+// src/mcp/protocol.ts
+var MODERN_PROTOCOL_VERSION = "2026-07-28";
+var LEGACY_PROTOCOL_VERSION = "2025-11-25";
+var SUPPORTED_PROTOCOL_VERSIONS = [MODERN_PROTOCOL_VERSION, LEGACY_PROTOCOL_VERSION];
+var JsonRpcRequestSchema = external_exports.object({
+  jsonrpc: external_exports.literal("2.0"),
+  id: external_exports.union([external_exports.string(), external_exports.number(), external_exports.null()]).optional(),
+  method: external_exports.string().trim().min(1),
+  params: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+}).strict();
+var ModernClientMetadataSchema = external_exports.object({
+  "io.modelcontextprotocol/clientCapabilities": external_exports.record(external_exports.string(), external_exports.unknown()),
+  "io.modelcontextprotocol/clientInfo": external_exports.object({
+    name: external_exports.string().trim().min(1),
+    version: external_exports.string().trim().min(1)
+  }).passthrough(),
+  "io.modelcontextprotocol/protocolVersion": external_exports.literal(MODERN_PROTOCOL_VERSION)
+}).passthrough();
+var UnsupportedProtocolVersionError = class extends Error {
+  protocolVersion;
+  supportedVersions = SUPPORTED_PROTOCOL_VERSIONS;
+  constructor(protocolVersion) {
+    super(`Unsupported MCP protocol version: ${protocolVersion}`);
+    this.name = "UnsupportedProtocolVersionError";
+    this.protocolVersion = protocolVersion;
+  }
+};
+var RequestMetadataMismatchError = class extends Error {
+  field;
+  expected;
+  actual;
+  constructor(field, expected, actual) {
+    super(`MCP request metadata mismatch for ${field}.`);
+    this.name = "RequestMetadataMismatchError";
+    this.field = field;
+    this.expected = expected;
+    this.actual = actual;
+  }
+};
+function parseJsonRpcRequest(input) {
+  return JsonRpcRequestSchema.parse(input);
+}
+function resolveProtocolVersion(request, context = {}) {
+  const meta3 = isRecord(request.params?._meta) ? request.params._meta : void 0;
+  const initializeVersion = request.method === "initialize" && typeof request.params?.protocolVersion === "string" ? request.params.protocolVersion : void 0;
+  const requested = context.protocolVersion ?? stringValue(meta3?.["io.modelcontextprotocol/protocolVersion"]) ?? initializeVersion ?? MODERN_PROTOCOL_VERSION;
+  if (!isSupportedProtocolVersion(requested)) {
+    throw new UnsupportedProtocolVersionError(requested);
+  }
+  return requested;
+}
+function assertRequestMetadata(request, protocolVersion, context = {}) {
+  const meta3 = isRecord(request.params?._meta) ? request.params._meta : void 0;
+  const metaVersion = stringValue(meta3?.["io.modelcontextprotocol/protocolVersion"]);
+  if (protocolVersion === MODERN_PROTOCOL_VERSION) {
+    const parsed = ModernClientMetadataSchema.safeParse(meta3);
+    if (!parsed.success) {
+      throw new RequestMetadataMismatchError("_meta", "valid modern client metadata");
+    }
+  }
+  if (context.protocolVersion && metaVersion && context.protocolVersion !== metaVersion) {
+    throw new RequestMetadataMismatchError("protocolVersion", context.protocolVersion, metaVersion);
+  }
+  if (context.method && context.method !== request.method) {
+    throw new RequestMetadataMismatchError("method", context.method, request.method);
+  }
+  const toolName = typeof request.params?.name === "string" ? request.params.name : void 0;
+  if (context.toolName && context.toolName !== toolName) {
+    throw new RequestMetadataMismatchError("name", context.toolName, toolName);
+  }
+}
+function isSupportedProtocolVersion(value) {
+  return SUPPORTED_PROTOCOL_VERSIONS.some((version2) => version2 === value);
+}
+function jsonRpcSuccess(id, result) {
+  return { jsonrpc: "2.0", id, result };
+}
+function jsonRpcFailure(id, error51) {
+  return { jsonrpc: "2.0", id, error: error51 };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringValue(value) {
+  return typeof value === "string" ? value : void 0;
+}
+
+// src/version.ts
+var VERSION = "0.7.0-alpha.5";
+
+// src/worker/http.ts
+var HEALTH_PATH = "/healthz";
+var READY_PATH = "/readyz";
+var MCP_PATH = "/mcp";
+var SESSION_PATH = "/session";
+var SESSION_TOUCH_PATH = "/session/touch";
+var WORKER_SERVICE_ID = "moodle-mcp";
+var WORKER_SERVICE_VERSION = VERSION;
+function createWorkerHandler(dependencies) {
+  return {
+    async fetch(request, env) {
+      const url2 = new URL(request.url);
+      const authorityProblem = validateRequestAuthority(request, url2, env.EXPECTED_HOSTS ?? env.EXPECTED_HOST);
+      if (authorityProblem) return authorityProblem;
+      if (hasQueryCredential(url2)) return unauthorized("Bearer credentials are not accepted in the query string.");
+      if (url2.pathname === HEALTH_PATH && request.method === "GET") {
+        return Response.json(
+          { status: "pass", serviceId: WORKER_SERVICE_ID, version: WORKER_SERVICE_VERSION },
+          { headers: { "content-type": "application/health+json; charset=utf-8" } }
+        );
+      }
+      if (url2.pathname === MCP_PATH && request.method !== "POST") {
+        return problemResponse(405, "METHOD_NOT_ALLOWED", "Method Not Allowed", "The MCP transport accepts POST requests only.", {
+          allow: "POST"
+        });
+      }
+      if (url2.pathname === MCP_PATH) {
+        if (!await verifyBearerToken(request.headers.get("authorization"), [
+          env.MCP_ACCESS_TOKEN_DIGEST,
+          activePreviousDigest(env.MCP_ACCESS_TOKEN_PREVIOUS_DIGEST, env.TOKEN_OVERLAP_EXPIRES_AT)
+        ])) {
+          return unauthorized();
+        }
+        const server = typeof dependencies.mcpServer === "function" ? dependencies.mcpServer(env) : dependencies.mcpServer;
+        return handleMcpRequest(request, server);
       }
-      break;
+      if (url2.pathname === READY_PATH && request.method === "GET") {
+        if (!await authorizeSessionSync(request, env)) return unauthorized();
+        const broker = resolveBroker(dependencies, env);
+        if (broker instanceof Response) return broker;
+        return broker.ready();
+      }
+      if (url2.pathname === SESSION_PATH && request.method === "PUT") {
+        if (!await authorizeSessionSync(request, env)) return unauthorized();
+        const broker = resolveBroker(dependencies, env);
+        if (broker instanceof Response) return broker;
+        return broker.replaceSession(request);
+      }
+      if (url2.pathname === SESSION_TOUCH_PATH && request.method === "POST") {
+        if (!await authorizeSessionSync(request, env)) return unauthorized();
+        const broker = resolveBroker(dependencies, env);
+        if (broker instanceof Response) return broker;
+        return broker.touch();
+      }
+      if (url2.pathname === READY_PATH || url2.pathname === SESSION_PATH || url2.pathname === SESSION_TOUCH_PATH) {
+        const method = url2.pathname === READY_PATH ? "GET" : url2.pathname === SESSION_PATH ? "PUT" : "POST";
+        return problemResponse(405, "METHOD_NOT_ALLOWED", "Method Not Allowed", "The session route does not accept this method.", {
+          allow: method
+        });
+      }
+      return problemResponse(404, "NOT_FOUND", "Not Found", "The requested route does not exist.");
     }
-    default:
-      throw new Error(`Unsupported type: ${type}`);
-  }
-  return zodSchema;
+  };
 }
-function convertSchema(schema2, ctx) {
-  if (typeof schema2 === "boolean") {
-    return schema2 ? z.any() : z.never();
-  }
-  let baseSchema = convertBaseSchema(schema2, ctx);
-  const hasExplicitType = schema2.type || schema2.enum !== void 0 || schema2.const !== void 0;
-  if (schema2.anyOf && Array.isArray(schema2.anyOf)) {
-    const options = schema2.anyOf.map((s) => convertSchema(s, ctx));
-    const anyOfUnion = z.union(options);
-    baseSchema = hasExplicitType ? z.intersection(baseSchema, anyOfUnion) : anyOfUnion;
+function createDurableObjectBrokerApi(namespace) {
+  const stub = namespace.get(namespace.idFromName("primary"));
+  return {
+    async handleMcp(body, context) {
