ofw-mcp 2.19.4 → 2.20.0

package/dist/bundle.js

@@ -23487,7 +23487,7 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// node_modules/@modelcontextprotocol/core/dist/auth-CUe6YdwF.mjs
+// node_modules/@modelcontextprotocol/core/dist/auth-CGP0BDVq.mjs
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
@@ -24324,7 +24324,8 @@ var OAuthMetadataSchema = looseObject({
   introspection_endpoint_auth_signing_alg_values_supported: array(string2()).optional(),
   code_challenge_methods_supported: array(string2()).optional(),
   client_id_metadata_document_supported: boolean2().optional(),
-  authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0)
+  authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0),
+  dpop_signing_alg_values_supported: array(string2()).optional()
 });
 var OpenIdProviderMetadataSchema = looseObject({
   issuer: string2(),
@@ -24425,7 +24426,7 @@ var OAuthTokenRevocationRequestSchema = object({
   token_type_hint: string2().optional()
 }).strip();
 
-// node_modules/@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs
+// node_modules/@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs
 var BRANDS = /* @__PURE__ */ Symbol.for("mcp.sdk.errorBrands");
 function stampErrorBrands(instance, ctor) {
   const brands = /* @__PURE__ */ new Set();
@@ -24539,8 +24540,18 @@ var SdkError = class extends Error {
     if (typeof this !== "function") throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");
     return brandedHasInstance(this, value);
   }
-  constructor(code, message, data) {
-    super(message);
+  /**
+  * @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+  * @param message - Human-readable description.
+  * @param data - Optional structured payload (for example the HTTP status carried by
+  * {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+  * promoted to `Error.cause`.
+  * @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+  * failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+  * loggers and error trackers walk.
+  */
+  constructor(code, message, data, options) {
+    super(message, options);
     this.code = code;
     this.data = data;
     this.name = "SdkError";
@@ -24551,8 +24562,11 @@ var SdkHttpError = class extends SdkError {
   static {
     Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
   }
-  constructor(code, message, data) {
-    super(code, message, data);
+  /**
+  * @param options - Standard `ErrorOptions`, forwarded to `Error` (see {@linkcode SdkError}).
+  */
+  constructor(code, message, data, options) {
+    super(code, message, data, options);
     this.name = "SdkHttpError";
   }
   get status() {
@@ -25773,11 +25787,11 @@ var rev2025Codec = {
   },
   encodeResult(method, result) {
     if (method !== "tools/list") return result;
-    const tools = result.tools;
-    if (!Array.isArray(tools) || !tools.some((t) => toolNeedsLegacyWrap(t))) return result;
+    const tools2 = result.tools;
+    if (!Array.isArray(tools2) || !tools2.some((t) => toolNeedsLegacyWrap(t))) return result;
     return {
       ...result,
-      tools: tools.map((t) => toolNeedsLegacyWrap(t) ? {
+      tools: tools2.map((t) => toolNeedsLegacyWrap(t) ? {
         ...t,
         outputSchema: wrapOutputSchemaForLegacy(t.outputSchema)
       } : t)
@@ -27005,8 +27019,8 @@ function enforceDeletedFields(method, result) {
     }
     return next;
   };
-  const tools = result.tools;
-  if (method === "tools/list" && Array.isArray(tools) && tools.some((tool) => isPlainObject$4(tool) && "execution" in tool)) copy().tools = tools.map((tool) => {
+  const tools2 = result.tools;
+  if (method === "tools/list" && Array.isArray(tools2) && tools2.some((tool) => isPlainObject$4(tool) && "execution" in tool)) copy().tools = tools2.map((tool) => {
     if (!isPlainObject$4(tool) || !("execution" in tool)) return tool;
     const rest = { ...tool };
     delete rest["execution"];
@@ -27503,7 +27517,7 @@ var INBOUND_VALIDATION_LADDER = [
     evaluatedAt: "pre-dispatch",
     codes: [HEADER_MISMATCH_ERROR_CODE],
     conformance: ["http-header-validation"],
-    rationale: "SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
+    rationale: "SEP-2243 standard `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The spec requires `MCP-Protocol-Version` and `Mcp-Method` on every modern *request* POST (`Mcp-Name` only for the methods that mirror `params.name` / `params.uri` / `params.taskId`, see `MCP_NAME_HEADER_SOURCE`) and names them in that order, so a request missing several is answered by the earliest. Notification POSTs are exempt: the presence half runs on requests only, so a modern-enveloped notification is dispatched even with no standard headers at all. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half \u2014 including the missing `MCP-Protocol-Version` cell, which cannot live on the edge rung without breaking body-primary classification. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