+      const response = await stub.fetch(new Request("https://session-broker/mcp", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ request: body, context })
+      }));
+      if (!response.ok) {
+        const problem = await safeProblem(response);
+        throw new SessionBrokerMcpError(response.status, problem?.code);
+      }
+      const envelope = await response.json();
+      return envelope.response ?? null;
+    },
+    ready: () => stub.fetch(new Request("https://session-broker/readyz")),
+    async replaceSession(request) {
+      return stub.fetch(new Request("https://session-broker/session", {
+        method: "PUT",
+        headers: { "content-type": request.headers.get("content-type") ?? "application/json" },
+        body: await request.arrayBuffer()
+      }));
+    },
+    touch: () => stub.fetch(new Request("https://session-broker/session/touch", { method: "POST" }))
+  };
+}
+var SessionBrokerMcpError = class extends Error {
+  constructor(status, code) {
+    super("The session broker could not complete the MCP request.");
+    this.status = status;
+    this.code = code;
+    this.name = "SessionBrokerMcpError";
   }
-  if (schema2.oneOf && Array.isArray(schema2.oneOf)) {
-    const options = schema2.oneOf.map((s) => convertSchema(s, ctx));
-    const oneOfUnion = z.xor(options);
-    baseSchema = hasExplicitType ? z.intersection(baseSchema, oneOfUnion) : oneOfUnion;
+  status;
+  code;
+};
+function resolveBroker(dependencies, env) {
+  if (dependencies.broker) return dependencies.broker(env);
+  if (env.SESSION_BROKER) return createDurableObjectBrokerApi(env.SESSION_BROKER);
+  return problemResponse(503, "SESSION_BROKER_UNAVAILABLE", "Service Unavailable", "The session broker is unavailable.");
+}
+function validateRequestAuthority(request, url2, configuredHosts) {
+  const expectedHosts = (configuredHosts ?? url2.host).split(",").map((host) => host.trim().toLowerCase()).filter(Boolean);
+  const requestHost = (request.headers.get("host") ?? url2.host).toLowerCase();
+  if (requestHost !== url2.host.toLowerCase() || !expectedHosts.includes(requestHost)) {
+    return problemResponse(403, "INVALID_HOST", "Forbidden", "The request Host is not allowed.");
   }
-  if (schema2.allOf && Array.isArray(schema2.allOf)) {
-    if (schema2.allOf.length === 0) {
-      baseSchema = hasExplicitType ? baseSchema : z.any();
-    } else {
-      let result = hasExplicitType ? baseSchema : convertSchema(schema2.allOf[0], ctx);
-      const startIdx = hasExplicitType ? 0 : 1;
-      for (let i = startIdx; i < schema2.allOf.length; i++) {
-        result = z.intersection(result, convertSchema(schema2.allOf[i], ctx));
-      }
-      baseSchema = result;
+  const origin = request.headers.get("origin");
+  if (!origin) return null;
+  try {
+    const parsed = new URL(origin);
+    if (parsed.origin !== url2.origin || !expectedHosts.includes(parsed.host.toLowerCase())) {
+      return problemResponse(403, "INVALID_ORIGIN", "Forbidden", "The request Origin is not allowed.");
     }
+  } catch {
+    return problemResponse(403, "INVALID_ORIGIN", "Forbidden", "The request Origin is not allowed.");
   }
-  if (schema2.nullable === true && ctx.version === "openapi-3.0") {
-    baseSchema = z.nullable(baseSchema);
-  }
-  if (schema2.readOnly === true) {
-    baseSchema = z.readonly(baseSchema);
+  return null;
+}
+function unauthorized(detail = "A valid Bearer token is required.") {
+  return problemResponse(401, "INVALID_BEARER_TOKEN", "Unauthorized", detail, {
+    "www-authenticate": 'Bearer realm="moodle-mcp"'
+  });
+}
+async function handleMcpRequest(request, server) {
+  if (!request.headers.get("content-type")?.toLowerCase().startsWith("application/json")) {
+    return problemResponse(415, "UNSUPPORTED_MEDIA_TYPE", "Unsupported Media Type", "MCP requests must use application/json.");
   }
-  if (schema2.default !== void 0) {
-    baseSchema = baseSchema.default(schema2.default);
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return problemResponse(400, "INVALID_JSON", "Bad Request", "The request body is not valid JSON.");
   }
-  const extraMeta = {};
-  const coreMetadataKeys = ["$id", "id", "$comment", "$anchor", "$vocabulary", "$dynamicRef", "$dynamicAnchor"];
-  for (const key of coreMetadataKeys) {
-    if (key in schema2) {
-      extraMeta[key] = schema2[key];
+  const protocolVersion = request.headers.get("mcp-protocol-version");
+  const metadataProblem = validateProtocolMetadata(request.headers, body, protocolVersion);
+  if (metadataProblem) return metadataProblem;
+  try {
+    const response = await server.handle(body, {
+      protocolVersion,
+      method: request.headers.get("mcp-method") ?? void 0,
+      toolName: request.headers.get("mcp-name") ?? void 0
+    });
+    if (response === null) return new Response(null, { status: 202 });
+    if (isUnsupportedProtocolVersionResponse(response)) {
+      return Response.json(response, {
+        status: 400,
+        headers: { "cache-control": "private, no-store" }
+      });
     }
-  }
-  const contentMetadataKeys = ["contentEncoding", "contentMediaType", "contentSchema"];
-  for (const key of contentMetadataKeys) {
-    if (key in schema2) {
-      extraMeta[key] = schema2[key];
+    if (request.headers.get("accept")?.toLowerCase().includes("text/event-stream")) {
+      return new Response(`event: message
+data: ${JSON.stringify(response)}
+
+`, {
+        headers: {
+          "cache-control": "private, no-store",
+          "content-type": "text/event-stream; charset=utf-8"
+        }
+      });
     }
-  }
-  for (const key of Object.keys(schema2)) {
-    if (!RECOGNIZED_KEYS.has(key)) {
-      extraMeta[key] = schema2[key];
+    return Response.json(response, { headers: { "cache-control": "private, no-store" } });
+  } catch (error51) {
+    if (error51 instanceof SessionBrokerMcpError) {
+      const status = error51.status === 503 ? 503 : 500;
+      const code = error51.code === "SESSION_MISSING" || error51.code === "SESSION_EXPIRED" ? error51.code : "SESSION_UNAVAILABLE";
+      return problemResponse(status, code, "Service Unavailable", "The Moodle session is not ready.");
     }
+    if (error51 instanceof Error && error51.name === "UnsupportedProtocolVersionError") {
+      const requested = "protocolVersion" in error51 && typeof error51.protocolVersion === "string" ? error51.protocolVersion : protocolVersion ?? "unknown";
+      return Response.json({
+        jsonrpc: "2.0",
+        id: jsonRpcRequestId(body),
+        error: {
+          code: -32022,
+          message: "Unsupported protocol version",
+          data: { supported: [...SUPPORTED_PROTOCOL_VERSIONS], requested }
+        }
+      }, {
+        status: 400,
+        headers: { "cache-control": "private, no-store" }
+      });
+    }
+    return problemResponse(500, "MCP_REQUEST_FAILED", "Internal Server Error", "The MCP request could not be completed.");
   }
-  if (Object.keys(extraMeta).length > 0) {
-    ctx.registry.add(baseSchema, extraMeta);
-  }
-  if (schema2.description) {
-    baseSchema = baseSchema.describe(schema2.description);
-  }
-  return baseSchema;
 }
-function fromJSONSchema(schema2, params) {
-  if (typeof schema2 === "boolean") {
-    return schema2 ? z.any() : z.never();
-  }
-  let normalized;
+async function safeProblem(response) {
   try {
-    normalized = JSON.parse(JSON.stringify(schema2));
+    const value = await response.json();
+    return isRecord2(value) && (value.code === void 0 || typeof value.code === "string") ? value : null;
   } catch {
-    throw new Error("fromJSONSchema input is not valid JSON (possibly cyclic); use $defs/$ref for recursive schemas");
+    return null;
+  }
+}
+function validateProtocolMetadata(headers, body, protocolVersion) {
+  if (!protocolVersion) {
+    return headerMismatchResponse(body, "MCP-Protocol-Version is required.");
+  }
+  const params = isRecord2(body.params) ? body.params : void 0;
+  const metadata = params && isRecord2(params._meta) ? params._meta : void 0;