   },
   {
     rung: "client-capabilities",
@@ -28304,7 +28318,7 @@ var Protocol = class {
     return this._requestHandlers.get(method);
   }
   async _oncancel(notification) {
-    if (!notification.params.requestId) return;
+    if (notification.params.requestId === void 0) return;
     this._requestHandlerAbortControllers.get(notification.params.requestId)?.abort(notification.params.reason);
   }
   _setupTimeout(messageId, timeout, maxTotalTimeout, onTimeout, resetTimeoutOnProgress = false) {
@@ -28703,19 +28717,20 @@ var Protocol = class {
       const cancel = (reason) => {
         if (responseReceived) return;
         this._progressHandlers.delete(messageId);
-        if (requestAbort === void 0) this._transport?.send(this._envelopeOutbound({
-          jsonrpc: "2.0",
-          method: "notifications/cancelled",
-          params: {
-            requestId: messageId,
-            reason: String(reason)
-          }
-        }), {
-          relatedRequestId,
-          resumptionToken,
-          onresumptiontoken
-        }).catch((error62) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error62}`)));
-        else requestAbort.abort();
+        if (requestAbort === void 0) {
+          if (request.method !== "initialize") this._transport?.send(this._envelopeOutbound({
+            jsonrpc: "2.0",
+            method: "notifications/cancelled",
+            params: {
+              requestId: messageId,
+              reason: String(reason)
+            }
+          }), {
+            relatedRequestId,
+            resumptionToken,
+            onresumptiontoken
+          }).catch((error62) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error62}`)));
+        } else requestAbort.abort();
         reject(reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason)));
       };
       this._responseHandlers.set(messageId, (response) => {
@@ -28795,7 +28810,7 @@ var Protocol = class {
       jsonrpc: "2.0",
       ...notification
     });
-    if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && !options?.relatedRequestId) {
+    if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && options?.relatedRequestId === void 0) {
       if (this._pendingDebouncedNotifications.has(notification.method)) return;
       this._pendingDebouncedNotifications.add(notification.method);
       Promise.resolve().then(() => {
@@ -36098,7 +36113,7 @@ var Ajv = import_ajv.Ajv;
 // node_modules/@modelcontextprotocol/server/dist/shimsNode.mjs
 import process2 from "node:process";
 
-// node_modules/@modelcontextprotocol/server/dist/mcp-DXXb3Vv3.mjs
+// node_modules/@modelcontextprotocol/server/dist/mcp-Dw2OlZ1f.mjs
 var COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -36291,6 +36306,9 @@ function notificationToServerEvent(method, uri) {
       };
   }
 }
+function supportsScopeChallengeResolver(transport) {
+  return typeof transport === "object" && transport !== null && "setScopeChallengeResolver" in transport && typeof transport.setScopeChallengeResolver === "function";
+}
 var DEFAULT_LEGACY_SHIM_MAX_ROUNDS = 8;
 var DEFAULT_LEGACY_SHIM_ROUND_TIMEOUT_MS = 6e5;
 function resolveLegacyShimOptions(options) {
@@ -37101,6 +37119,7 @@ var McpServer = class {
   * ```
   */
   async connect(transport) {
+    if (supportsScopeChallengeResolver(transport)) transport.setScopeChallengeResolver((context) => this.resolveScopeChallenge(context));
     return await this.server.connect(transport);
   }
   /**
@@ -37109,6 +37128,41 @@ var McpServer = class {
   async close() {
     await this.server.close();
   }
+  /** @internal */
+  resolveScopeChallenge = (context) => {
+    switch (context.request.method) {
+      case "tools/call": {
+        const toolName = context.request.params?.name;
+        if (typeof toolName !== "string") return;
+        const tool = this._registeredTools[toolName];
+        if (tool === void 0 || !tool.enabled) return;
+        return tool.scopeChallenge?.(context);
+      }
+      case "resources/read": {
+        const resourceUri = context.request.params?.uri;
+        if (typeof resourceUri !== "string") return;
+        let uri;
+        try {
+          uri = new URL(resourceUri);
+        } catch {
+          return;
+        }
+        const resource = this._registeredResources[uri.toString()];
+        if (resource !== void 0) return resource.enabled ? resource.scopeChallenge?.(context) : void 0;
+        for (const template of Object.values(this._registeredResourceTemplates)) if (template.resourceTemplate.uriTemplate.match(uri.toString())) return template.enabled ? template.scopeChallenge?.(context) : void 0;
+        return;
+      }
+      case "prompts/get": {
+        const promptName = context.request.params?.name;
+        if (typeof promptName !== "string") return;
+        const prompt = this._registeredPrompts[promptName];
+        if (prompt === void 0 || !prompt.enabled) return;
+        return prompt.scopeChallenge?.(context);
+      }
+      default:
+        return;
+    }
+  };
   _toolHandlersInitialized = false;
   setToolRequestHandlers() {
     if (this._toolHandlersInitialized) return;
@@ -37275,7 +37329,10 @@ var McpServer = class {
       }
       for (const template of Object.values(this._registeredResourceTemplates)) {
         const variables = template.resourceTemplate.uriTemplate.match(uri.toString());
-        if (variables) return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+        if (variables) {
+          if (!template.enabled) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Resource template ${template.resourceTemplate.uriTemplate} disabled`);
+          return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+        }
       }
       throw new ResourceNotFoundError(request.params.uri);
     });
@@ -37306,36 +37363,32 @@ var McpServer = class {
     this._promptHandlersInitialized = true;
   }
   registerResource(name, uriOrTemplate, config2, readCallback) {
-    const cacheHint = config2.cacheHint;
-    let metadata = config2;
-    if (cacheHint !== void 0) {
-      assertValidCacheHint(cacheHint, `resource ${name}`);
-      const rest = { ...config2 };
-      delete rest.cacheHint;
-      metadata = rest;
-    }
+    const { cacheHint, scopeChallenge, ...resourceMetadata } = config2;
+    const metadata = resourceMetadata;
+    if (cacheHint !== void 0) assertValidCacheHint(cacheHint, `resource ${name}`);
     if (typeof uriOrTemplate === "string") {
       if (this._registeredResources[uriOrTemplate]) throw new Error(`Resource ${uriOrTemplate} is already registered`);
-      const registeredResource = this._createRegisteredResource(name, config2.title, uriOrTemplate, metadata, readCallback);
+      const registeredResource = this._createRegisteredResource(name, config2.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
       if (cacheHint !== void 0) registeredResource.cacheHint = cacheHint;
       this.setResourceRequestHandlers();
       this.sendResourceListChanged();
       return registeredResource;
     } else {
       if (this._registeredResourceTemplates[name]) throw new Error(`Resource template ${name} is already registered`);
-      const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config2.title, uriOrTemplate, metadata, readCallback);
+      const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config2.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
       if (cacheHint !== void 0) registeredResourceTemplate.cacheHint = cacheHint;
       this.setResourceRequestHandlers();
       this.sendResourceListChanged();
       return registeredResourceTemplate;
     }
   }
-  _createRegisteredResource(name, title, uri, metadata, readCallback) {
+  _createRegisteredResource(name, title, uri, metadata, scopeChallenge, readCallback) {
     const registeredResource = {
       name,
       title,
       metadata,
       readCallback,
+      scopeChallenge,
       enabled: true,
       disable: () => registeredResource.update({ enabled: false }),
       enable: () => registeredResource.update({ enabled: true }),
@@ -37349,6 +37402,7 @@ var McpServer = class {
         if (updates.title !== void 0) registeredResource.title = updates.title;
         if (updates.metadata !== void 0) registeredResource.metadata = updates.metadata;
         if (updates.callback !== void 0) registeredResource.readCallback = updates.callback;
+        if (updates.scopeChallenge !== void 0) registeredResource.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates.enabled !== void 0) registeredResource.enabled = updates.enabled;
         this.sendResourceListChanged();
       }
@@ -37356,12 +37410,13 @@ var McpServer = class {
     this._registeredResources[uri] = registeredResource;
     return registeredResource;
   }
-  _createRegisteredResourceTemplate(name, title, template, metadata, readCallback) {
+  _createRegisteredResourceTemplate(name, title, template, metadata, scopeChallenge, readCallback) {
     const registeredResourceTemplate = {
       resourceTemplate: template,
       title,
       metadata,
       readCallback,
+      scopeChallenge,
       enabled: true,
       disable: () => registeredResourceTemplate.update({ enabled: false }),
       enable: () => registeredResourceTemplate.update({ enabled: true }),
@@ -37375,6 +37430,7 @@ var McpServer = class {