+  const bodyVersion = metadata?.["io.modelcontextprotocol/protocolVersion"];
+  if (bodyVersion !== void 0 && bodyVersion !== protocolVersion) {
+    return headerMismatchResponse(body, "MCP protocol metadata does not match the HTTP headers.");
+  }
+  if (typeof body.method !== "string") {
+    return problemResponse(400, "MCP_PROTOCOL_METADATA_INVALID", "Bad Request", "The JSON-RPC method is required.");
+  }
+  const headerMethod = headers.get("mcp-method");
+  const headerName = headers.get("mcp-name") ?? void 0;
+  const paramsName = params && typeof params.name === "string" ? params.name : void 0;
+  const requiresModernHeaders = protocolVersion !== LEGACY_PROTOCOL_VERSION;
+  const hasModernHeaders = headerMethod !== null || headerName !== void 0;
+  if ((requiresModernHeaders || hasModernHeaders) && (headerMethod !== body.method || headerName !== paramsName)) {
+    return headerMismatchResponse(body, "MCP method metadata does not match the JSON-RPC request.");
+  }
+  return null;
+}
+function headerMismatchResponse(body, detail) {
+  return Response.json({
+    jsonrpc: "2.0",
+    id: jsonRpcRequestId(body),
+    error: {
+      code: -32020,
+      message: "HeaderMismatch",
+      data: { detail }
+    }
+  }, {
+    status: 400,
+    headers: { "cache-control": "private, no-store" }
+  });
+}
+function jsonRpcRequestId(body) {
+  return typeof body.id === "string" || typeof body.id === "number" || body.id === null ? body.id : null;
+}
+function isUnsupportedProtocolVersionResponse(value) {
+  if (!isRecord2(value) || !isRecord2(value.error)) return false;
+  return value.jsonrpc === "2.0" && value.error.code === -32022;
+}
+function authorizeSessionSync(request, env) {
+  return verifyBearerToken(request.headers.get("authorization"), [
+    env.SESSION_SYNC_TOKEN_DIGEST,
+    activePreviousDigest(env.SESSION_SYNC_TOKEN_PREVIOUS_DIGEST, env.TOKEN_OVERLAP_EXPIRES_AT)
+  ]);
+}
+function activePreviousDigest(digest, expiresAt2) {
+  if (!digest || !expiresAt2) return void 0;
+  const expiration = Number(expiresAt2);
+  return Number.isFinite(expiration) && Date.now() < expiration ? digest : void 0;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/worker/crypto.ts
+async function createEncryptionKeyring(currentSecret, previousSecret) {
+  if (!currentSecret) throw new Error("SESSION_ENCRYPTION_KEY is required.");
+  const current = await deriveEncryptionKey(currentSecret);
+  const keys = /* @__PURE__ */ new Map([[current.id, current.key]]);
+  if (previousSecret) {
+    const previous = await deriveEncryptionKey(previousSecret);
+    keys.set(previous.id, previous.key);
   }
-  const version2 = detectVersion(normalized, params?.defaultTarget);
-  const defs = normalized.$defs || normalized.definitions || {};
-  const ctx = {
-    version: version2,
-    defs,
-    refs: /* @__PURE__ */ new Map(),
-    processing: /* @__PURE__ */ new Set(),
-    rootSchema: normalized,
-    registry: params?.registry ?? globalRegistry
+  return { current, keys };
+}
+async function encryptValue(value, keyring) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    keyring.current.key,
+    new TextEncoder().encode(value)
+  );
+  return JSON.stringify({
+    version: 1,
+    keyId: keyring.current.id,
+    iv: toBase64Url(iv),
+    ciphertext: toBase64Url(new Uint8Array(ciphertext))
+  });
+}
+async function decryptValue(encrypted, keyring) {
+  const envelope = parseEnvelope(encrypted);
+  const key = keyring.keys.get(envelope.keyId);
+  if (!key) throw new Error("The session encryption key is unavailable.");
+  const plaintext = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: fromBase64Url(envelope.iv) },
+    key,
+    fromBase64Url(envelope.ciphertext)
+  );
+  return {
+    value: new TextDecoder().decode(plaintext),
+    keyId: envelope.keyId,
+    needsRotation: envelope.keyId !== keyring.current.id
   };
-  return convertSchema(normalized, ctx);
 }
-
-// node_modules/zod/v4/classic/coerce.js
-var coerce_exports = {};
-__export(coerce_exports, {
-  bigint: () => bigint3,
-  boolean: () => boolean3,
-  date: () => date4,
-  number: () => number3,
-  string: () => string3
-});
-function string3(params) {
-  return _coercedString(ZodString, params);
+async function deriveEncryptionKey(secret) {
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret)));
+  const key = await crypto.subtle.importKey("raw", digest, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+  const id = Array.from(digest.slice(0, 8), (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return { id, key };
 }
-function number3(params) {
-  return _coercedNumber(ZodNumber, params);
+function parseEnvelope(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("The encrypted session record is invalid.");
+  }
+  if (!isRecord3(parsed) || parsed.version !== 1 || typeof parsed.keyId !== "string" || typeof parsed.iv !== "string" || typeof parsed.ciphertext !== "string") {
+    throw new Error("The encrypted session record is invalid.");
+  }
+  return parsed;
 }
-function boolean3(params) {
-  return _coercedBoolean(ZodBoolean, params);
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
 }
-function bigint3(params) {
-  return _coercedBigint(ZodBigInt, params);
+function fromBase64Url(value) {
+  const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
+  const binary = atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "="));
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+  return bytes;
 }
-function date4(params) {
-  return _coercedDate(ZodDate, params);
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-// node_modules/zod/v4/classic/external.js
-config(en_default());
-
 // src/constants.ts
 var PACKAGE_NAME = "moodle-cli";
 var NPM_LATEST_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
@@ -20917,19 +21045,19 @@ function parseUserInfo(value) {
   const data = asRecord(value);
   return {
     userid: numberValue(data.userid),
-    username: stringValue(data.username),
-    fullname: stringValue(data.fullname),
-    sitename: stringValue(data.sitename),
-    siteurl: stringValue(data.siteurl),
-    lang: stringValue(data.lang)
+    username: stringValue2(data.username),
+    fullname: stringValue2(data.fullname),
+    sitename: stringValue2(data.sitename),
+    siteurl: stringValue2(data.siteurl),
+    lang: stringValue2(data.lang)
   };
 }
 function parseCourse(value, nowSeconds = Math.floor(Date.now() / 1e3)) {
   const data = asRecord(value);
   const course = {
     id: numberValue(data.id),
-    shortname: stringValue(data.shortname),
-    fullname: stringValue(data.fullname),
+    shortname: stringValue2(data.shortname),
+    fullname: stringValue2(data.fullname),
     category: numberValue(data.category),
     visible: booleanValue(data.visible, true),
     startdate: numberValue(data.startdate)
@@ -20947,21 +21075,21 @@ function parseActivity(value) {
   const data = asRecord(value);
   return {
     id: numberValue(data.id),
-    name: stringValue(data.name),
-    modname: stringValue(data.modname),
-    url: stringValue(data.url),
+    name: stringValue2(data.name),
+    modname: stringValue2(data.modname),
+    url: stringValue2(data.url),
     visible: booleanValue(data.visible, true),
-    description: stringValue(data.description)
+    description: stringValue2(data.description)
   };
 }
 function parseSection(value) {
   const data = asRecord(value);
   return {
     id: numberValue(data.id),
-    name: stringValue(data.name),
+    name: stringValue2(data.name),
     section: numberValue(data.section),
     visible: booleanValue(data.visible, true),
-    summary: stringValue(data.summary),
+    summary: stringValue2(data.summary),
     activities: asArray(data.modules).map((item) => parseActivity(item))
   };
 }
@@ -20975,13 +21103,13 @@ function parseCourseFormatState(value, baseUrl) {
   for (const item of asArray(state.cm)) {
     const data = asRecord(item);
     const id = numberValue(data.id);
-    const sectionId = stringValue(data.sectionid);