         if (updates.template !== void 0) registeredResourceTemplate.resourceTemplate = updates.template;
         if (updates.metadata !== void 0) registeredResourceTemplate.metadata = updates.metadata;
         if (updates.callback !== void 0) registeredResourceTemplate.readCallback = updates.callback;
+        if (updates.scopeChallenge !== void 0) registeredResourceTemplate.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates.enabled !== void 0) registeredResourceTemplate.enabled = updates.enabled;
         this.sendResourceListChanged();
       }
@@ -37384,7 +37440,7 @@ var McpServer = class {
     if (Array.isArray(variableNames) && variableNames.some((v) => !!template.completeCallback(v))) this.setCompletionRequestHandler();
     return registeredResourceTemplate;
   }
-  _createRegisteredPrompt(name, title, description, argsSchema, callback, icons, _meta) {
+  _createRegisteredPrompt(name, title, description, argsSchema, callback, icons, scopeChallenge, _meta) {
     let currentArgsSchema = argsSchema;
     let currentCallback = callback;
     const registeredPrompt = {
@@ -37392,6 +37448,7 @@ var McpServer = class {
       description,
       argsSchema,
       icons,
+      scopeChallenge,
       _meta,
       handler: createPromptHandler(name, argsSchema, callback),
       enabled: true,
@@ -37406,6 +37463,7 @@ var McpServer = class {
         if (updates.title !== void 0) registeredPrompt.title = updates.title;
         if (updates.description !== void 0) registeredPrompt.description = updates.description;
         if (updates.icons !== void 0) registeredPrompt.icons = updates.icons;
+        if (updates.scopeChallenge !== void 0) registeredPrompt.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates._meta !== void 0) registeredPrompt._meta = updates._meta;
         let needsHandlerRegen = false;
         if (updates.argsSchema !== void 0) {
@@ -37433,7 +37491,7 @@ var McpServer = class {
     }
     return registeredPrompt;
   }
-  _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, _meta, handler) {
+  _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
     validateAndWarnToolName(name);
     if (inputSchema !== void 0) try {
       const json2 = standardSchemaToJsonSchema(inputSchema, "input");
@@ -37452,6 +37510,7 @@ var McpServer = class {
       annotations,
       icons,
       execution,
+      scopeChallenge,
       _meta,
       handler,
       executor: createToolExecutor(inputSchema, handler),
@@ -37490,6 +37549,7 @@ var McpServer = class {
         }
         if (updates.annotations !== void 0) registeredTool.annotations = updates.annotations;
         if (updates.icons !== void 0) registeredTool.icons = updates.icons;
+        if (updates.scopeChallenge !== void 0) registeredTool.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates._meta !== void 0) registeredTool._meta = updates._meta;
         if (updates.enabled !== void 0) registeredTool.enabled = updates.enabled;
         this.sendToolListChanged();
@@ -37502,13 +37562,13 @@ var McpServer = class {
   }
   registerTool(name, config2, cb) {
     if (this._registeredTools[name]) throw new Error(`Tool ${name} is already registered`);
-    const { title, description, inputSchema, outputSchema, annotations, icons, _meta } = config2;
-    return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, _meta, cb);
+    const { title, description, inputSchema, outputSchema, annotations, icons, scopeChallenge, _meta } = config2;
+    return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, scopeChallenge, _meta, cb);
   }
   registerPrompt(name, config2, cb) {
     if (this._registeredPrompts[name]) throw new Error(`Prompt ${name} is already registered`);
-    const { title, description, argsSchema, icons, _meta } = config2;
-    const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, _meta);
+    const { title, description, argsSchema, icons, scopeChallenge, _meta } = config2;
+    const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, scopeChallenge, _meta);
     this.setPromptRequestHandlers();
     this.sendPromptListChanged();
     return registeredPrompt;
@@ -37620,6 +37680,7 @@ function unwrapOptionalSchema(schema) {
 }
 
 // node_modules/@modelcontextprotocol/server/dist/stdio.mjs
+var swallowsErrorsAfterClose = /* @__PURE__ */ Symbol("swallowsErrorsAfterClose");
 var StdioServerTransport = class {
   _readBuffer;
   _started = false;
@@ -37646,18 +37707,27 @@ var StdioServerTransport = class {
     this.onerror?.(error62);
   };
   _onstdouterror = (error62) => {
+    if (this._closed) return;
     this.onerror?.(error62);
     this.close().catch(() => {
     });
   };
+  _onstdinclose = () => {
+    this.close().catch(() => {
+    });
+  };
   /**
   * Starts listening for messages on `stdin`.
   */
   async start() {
     if (this._started) throw new Error("StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.");
     this._started = true;
+    for (const listener of this._stdout.listeners("error")) if (listener[swallowsErrorsAfterClose]) this._stdout.off("error", listener);
+    if (this._stdin.readableEnded || this._stdin.destroyed) setImmediate(this._onstdinclose);
     this._stdin.on("data", this._ondata);
     this._stdin.on("error", this._onerror);
+    this._stdin.on("end", this._onstdinclose);
+    this._stdin.on("close", this._onstdinclose);
     this._stdout.on("error", this._onstdouterror);
   }
   processReadBuffer() {
@@ -37674,7 +37744,9 @@ var StdioServerTransport = class {
     this._closed = true;
     this._stdin.off("data", this._ondata);
     this._stdin.off("error", this._onerror);
-    this._stdout.off("error", this._onstdouterror);
+    this._stdin.off("end", this._onstdinclose);
+    this._stdin.off("close", this._onstdinclose);
+    this._onstdouterror[swallowsErrorsAfterClose] = true;
     if (this._stdin.listenerCount("data") === 0) this._stdin.pause();
     this._readBuffer.clear();
     this.onclose?.();
@@ -37951,6 +38023,7 @@ function serveStdio(factory, options = {}) {
         return;
       }
       if (state.era === "modern" && await tryServeListen(message)) return;
+      if (isTornDown()) return;
       state.instance.channel.deliver(message);
       return;
     }
@@ -38017,6 +38090,7 @@ function serveStdio(factory, options = {}) {
           };
         }
         if (await tryServeListen(message)) return;
+        if (isTornDown()) return;
         state.instance.channel.deliver(message, { classification: opening.classification });
         return;
       case "legacy": {
@@ -38103,6 +38177,9 @@ function toError(value) {
   return value instanceof Error ? value : new Error(String(value));
 }
 
+// node_modules/@modelcontextprotocol/server/dist/index.mjs
+var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
+
 // node_modules/@chrischall/mcp-utils/dist/errors/index.js
 var DEFAULT_ERROR_MESSAGE_MAX = 500;
 var McpToolError = class extends Error {
@@ -38119,11 +38196,12 @@ var McpToolError = class extends Error {
 function createHelpfulError(message, opts) {
   return new McpToolError(message, opts);
 }
+var HEADER_NAME_RUN = "[a-z0-9_-]{0,40}";
 var BEARER_RE = /(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
-var JWT_RE = /\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/g;
+var JWT_RE = /(?<![A-Za-z0-9_-])[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}(?![A-Za-z0-9_-])/g;
 var BASIC_AUTH_RE = /(authorization\s*:\s*basic\s+)[A-Za-z0-9+/=_-]{6,}/gi;
-var SET_COOKIE_RE = /(\bset-cookie\s*:\s*)([^=;,\s]+)=[^;,\s]*/gi;
-var COOKIE_HEADER_RE = /((?<!set-)\bcookie\s*:\s*)((?:[^=;,\s]+=[^;,\s]*)(?:;\s*[^=;,\s]+=[^;,\s]*)*)/gi;
+var SET_COOKIE_RE = /(\bset-cookie\s*:\s*)([^=;,:\s]+)=[^;,\s]*/gi;
+var COOKIE_HEADER_RE = /((?<!set-)\bcookie\s*:\s*)((?:[^=;,:\s]+=[^;,\s]*)(?:;\s*[^=;,:\s]+=[^;,\s]*)*)/gi;
 var API_KEY_RE = new RegExp([
   "sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])",
   // OpenAI / Anthropic (incl. sk-ant-…)
@@ -38138,10 +38216,10 @@ var API_KEY_RE = new RegExp([
   "whsec_[A-Za-z0-9]{16,}\\b"
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
-var QUERY_SECRET_RE = /([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
 var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
 var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
-var HEADER_SECRET_RE = /(\b(?:x[-_][a-z0-9_-]*?(?:api[-_]?key|token|secret|auth)[a-z0-9_-]*|api[-_]?key)\s*:\s*)[^\s,;"'<>`]+/gi;