-    const module = stringValue(data.module) || stringValue(data.plugin).replace(/^mod_/u, "") || stringValue(data.modname).toLowerCase();
+    const sectionId = stringValue2(data.sectionid);
+    const module = stringValue2(data.module) || stringValue2(data.plugin).replace(/^mod_/u, "") || stringValue2(data.modname).toLowerCase();
     const activity = {
       id,
       name: htmlText(data.name, baseUrl),
       modname: module.toLowerCase(),
-      url: stringValue(data.url) ? resolveUrl(baseUrl, stringValue(data.url)) : "",
+      url: stringValue2(data.url) ? resolveUrl(baseUrl, stringValue2(data.url)) : "",
       visible: booleanValue(data.visible, true) && booleanValue(data.uservisible, true) && !booleanValue(data.stealth),
       description: htmlText(data.content ?? data.description, baseUrl)
     };
@@ -20994,7 +21122,7 @@ function parseCourseFormatState(value, baseUrl) {
     const data = asRecord(item);
     const id = numberValue(data.id);
     const hasActivityList = Array.isArray(data.cmlist);
-    const listedActivities = asArray(data.cmlist).map((activityId) => activities.get(stringValue(activityId))).filter((activity) => activity !== void 0);
+    const listedActivities = asArray(data.cmlist).map((activityId) => activities.get(stringValue2(activityId))).filter((activity) => activity !== void 0);
     return {
       id,
       name: htmlText(data.title || data.rawtitle, baseUrl),
@@ -21012,18 +21140,18 @@ function parseTodoItem(value) {
   const progress = course.progress;
   return {
     id: numberValue(data.id),
-    name: stringValue(data.name),
-    activity_name: stringValue(data.activityname),
-    modname: stringValue(data.modulename),
+    name: stringValue2(data.name),
+    activity_name: stringValue2(data.activityname),
+    modname: stringValue2(data.modulename),
     course_id: numberValue(course.id),
-    course_name: stringValue(course.fullname),
+    course_name: stringValue2(course.fullname),
     due_at: numberValue(data.timesort) || numberValue(data.timestart),
     overdue: booleanValue(data.overdue),
     actionable: booleanValue(action.actionable),
-    action_name: stringValue(action.name),
-    action_url: stringValue(action.url),
-    url: stringValue(data.url),
-    event_type: stringValue(data.eventtype),
+    action_name: stringValue2(action.name),
+    action_url: stringValue2(action.url),
+    url: stringValue2(data.url),
+    event_type: stringValue2(data.eventtype),
     course_progress: typeof progress === "number" ? progress : void 0
   };
 }
@@ -21034,15 +21162,15 @@ function parseAlertNotification(value) {
   const data = asRecord(value);
   return {
     id: numberValue(data.id),
-    subject: stringValue(data.subject),
-    short_subject: stringValue(data.shortenedsubject),
-    event_type: stringValue(data.eventtype),
-    component: stringValue(data.component),
+    subject: stringValue2(data.subject),
+    short_subject: stringValue2(data.shortenedsubject),
+    event_type: stringValue2(data.eventtype),
+    component: stringValue2(data.component),
     created_at: numberValue(data.timecreated),
-    created_pretty: stringValue(data.timecreatedpretty),
+    created_pretty: stringValue2(data.timecreatedpretty),
     read: booleanValue(data.read),
-    context_url: stringValue(data.contexturl),
-    context_name: stringValue(data.contexturlname)
+    context_url: stringValue2(data.contexturl),
+    context_name: stringValue2(data.contexturlname)
   };
 }
 function parseAlertSummary(notificationsData, countsData, unreadCountsData) {
@@ -21071,20 +21199,20 @@ function parseForumPostAuthor(value) {
   const urls = asRecord(data.urls);
   return {
     id: numberValue(data.id),
-    fullname: stringValue(data.fullname),
-    profile_url: stringValue(urls.profile),
-    profile_image_url: stringValue(urls.profileimage)
+    fullname: stringValue2(data.fullname),
+    profile_url: stringValue2(urls.profile),
+    profile_image_url: stringValue2(urls.profileimage)
   };
 }
 function parseForumPost(value, baseUrl = "") {
   const data = asRecord(value);
   const urls = asRecord(data.urls);
-  const messageHtml = stringValue(data.message);
-  const structured = htmlToStructuredContent(messageHtml, stringValue(urls.view || urls.discuss) || baseUrl);
+  const messageHtml = stringValue2(data.message);
+  const structured = htmlToStructuredContent(messageHtml, stringValue2(urls.view || urls.discuss) || baseUrl);
   return {
     id: numberValue(data.id),
     discussion_id: numberValue(data.discussionid),
-    subject: stringValue(data.subject),
+    subject: stringValue2(data.subject),
     message_html: messageHtml,
     message_text: structured.text,
     image_urls: structured.image_urls,
@@ -21098,8 +21226,8 @@ function parseForumPost(value, baseUrl = "") {
     unread: booleanValue(data.unread),
     is_deleted: booleanValue(data.isdeleted),
     is_private_reply: booleanValue(data.isprivatereply),
-    url: stringValue(urls.view || urls.viewisolated),
-    reply_url: stringValue(urls.reply)
+    url: stringValue2(urls.view || urls.viewisolated),
+    reply_url: stringValue2(urls.reply)
   };
 }
 function parseForumDiscussion(value, discussionId, baseUrl = "") {
@@ -21111,7 +21239,7 @@ function parseForumDiscussion(value, discussionId, baseUrl = "") {
     course_id: numberValue(data.courseid),
     forum_id: numberValue(data.forumid),
     group_id: numberValue(data.groupid),
-    group_name: stringValue(data.groupname),
+    group_name: stringValue2(data.groupname),
     url: posts[0]?.url ? posts[0].url.split("#", 1)[0] : "",
     posts
   };
@@ -21122,7 +21250,7 @@ function asRecord(value) {
 function asArray(value) {
   return Array.isArray(value) ? value : [];
 }
-function stringValue(value) {
+function stringValue2(value) {
   return typeof value === "string" ? value : value == null ? "" : String(value);
 }
 function numberValue(value) {
@@ -21149,15 +21277,41 @@ function parseJsonValue(value) {
   }
 }
 function htmlText(value, baseUrl) {
-  return htmlToStructuredContent(stringValue(value), baseUrl).text;
+  return htmlToStructuredContent(stringValue2(value), baseUrl).text;
 }
 
 // src/scraper.ts
 var import_node_html_parser2 = __toESM(require_dist(), 1);
+function parseMoodleErrorHtml(html) {
+  const root = (0, import_node_html_parser2.parse)(html);
+  const messageNode = first(root, [
+    ".errormessage",
+    ".alert-danger .alert-message",
+    "[data-region='error-message']",
+    ".alert-danger[role='alert']",
+    ".alert-danger"
+  ]);
+  if (!messageNode) {
+    return null;
+  }
+  const messageRoot = (0, import_node_html_parser2.parse)(messageNode.toString());
+  for (const unwanted of messageRoot.querySelectorAll(
+    "button, .close, .errorcode, .stacktrace, .debuginfo, .backtrace, a.alert-link, a[href*='/error/']"
+  )) {
+    unwanted.remove();
+  }
+  const message = cleanText(messageRoot.textContent);
+  if (!message) {
+    return null;
+  }
+  const errorCodeText = cleanNodeText(root.querySelector(".errorcode"));
+  const errorCode = errorCodeText.match(/^error\s+code\s*:\s*([a-z][a-z0-9_]*)\s*$/iu)?.[1] ?? moodleDocsErrorCode(root);
+  return { message, ...errorCode ? { code: errorCode } : {} };
+}
 function parsePageContext(html, baseUrl) {
   const root = (0, import_node_html_parser2.parse)(html);
   const config2 = parseMoodleConfig(html);
-  const sesskey = stringValue2(config2.sesskey).trim();
+  const sesskey = stringValue3(config2.sesskey).trim();
   const userid = numberValue2(config2.userId) || numberValue2(root.querySelector("[data-user-id]")?.getAttribute("data-user-id"));
   if (!sesskey || !userid) {
     throw new Error("Session appears invalid: could not load authenticated Moodle context");
@@ -21170,7 +21324,7 @@ function parsePageContext(html, baseUrl) {
       fullname: cleanNodeText(root.querySelector(".userfullname")),
       sitename: extractSitename(root),
       siteurl: baseUrl,
-      lang: stringValue2(config2.language) || root.querySelector("html")?.getAttribute("lang") || ""