+var HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
 var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
 var JSON_SECRET_KEYS = [
   "(?:access|refresh|id|auth|session|bearer|csrf|xsrf)[_-]?token",
@@ -38149,7 +38227,8 @@ var JSON_SECRET_KEYS = [
   "api[_-]?secret",
   "(?:x[_-])?api[_-]?key",
   "private[_-]?key",
-  "x[_-][a-z0-9_-]*?(?:api[_-]?key|token|secret|auth)[a-z0-9_-]*",
+  `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
+  // bounded like HEADER_SECRET_RE
   "(?:proxy-)?authorization",
   "password",
   "passwd",
@@ -38158,12 +38237,30 @@ var JSON_SECRET_KEYS = [
 ].join("|");
 var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")(?:[^"\\\\]|\\\\.)*(")`, "gi");
 var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')(?:[^'\\\\]|\\\\.)*(')`, "gi");
+var JSON_SECRET_NUM_RE = new RegExp(`(["'](?:${JSON_SECRET_KEYS})["']\\s*:\\s*)-?\\d+(?:\\.\\d+)?(?![\\d.])`, "gi");
+var JSON_COOKIE_DQ_RE = /("((?:set-)?cookie)"\s*:\s*)("(?:[^"\\]|\\.)*"|\[\s*"(?:[^"\\]|\\.)*"(?:\s*,\s*"(?:[^"\\]|\\.)*")*)/gi;
+var JSON_COOKIE_SQ_RE = /('((?:set-)?cookie)'\s*:\s*)('(?:[^'\\]|\\.)*'|\[\s*'(?:[^'\\]|\\.)*'(?:\s*,\s*'(?:[^'\\]|\\.)*')*)/gi;
+var DQ_STRING_RE = /"((?:[^"\\]|\\.)*)"/g;
+var SQ_STRING_RE = /'((?:[^'\\]|\\.)*)'/g;
+function redactJsonCookie(quote) {
+  const stringRe = quote === '"' ? DQ_STRING_RE : SQ_STRING_RE;
+  return (_m, prefix, key, value) => {
+    const setCookie = key.toLowerCase() === "set-cookie";
+    const redacted = value.replace(stringRe, (_s, body) => {
+      const out = setCookie ? body.replace(/^(\s*[^=;]+)=[^;]*/, "$1=[REDACTED]") : body.replace(/=[^;]*/g, "=[REDACTED]");
+      return `${quote}${out}${quote}`;
+    });
+    return `${prefix}${redacted}`;
+  };
+}
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_COOKIE_DQ_RE, redactJsonCookie('"')).replace(JSON_COOKIE_SQ_RE, redactJsonCookie("'")).replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_NUM_RE, "$1[REDACTED]").replace(JWT_RE, "[REDACTED]");
 }
+var ERROR_REDACTION_INPUT_MAX = 64 * 1024;
 function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   const str = text === null || text === void 0 ? "" : String(text);
-  const redacted = redactSecrets(str);
+  const cap = Math.max(ERROR_REDACTION_INPUT_MAX, max);
+  const redacted = redactSecrets(str.length > cap ? str.slice(0, cap) : str);
   if (redacted.length <= max)
     return redacted;
   return `${redacted.slice(0, max)}\u2026 [truncated]`;
@@ -38516,6 +38613,9 @@ async function tokenConfirmation(action, fb) {
   const subject = await fb.subject();
   if (isToolResult(subject))
     return subject;
+  if (subject.payload === void 0) {
+    throw new TypeError(`confirm token: ${fb.tool}'s subject() returned no payload. Bind what the call will do (the arguments or the request body), or pass \`args\` to confirmationFromEnv.`);
+  }
   const binding = {
     tool: fb.tool,
     ...fb.account === void 0 ? {} : { account: fb.account },
@@ -38633,9 +38733,19 @@ function readConfirmMode(env = process.env) {
   }
   return "refuse";
 }
-function confirmTtlFromEnv(env = process.env) {
+function readConfirmTtl(env) {
   const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
-  return raw && /^[1-9]\d*$/.test(raw) ? Number(raw) : DEFAULT_TTL_SECONDS2;
+  if (!raw)
+    return DEFAULT_TTL_SECONDS2;
+  if (/^[1-9]\d*$/.test(raw))
+    return Number(raw);
+  const key = `ttl:${raw}`;
+  if (!warned.has(key)) {
+    warned.add(key);
+    process.stderr.write(`MCP_CONFIRM_TTL_SECONDS="${raw}" is not a positive whole number of seconds; gated writes will refuse on clients that cannot show a confirmation prompt until it is fixed.