+      lang: stringValue3(config2.language) || root.querySelector("html")?.getAttribute("lang") || ""
     }
   };
 }
@@ -21240,9 +21394,9 @@ function parseCourseSectionNumbers(html, courseId) {
   for (const href of hrefs) {
     const url2 = parseMaybeUrl(href.replace(/&amp;/gu, "&"), "https://moodle.invalid");
     const id = url2?.searchParams.get("id");
-    const sectionValue = url2?.searchParams.get("section");
-    if (id === String(courseId) && sectionValue && /^\d+$/.test(sectionValue)) {
-      const section = Number(sectionValue);
+    const sectionValue2 = url2?.searchParams.get("section");
+    if (id === String(courseId) && sectionValue2 && /^\d+$/.test(sectionValue2)) {
+      const section = Number(sectionValue2);
       if (!sections.includes(section)) {
         sections.push(section);
       }
@@ -21585,6 +21739,16 @@ function selectedGroupName(root, groupId) {
   }
   return "";
 }
+function moodleDocsErrorCode(root) {
+  for (const link of root.querySelectorAll("a[href*='/error/']")) {
+    const href = link.getAttribute("href") ?? "";
+    const code = href.match(/\/error\/[^/]+\/([a-z][a-z0-9_]*)/iu)?.[1];
+    if (code) {
+      return code;
+    }
+  }
+  return void 0;
+}
 function cleanNodeText(node) {
   return cleanText(node?.textContent ?? "");
 }
@@ -21707,7 +21871,7 @@ function numberValue2(value) {
   }
   return 0;
 }
-function stringValue2(value) {
+function stringValue3(value) {
   return typeof value === "string" ? value : value == null ? "" : String(value);
 }
 function fileEntry(name, url2, baseUrl) {
@@ -21834,13 +21998,13 @@ var ForumModule = class {
   }
 };
 function shouldFallbackForumAjax(error51) {
-  if (!isRecord3(error51)) {
+  if (!isRecord4(error51)) {
     return false;
   }
   const code = typeof error51.moodleErrorCode === "string" ? error51.moodleErrorCode : "";
   return code === "servicenotavailable" || code === "accessexception" || error51 instanceof Error && error51.message.includes("Web service is not available");
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -22074,7 +22238,7 @@ var MoodleClientCoreApiError = class extends MoodleClientCoreError {
   moodleErrorCode;
   constructor(message, moodleErrorCode) {
     const auth = isLoginErrorCode(moodleErrorCode);
-    const notFound = ["invalidrecord", "invalidcoursemodule"].includes(moodleErrorCode ?? "") || /^HTTP 404\b/.test(message);
+    const notFound = ["invalidrecord", "invalidcoursemodule"].includes(moodleErrorCode ?? "") || /\bHTTP 404\b/.test(message);
     super(
       auth ? "auth" : notFound ? "not_found" : "upstream",
       message,
@@ -22141,7 +22305,7 @@ var MoodleClientCore = class {
     await this.ensureSession();
     try {
       const data = await this.call(FUNC_GET_SITE_INFO);
-      if (isRecord4(data) && "userid" in data) {
+      if (isRecord5(data) && "userid" in data) {
         const info = parseUserInfo(data);
         this.sesskey = typeof data.sesskey === "string" ? data.sesskey : this.sesskey;
         this.userid = info.userid;
@@ -22226,9 +22390,9 @@ var MoodleClientCore = class {
     let type = "";
     try {
       const data = await this.call(FUNC_GET_COURSE_MODULE, { cmid: id });
-      const module = isRecord4(data) && isRecord4(data.cm) ? data.cm : data;
-      type = isRecord4(module) && typeof module.modname === "string" ? module.modname : "";
-      courseId = isRecord4(module) && typeof module.course === "number" ? module.course : void 0;
+      const module = isRecord5(data) && isRecord5(data.cm) ? data.cm : data;
+      type = isRecord5(module) && typeof module.modname === "string" ? module.modname : "";
+      courseId = isRecord5(module) && typeof module.course === "number" ? module.course : void 0;
     } catch (error51) {
       if (!this.errors.isApi(error51) || error51.moodleErrorCode !== "servicenotavailable") {
         throw error51;
@@ -22261,7 +22425,7 @@ var MoodleClientCore = class {
       aftereventid: 0,
       limittononsuspendedevents: true
     });
-    const events = isRecord4(data) && Array.isArray(data.events) ? data.events : [];
+    const events = isRecord5(data) && Array.isArray(data.events) ? data.events : [];
     return parseTodoItems(events);
   }
   async getAlerts(limit = 20) {
@@ -22505,7 +22669,15 @@ var MoodleClientCore = class {
       throw this.errors.api("Session expired", "servicerequireslogin");
     }
     if (!response.ok) {
-      throw this.errors.api(`HTTP ${response.status} loading ${safeUrl(url2)}`);
+      const context = `HTTP ${response.status} loading ${safeUrl(url2)}`;
+      const contentType2 = response.headers.get("content-type")?.toLowerCase() ?? "";
+      if (contentType2.includes("text/html") || contentType2.includes("application/xhtml+xml")) {
+        const moodleError = await response.text().then(parseMoodleErrorHtml).catch(() => null);
+        if (moodleError) {
+          throw this.errors.api(`${moodleError.message} (${context})`, moodleError.code);
+        }
+      }
+      throw this.errors.api(context);
     }
     return response;
   }
@@ -22514,7 +22686,7 @@ var MoodleClientCore = class {
     let offset = 0;
     while (true) {
       const data = await this.call(FUNC_GET_COURSES_BY_TIMELINE, { classification: "all", limit: 100, offset });
-      if (!isRecord4(data) || !Array.isArray(data.courses) || !data.courses.length) {
+      if (!isRecord5(data) || !Array.isArray(data.courses) || !data.courses.length) {
         break;
       }
       courses.push(...data.courses);
@@ -22679,7 +22851,7 @@ function queryMatches(text, query) {
   return needle ? haystack.includes(needle) || needle.split(" ").every((token) => haystack.includes(token)) : true;
 }
 function parseTodoPayload(value) {
-  return parseTodoItems(isRecord4(value) && Array.isArray(value.events) ? value.events : []);
+  return parseTodoItems(isRecord5(value) && Array.isArray(value.events) ? value.events : []);
 }
 function errorMessage(value) {
   return value instanceof Error ? value.message : "Unknown Moodle error";
@@ -22691,7 +22863,7 @@ function chunks(values, size) {
   }
   return result;
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function isLoginErrorCode(code) {
@@ -22714,6 +22886,8 @@ function safeUrl(value) {
 }
 
 // src/mcp/gateway.ts
+var import_node_html_parser3 = __toESM(require_dist(), 1);
+var MAX_MCP_FILE_BYTES = 16 * 1024 * 1024;
 var MoodleGatewayError = class extends Error {
   code;
   constructor(code, message) {
@@ -22749,95 +22923,211 @@ function createMoodleGateway(client) {
       return limit === void 0 ? forums : forums.slice(0, limit);
     },
     searchForums: ({ forumId, ...input }) => client.searchForumContent({ ...input, forumCmid: forumId }),
-    getThread: ({ discussionId }) => client.getForumDiscussion(discussionId)
+    getThread: ({ discussionId }) => client.getForumDiscussion(discussionId),
+    async getFile({ source }) {
+      let target = await resolveFileTarget(client, source);
+      let response = await client.requestAbsolute(target.url);
+      if (isHtml(response)) {
+        const html = await response.text();
+        if (looksLikeLoginPage(html)) throw fileAuthenticationRequired();
+        const links = resourceLinks(html, target.url);
+        if (links.length !== 1) {
+          const code = links.length ? "MOODLE_FILE_SOURCE_AMBIGUOUS" : "MOODLE_FILE_NOT_FOUND";
+          throw new MoodleGatewayError(code, "The Moodle resource did not resolve to exactly one file.");
+        }
+        const resolved = await resolveFileTarget(client, links[0].url);
+        target = { ...resolved, name: target.name || links[0].name || resolved.name };
+        response = await client.requestAbsolute(target.url);
+        if (isHtml(response)) {
+          if (looksLikeLoginPage(await response.text())) throw fileAuthenticationRequired();
+          throw new MoodleGatewayError("MOODLE_FILE_NOT_FOUND", "Moodle did not return a downloadable file.");
+        }
+      }
+      const contentLength = Number(response.headers.get("content-length"));