+`);
+  }
+  return void 0;
 }
 var processKey;
 function confirmKeyFromEnv(env = process.env) {
@@ -38647,15 +38757,33 @@ function confirmKeyFromEnv(env = process.env) {
 }
 var CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
 var REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+var BAD_TTL_HINT = "MCP_CONFIRM_TTL_SECONDS on the server is not a positive whole number of seconds; fix it to allow two-step confirmation.";
+function boundArgs(args) {
+  if (args === null || typeof args !== "object" || Array.isArray(args) || !("confirmToken" in args))
+    return args;
+  const { confirmToken, ...rest } = args;
+  void confirmToken;
+  return rest;
+}
 function confirmationFromEnv(options) {
-  const { tool, account, confirmToken, subject, instruction, spent, env = process.env, ...confirmation } = options;
+  const { tool, account, confirmToken, subject, instruction, spent, args, env = process.env, ...rest } = options;
   const mode = readConfirmMode(env);
-  if (mode === "refuse") {
+  const ttlSeconds = readConfirmTtl(env);
+  const bound = args === void 0 ? void 0 : boundArgs(args);
+  const confirmation = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  if (mode === "refuse" || ttlSeconds === void 0) {
+    const hint = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
     return {
       ...confirmation,
-      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${REFUSE_HINT}` : REFUSE_HINT
+      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${hint}` : hint
     };
   }
+  const boundSubject = bound === void 0 ? subject : async () => {
+    const read = await subject();
+    if ("content" in read)
+      return read;
+    return { ...read, payload: { payload: read.payload, args: bound } };
+  };
   return {
     ...confirmation,
     tokenFallback: {
@@ -38663,8 +38791,8 @@ function confirmationFromEnv(options) {
       tool,
       ...account === void 0 ? {} : { account },
       ...confirmToken === void 0 ? {} : { confirmToken },
-      subject,
-      ttlSeconds: confirmTtlFromEnv(env),
+      subject: boundSubject,
+      ttlSeconds,
       instruction: mode === "auto" ? CONFIRM_TOKEN_AUTO_INSTRUCTION : instruction ?? CONFIRM_TOKEN_INSTRUCTION,
       ...spent === void 0 ? {} : { spent }
     }
@@ -38788,6 +38916,8 @@ function withGracefulShutdown(target, opts = {}) {
   };
   const handler = (signal) => {
     if (shuttingDown) {
+      if (signal === "stdin-eof")
+        return;
       if (Date.now() - firstSignalAt < repeatGraceMs)
         return;
       if (shouldExit) {
@@ -38823,6 +38953,10 @@ function withGracefulShutdown(target, opts = {}) {
   };
   process.on("SIGINT", () => handler("SIGINT"));
   process.on("SIGTERM", () => handler("SIGTERM"));
+  if (opts.stdin) {
+    opts.stdin.once("end", () => handler("stdin-eof"));
+    opts.stdin.once("close", () => handler("stdin-eof"));
+  }
 }
 function runMcp(opts) {
   if (opts.banner !== void 0) {
@@ -38841,7 +38975,8 @@ function runMcp(opts) {
   });
   const shutdown = opts.shutdown ?? true;
   if (shutdown !== false) {
-    withGracefulShutdown(handle, shutdown === true ? {} : shutdown);
+    const stdinDefault = spec === "stdio" ? { stdin: process.stdin } : {};
+    withGracefulShutdown(handle, { ...stdinDefault, ...shutdown === true ? {} : shutdown });
   }
   return handle;
 }
@@ -38973,7 +39108,7 @@ async function resolveAuthPattern(pattern) {
     if (resolver)
       return resolver();
   }
-  throw createHelpfulError("No auth configured. Provide a token, OAuth credentials, login credentials, or sign in in your browser (fetchproxy fallback).", { hint: "Set one of the supported credential env vars, or sign in in your browser." });