+      if (Number.isFinite(contentLength) && contentLength > MAX_MCP_FILE_BYTES) {
+        throw fileTooLarge();
+      }
+      const content = await readBoundedBody(response, MAX_MCP_FILE_BYTES);
+      const name = safeFilename(contentDispositionFilename(response.headers.get("content-disposition"))) ?? safeFilename(target.name) ?? safeFilename(urlFilename(response.url || target.url));
+      if (!name) {
+        throw new MoodleGatewayError("MOODLE_FILE_NAME_MISSING", "Moodle did not provide a safe filename.");
+      }
+      return {
+        name,
+        mimeType: contentType(response),
+        bytes: content.byteLength,
+        uri: publicFileUrl(response.url || target.url),
+        blob: encodeBase64(content)
+      };
+    }
   };
 }
-
-// src/mcp/protocol.ts
-var MODERN_PROTOCOL_VERSION = "2026-07-28";
-var LEGACY_PROTOCOL_VERSION = "2025-11-25";
-var SUPPORTED_PROTOCOL_VERSIONS = [MODERN_PROTOCOL_VERSION, LEGACY_PROTOCOL_VERSION];
-var JsonRpcRequestSchema = external_exports.object({
-  jsonrpc: external_exports.literal("2.0"),
-  id: external_exports.union([external_exports.string(), external_exports.number(), external_exports.null()]).optional(),
-  method: external_exports.string().trim().min(1),
-  params: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-}).strict();
-var ModernClientMetadataSchema = external_exports.object({
-  "io.modelcontextprotocol/clientCapabilities": external_exports.record(external_exports.string(), external_exports.unknown()),
-  "io.modelcontextprotocol/clientInfo": external_exports.object({
-    name: external_exports.string().trim().min(1),
-    version: external_exports.string().trim().min(1)
-  }).passthrough(),
-  "io.modelcontextprotocol/protocolVersion": external_exports.literal(MODERN_PROTOCOL_VERSION)
-}).passthrough();
-var UnsupportedProtocolVersionError = class extends Error {
-  protocolVersion;
-  supportedVersions = SUPPORTED_PROTOCOL_VERSIONS;
-  constructor(protocolVersion) {
-    super(`Unsupported MCP protocol version: ${protocolVersion}`);
-    this.name = "UnsupportedProtocolVersionError";
-    this.protocolVersion = protocolVersion;
+async function resolveFileTarget(client, rawSource) {
+  const source = String(rawSource).trim();
+  if (/^\d+$/u.test(source)) {
+    const activityId = Number(source);
+    if (!Number.isSafeInteger(activityId) || activityId < 1) throw invalidFileSource();
+    return validateFileTarget(client, await fileFromActivity(client, activityId));
   }
-};
-var RequestMetadataMismatchError = class extends Error {
-  field;
-  expected;
-  actual;
-  constructor(field, expected, actual) {
-    super(`MCP request metadata mismatch for ${field}.`);
-    this.name = "RequestMetadataMismatchError";
-    this.field = field;
-    this.expected = expected;
-    this.actual = actual;
+  let url2;
+  try {
+    url2 = new URL(source);
+  } catch {
+    throw invalidFileSource();
   }
-};
-function parseJsonRpcRequest(input) {
-  return JsonRpcRequestSchema.parse(input);
-}
-function resolveProtocolVersion(request, context = {}) {
-  const meta3 = isRecord5(request.params?._meta) ? request.params._meta : void 0;
-  const initializeVersion = request.method === "initialize" && typeof request.params?.protocolVersion === "string" ? request.params.protocolVersion : void 0;
-  const requested = context.protocolVersion ?? stringValue3(meta3?.["io.modelcontextprotocol/protocolVersion"]) ?? initializeVersion ?? MODERN_PROTOCOL_VERSION;
-  if (!isSupportedProtocolVersion(requested)) {
-    throw new UnsupportedProtocolVersionError(requested);
+  const site = new URL(client.baseUrl);
+  const sitePath = site.pathname.replace(/\/$/u, "");
+  if (url2.origin !== site.origin) throw invalidFileSource();
+  if (url2.pathname === `${sitePath}/mod/resource/view.php`) {
+    const activityId = Number(url2.searchParams.get("id"));
+    if (!Number.isSafeInteger(activityId) || activityId < 1) throw invalidFileSource();
+    return validateFileTarget(client, await fileFromActivity(client, activityId));
   }
-  return requested;
+  if (!url2.pathname.startsWith(`${sitePath}/pluginfile.php/`)) throw invalidFileSource();
+  return { url: url2.toString(), name: urlFilename(url2.toString()) };
 }
-function assertRequestMetadata(request, protocolVersion, context = {}) {
-  const meta3 = isRecord5(request.params?._meta) ? request.params._meta : void 0;
-  const metaVersion = stringValue3(meta3?.["io.modelcontextprotocol/protocolVersion"]);
-  if (protocolVersion === MODERN_PROTOCOL_VERSION) {
-    const parsed = ModernClientMetadataSchema.safeParse(meta3);
-    if (!parsed.success) {
-      throw new RequestMetadataMismatchError("_meta", "valid modern client metadata");
-    }
-  }
-  if (context.protocolVersion && metaVersion && context.protocolVersion !== metaVersion) {
-    throw new RequestMetadataMismatchError("protocolVersion", context.protocolVersion, metaVersion);
-  }
-  if (context.method && context.method !== request.method) {
-    throw new RequestMetadataMismatchError("method", context.method, request.method);
+function validateFileTarget(client, target) {
+  let url2;
+  try {
+    url2 = new URL(target.url);
+  } catch {
+    throw invalidFileSource();
+  }
+  const site = new URL(client.baseUrl);
+  const sitePath = site.pathname.replace(/\/$/u, "");
+  const supportedPath = url2.pathname === `${sitePath}/mod/resource/view.php` || url2.pathname.startsWith(`${sitePath}/pluginfile.php/`);
+  if (url2.origin !== site.origin || !supportedPath) throw invalidFileSource();
+  return target;
+}
+async function fileFromActivity(client, activityId) {
+  const activity = await client.getActivity(activityId);
+  if (activity.type !== "resource" || !("file_entries" in activity) || !Array.isArray(activity.file_entries)) {
+    throw new MoodleGatewayError(
+      "MOODLE_FILE_SOURCE_INVALID",
+      `Activity ${activityId} is not a downloadable resource.`
+    );
   }
-  const toolName = typeof request.params?.name === "string" ? request.params.name : void 0;
-  if (context.toolName && context.toolName !== toolName) {
-    throw new RequestMetadataMismatchError("name", context.toolName, toolName);
+  if (activity.file_entries.length !== 1) {
+    if (activity.file_entries.length === 0) {
+      const resource = activity;
+      const url2 = resource.target_url || resource.url;
+      if (url2) return { url: url2, name: resource.target_name || void 0 };
+    }
+    throw new MoodleGatewayError(
+      "MOODLE_FILE_SOURCE_AMBIGUOUS",
+      `Activity ${activityId} did not resolve to exactly one file. Inspect file_entries and request one URL.`
+    );
   }
+  const [entry] = activity.file_entries;
+  return { url: entry.url, name: entry.name };
+}
+function resourceLinks(html, baseUrl) {
+  const root = (0, import_node_html_parser3.parse)(html);
+  const entries = root.querySelectorAll(".resourceworkaround a[href], .resourcecontent a[href], a.resourceworkaround[href]").map((link) => ({
+    name: link.textContent.trim(),
+    url: new URL(link.getAttribute("href") ?? "", baseUrl).toString()
+  })).filter((entry) => entry.url !== baseUrl);
+  return entries.filter((entry, index) => entries.findIndex((candidate) => candidate.url === entry.url) === index);
+}
+async function readBoundedBody(response, maxBytes) {
+  if (!response.body) return new Uint8Array();
+  const reader = response.body.getReader();
+  const chunks2 = [];
+  let bytes = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    bytes += value.byteLength;
+    if (bytes > maxBytes) {
+      await reader.cancel().catch(() => void 0);
+      throw fileTooLarge();
+    }
+    chunks2.push(value);
+  }
+  const content = new Uint8Array(bytes);
+  let offset = 0;
+  for (const chunk of chunks2) {
+    content.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return content;
+}
+function invalidFileSource() {
+  return new MoodleGatewayError(
+    "MOODLE_FILE_SOURCE_INVALID",
+    "Use a positive resource activity ID, a same-site resource URL, or a same-site pluginfile URL."
+  );
 }
-function isSupportedProtocolVersion(value) {
-  return SUPPORTED_PROTOCOL_VERSIONS.some((version2) => version2 === value);
+function fileTooLarge() {
+  return new MoodleGatewayError(
+    "MOODLE_FILE_TOO_LARGE",
+    `Moodle files returned through MCP cannot exceed ${MAX_MCP_FILE_BYTES / 1024 / 1024} MiB.`
+  );
 }
-function jsonRpcSuccess(id, result) {
-  return { jsonrpc: "2.0", id, result };
+function fileAuthenticationRequired() {
+  return new MoodleGatewayError(
+    "MOODLE_AUTH_REQUIRED",
+    "Moodle returned a login page instead of the requested file."
+  );
 }
-function jsonRpcFailure(id, error51) {
-  return { jsonrpc: "2.0", id, error: error51 };
+function isHtml(response) {
+  if (/\battachment\b/iu.test(response.headers.get("content-disposition") ?? "")) return false;
+  const type = response.headers.get("content-type")?.toLowerCase() ?? "";
+  return type.includes("text/html") || type.includes("application/xhtml+xml");
 }
-function isRecord5(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+function looksLikeLoginPage(html) {
+  const root = (0, import_node_html_parser3.parse)(html);
+  return root.querySelector('form[action*="/login/"], input[name="password"], #page-login-index') !== null || /<title>\s*(?:log in|login)/iu.test(html);
 }
-function stringValue3(value) {
-  return typeof value === "string" ? value : void 0;
+function contentType(response) {
+  return response.headers.get("content-type")?.split(";", 1)[0]?.trim() || "application/octet-stream";
+}
+function contentDispositionFilename(value) {
+  if (!value) return void 0;
+  const extended = value.match(/filename\*\s*=\s*([^;]+)/iu)?.[1]?.trim().replace(/^"|"$/gu, "");
+  if (extended) {
+    const encoded = extended.replace(/^[^']*'[^']*'/u, "");
+    try {
+      return decodeURIComponent(encoded);
+    } catch {
+      return encoded;
+    }
+  }
+  const quoted = value.match(/filename\s*=\s*"((?:\\.|[^"])*)"/iu)?.[1];
+  if (quoted !== void 0) return quoted.replace(/\\([\\"])/gu, "$1");
+  return value.match(/filename\s*=\s*([^;]+)/iu)?.[1]?.trim();
+}
+function urlFilename(value) {
+  try {
+    const encoded = new URL(value).pathname.split("/").at(-1) ?? "";
+    try {
+      return decodeURIComponent(encoded);
+    } catch {
+      return encoded;
+    }
+  } catch {
+    return void 0;
+  }
+}
+function safeFilename(value) {
+  const name = value?.split(/[\\/]/u).at(-1)?.replace(/[\u0000-\u001f\u007f]/gu, "").trim();
+  return name && name !== "." && name !== ".." ? name : void 0;
+}
+function publicFileUrl(value) {
+  const url2 = new URL(value);
+  url2.username = "";
+  url2.password = "";
+  for (const key of [...url2.searchParams.keys()]) {
+    if (key !== "forcedownload" && key !== "download") url2.searchParams.delete(key);
+  }
+  return url2.toString();
+}
+function encodeBase64(content) {
+  let binary = "";
+  for (let offset = 0; offset < content.byteLength; offset += 32768) {
+    binary += String.fromCharCode(...content.subarray(offset, offset + 32768));
+  }
+  return btoa(binary);
 }
 
 // src/mcp/server.ts
@@ -22850,14 +23140,122 @@ var READ_ONLY_ANNOTATIONS = {
 };
 var emptyInput = external_exports.object({}).strict();
 var positiveId = external_exports.number().int().positive();
-var objectOutput = external_exports.looseObject({});
-var listOutput = external_exports.array(objectOutput);
+var integer2 = external_exports.number().int();
+var userValue = external_exports.looseObject({
+  userid: integer2,
+  username: external_exports.string(),
+  fullname: external_exports.string(),
+  sitename: external_exports.string(),
+  siteurl: external_exports.string(),
+  lang: external_exports.string().optional()
+});
+var courseValue = external_exports.looseObject({
+  id: integer2,
+  shortname: external_exports.string(),
+  fullname: external_exports.string(),
+  category: external_exports.number().int(),
+  visible: external_exports.boolean(),
+  startdate: external_exports.number(),
+  enddate: external_exports.number().optional()
+});
+var activityValue = external_exports.looseObject({
+  id: integer2,
+  name: external_exports.string(),
+  modname: external_exports.string(),
+  url: external_exports.string(),
+  visible: external_exports.boolean(),
+  description: external_exports.string()
+});
+var fileEntryValue = external_exports.looseObject({
+  name: external_exports.string(),
+  url: external_exports.string(),
+  requires_authentication: external_exports.boolean()
+});
+var activityDetailValue = external_exports.looseObject({
+  id: positiveId,
+  name: external_exports.string(),
+  type: external_exports.string(),
+  url: external_exports.string().optional(),
+  target_name: external_exports.string().optional(),
+  target_url: external_exports.string().optional(),
+  file_entries: external_exports.array(fileEntryValue).optional()
+});
+var sectionValue = external_exports.looseObject({
+  id: external_exports.number().int(),
+  name: external_exports.string(),
+  section: external_exports.number().int(),
+  visible: external_exports.boolean(),
+  summary: external_exports.string(),
+  activities: external_exports.array(activityValue)
+});
+var todoValue = external_exports.looseObject({
+  id: external_exports.number().int(),
+  name: external_exports.string(),
+  course_id: external_exports.number().int(),
+  course_name: external_exports.string(),
+  due_at: external_exports.number(),
+  url: external_exports.string()
+});
+var gradeItemValue = external_exports.looseObject({
+  name: external_exports.string(),
+  item_type: external_exports.string(),
+  grade: external_exports.string(),
+  range: external_exports.string(),
+  percentage: external_exports.string(),
+  feedback: external_exports.string(),
+  url: external_exports.string()
+});
+var gradesValue = external_exports.looseObject({
+  course_id: integer2,
+  course_name: external_exports.string(),
+  learner_name: external_exports.string(),
+  total_grade: external_exports.string(),
+  total_range: external_exports.string(),
+  total_percentage: external_exports.string(),
+  items: external_exports.array(gradeItemValue)
+});
+var forumValue = external_exports.looseObject({
+  id: integer2,
+  name: external_exports.string(),
+  course_id: integer2,
+  course_name: external_exports.string(),
+  url: external_exports.string()
+});
+var forumSearchValue = external_exports.looseObject({
+  course_id: integer2,
+  course_name: external_exports.string(),
+  forum_id: integer2,
+  forum_name: external_exports.string(),
+  discussion_id: integer2,
+  discussion_subject: external_exports.string(),
+  post_id: integer2,
+  snippet: external_exports.string(),
+  url: external_exports.string()
+});
+var forumPostValue = external_exports.looseObject({
+  id: integer2,
+  discussion_id: integer2,
+  subject: external_exports.string(),
+  message_text: external_exports.string(),
+  author: external_exports.looseObject({ id: integer2, fullname: external_exports.string() }),
+  url: external_exports.string()
+});
+var threadValue = external_exports.looseObject({
+  id: integer2,
+  subject: external_exports.string(),
+  course_id: integer2,
+  forum_id: integer2,
+  group_id: external_exports.number().int(),
+  group_name: external_exports.string(),
+  url: external_exports.string(),
+  posts: external_exports.array(forumPostValue)
+});
 var TOOL_REGISTRATIONS = [
   {
     name: "get_user",
     description: "Get the authenticated Moodle user and site.",
     input: emptyInput,
-    output: external_exports.object({ user: objectOutput })
+    output: external_exports.object({ user: userValue })
   },
   {
     name: "get_overview",
@@ -22867,19 +23265,31 @@ var TOOL_REGISTRATIONS = [
       todoDays: external_exports.number().int().min(1).max(365).optional(),
       alertsLimit: external_exports.number().int().min(1).max(100).optional().default(5)
     }).strict(),
-    output: external_exports.object({ overview: objectOutput })
+    output: external_exports.object({
+      overview: external_exports.looseObject({
+        user: userValue,
+        courses: external_exports.array(courseValue),
+        todo: external_exports.array(todoValue),
+        errors: external_exports.array(external_exports.string())
+      })
+    })
   },
   {
     name: "list_courses",
     description: "List the authenticated user's Moodle courses.",
     input: external_exports.object({ limit: external_exports.number().int().min(1).max(200).optional().default(100) }).strict(),
-    output: external_exports.object({ courses: listOutput })
+    output: external_exports.object({ courses: external_exports.array(courseValue) })
   },
   {
     name: "get_course",
     description: "Get one Moodle course and its sections.",
     input: external_exports.object({ courseId: positiveId }).strict(),
-    output: external_exports.object({ course: objectOutput })
+    output: external_exports.object({
+      course: external_exports.looseObject({
+        course: courseValue,
+        sections: external_exports.array(sectionValue)
+      })
+    })
   },
   {
     name: "list_activities",
@@ -22888,19 +23298,19 @@ var TOOL_REGISTRATIONS = [
       courseId: positiveId,
       limit: external_exports.number().int().min(1).max(200).optional().default(100)
     }).strict(),
-    output: external_exports.object({ activities: listOutput })
+    output: external_exports.object({ activities: external_exports.array(activityValue) })
   },
   {
     name: "get_activity",
     description: "Get the supported details for one Moodle activity.",
     input: external_exports.object({ activityId: positiveId }).strict(),
-    output: external_exports.object({ activity: objectOutput })
+    output: external_exports.object({ activity: activityDetailValue })
   },
   {
     name: "get_grades",
     description: "Get the authenticated user's grades for one Moodle course.",
     input: external_exports.object({ courseId: positiveId }).strict(),
-    output: external_exports.object({ grades: objectOutput })
+    output: external_exports.object({ grades: gradesValue })
   },
   {
     name: "list_forums",
@@ -22909,7 +23319,7 @@ var TOOL_REGISTRATIONS = [
       courseId: positiveId.optional(),
       limit: external_exports.number().int().min(1).max(100).optional().default(50)
     }).strict(),
-    output: external_exports.object({ forums: listOutput })
+    output: external_exports.object({ forums: external_exports.array(forumValue) })
   },
   {
     name: "search_forums",
@@ -22925,13 +23335,28 @@ var TOOL_REGISTRATIONS = [
       maxForums: external_exports.number().int().min(1).max(50).optional(),
       maxDiscussionsPerForum: external_exports.number().int().min(1).max(100).optional()
     }).strict(),
-    output: external_exports.object({ results: listOutput })
+    output: external_exports.object({ results: external_exports.array(forumSearchValue) })
   },
   {
     name: "get_thread",
     description: "Get one Moodle forum discussion and its posts.",
     input: external_exports.object({ discussionId: positiveId }).strict(),
-    output: external_exports.object({ thread: objectOutput })
+    output: external_exports.object({ thread: threadValue })
+  },
+  {
+    name: "get_file",
+    description: "Fetch one authenticated Moodle file and return its content directly (maximum 16 MiB).",
+    input: external_exports.object({
+      source: external_exports.union([positiveId, external_exports.string().trim().min(1).max(2048)])
+    }).strict(),
+    output: external_exports.object({
+      file: external_exports.object({
+        name: external_exports.string(),
+        mime_type: external_exports.string(),
+        bytes: external_exports.number().int().nonnegative(),
+        uri: external_exports.string()
+      })
+    })
   }
 ];
 var TOOL_CATALOG = TOOL_REGISTRATIONS.map(({ name, description, input, output }) => ({
@@ -22999,12 +23424,11 @@ function createMoodleMcpServer(gateway, options = {}) {
         }
         if (error51 instanceof UnsupportedProtocolVersionError) {
           return jsonRpcFailure(id, {
-            code: -32602,
-            message: error51.message,
+            code: -32022,
+            message: "Unsupported protocol version",
             data: {
-              type: "UNSUPPORTED_PROTOCOL_VERSION",
-              protocolVersion: error51.protocolVersion,
-              supportedVersions: [...error51.supportedVersions]
+              supported: [...error51.supportedVersions],
+              requested: error51.protocolVersion
             }
           });
         }
@@ -23052,7 +23476,7 @@ async function callTool(gateway, params) {
     const payload = await runGatewayTool(gateway, name, input);
     const structuredContent = registration.output.parse(wrapToolOutput(name, payload));
     return {
-      content: [{ type: "text", text: summarizeToolOutput(name, payload) }],
+      content: toolContent(name, payload),
       structuredContent,
       resultType: "complete",
       _meta: RESULT_META
@@ -23113,6 +23537,8 @@ async function runGatewayTool(gateway, name, input) {
       });
     case "get_thread":
       return gateway.getThread({ discussionId: numberValue3(input.discussionId) });
+    case "get_file":
+      return gateway.getFile({ source: fileSource(input.source) });
     default:
       throw new McpCallError("TOOL_NOT_FOUND", `Unknown Moodle tool: ${name}`);
   }
@@ -23130,8 +23556,33 @@ function wrapToolOutput(name, payload) {
     search_forums: "results",
     get_thread: "thread"
   };
+  if (name === "get_file" && isMoodleFile(payload)) {
+    return {
+      file: {
+        name: payload.name,
+        mime_type: payload.mimeType,
+        bytes: payload.bytes,
+        uri: payload.uri
+      }
+    };
+  }
   return { [keys[name] ?? "result"]: payload };
 }
+function toolContent(name, payload) {
+  const text = { type: "text", text: summarizeToolOutput(name, payload) };
+  if (name !== "get_file" || !isMoodleFile(payload)) return [text];
+  return [
+    text,
+    {
+      type: "resource",
+      resource: {
+        uri: payload.uri,
+        mimeType: payload.mimeType,
+        blob: payload.blob
+      }
+    }
+  ];
+}
 function summarizeToolOutput(name, payload) {
   if (Array.isArray(payload)) {
     const labels = {
@@ -23163,6 +23614,9 @@ function summarizeToolOutput(name, payload) {
   if (name === "get_thread" && isRecord6(payload)) {
     return `Loaded forum thread ${stringValue4(payload.subject) || numberValue3(payload.id)}.`;
   }
+  if (name === "get_file" && isMoodleFile(payload)) {
+    return `Loaded Moodle file ${payload.name} (${payload.bytes} bytes).`;
+  }
   return "Moodle request completed.";
 }
 function mapMoodleError(error51) {
@@ -23198,6 +23652,9 @@ function optionalNumber(value) {
 function stringValue4(value) {
   return typeof value === "string" ? value : "";
 }
+function fileSource(value) {
+  return typeof value === "number" || typeof value === "string" ? value : "";
+}
 function booleanValue2(value) {
   return value === true;
 }
@@ -23207,6 +23664,9 @@ function enumValue(value, values) {
 function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isMoodleFile(value) {
+  return isRecord6(value) && typeof value.name === "string" && typeof value.mimeType === "string" && typeof value.bytes === "number" && typeof value.uri === "string" && typeof value.blob === "string";
+}
 
 // src/worker/moodle-upstream.ts
 var DASHBOARD_PATH2 = "/my/";