+  throw createHelpfulError("No auth configured. Provide a token, OAuth credentials, login credentials, or sign in in your browser (read via ContextMint Bridge).", { hint: "Set one of the supported credential env vars, or sign in in your browser." });
 }
 
 // node_modules/@chrischall/mcp-utils/dist/session/index.js
@@ -39353,7 +39488,7 @@ var TokenManager = class {
 };
 
 // src/client.ts
-import { dirname as dirname3, join as join5 } from "path";
+import { dirname as dirname3, join as join6 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/@fetchproxy/protocol/dist/crypto.js
@@ -39559,6 +39694,30 @@ var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "write_cookies"
 ]);
 
+// node_modules/@fetchproxy/protocol/dist/capability-availability.js
+var CAPABILITY_UNAVAILABLE_CODE = "capability_unavailable";
+var MAX_UNAVAILABLE_CAPABILITIES = 32;
+var MAX_CAPABILITY_NAME_LENGTH = 64;
+var UNSUPPORTED_CAPABILITY_REASON_PREFIX = "unsupported-capability:";
+function capabilityUnavailableMessage(capability, platform) {
+  return `capability ${JSON.stringify(capability)} is not available in this browser (${platform})`;
+}
+var UNAVAILABLE_RE = /^capability "([^"]{1,64})" is not available in this browser(?: \(([^)]{1,32})\))?/;
+function parseCapabilityUnavailable(error62) {
+  const m = UNAVAILABLE_RE.exec(error62);
+  if (!m)
+    return null;
+  return { capability: m[1], platform: m[2] ?? null };
+}
+function parseUnsupportedCapabilityReason(reason) {
+  if (!reason.startsWith(UNSUPPORTED_CAPABILITY_REASON_PREFIX))
+    return null;
+  const rest = reason.slice(UNSUPPORTED_CAPABILITY_REASON_PREFIX.length).replace(/\s*\(not available in this browser\)\s*$/, "").trim();
+  if (rest === "")
+    return [];
+  return rest.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+
 // node_modules/@fetchproxy/protocol/dist/mcp-id.js
 var ID_RE = /^([^:]+):([^:]+):([0-9a-f]{16})$/;
 function generateMcpId(serverName, version2) {
@@ -40273,6 +40432,9 @@ function validateHello(raw) {
     assertBase64(raw.sessionNonce, "hello.sessionNonce");
     if (raw.accepts !== void 0)
       assertAcceptsList(raw.accepts);
+    if (raw.unavailableCapabilities !== void 0) {
+      assertUnavailableCapabilities(raw.unavailableCapabilities);
+    }
     return raw;
   }
   throw new ProtocolError3(`hello.role: must be 'server' or 'extension', got ${String(role)}`);
@@ -40338,6 +40500,22 @@ function assertAcceptsList(accepts) {
     }
   }
 }
+function assertUnavailableCapabilities(list) {
+  const label = "hello.unavailableCapabilities";
+  if (!Array.isArray(list))
+    throw new ProtocolError3(`${label}: expected array`);
+  if (list.length > MAX_UNAVAILABLE_CAPABILITIES) {
+    throw new ProtocolError3(`${label}: at most ${MAX_UNAVAILABLE_CAPABILITIES} entries, got ${list.length}`);
+  }
+  for (const c of list) {
+    if (typeof c !== "string") {
+      throw new ProtocolError3(`${label}: entry must be string, got ${typeof c}`);
+    }
+    if (c.length < 1 || c.length > MAX_CAPABILITY_NAME_LENGTH) {
+      throw new ProtocolError3(`${label}: entry must be 1-${MAX_CAPABILITY_NAME_LENGTH} characters, got ${c.length}`);
+    }
+  }
+}
 function validatePeerGone(raw) {
   assertString(raw.mcpId, "peer-gone.mcpId");
   if (!isValidMcpId(raw.mcpId))
@@ -40813,6 +40991,8 @@ function validateInnerResponse(raw) {
   }
   if (raw.ok === false) {
     assertString(raw.error, "inner.error");
+    if (raw.code !== void 0)
+      assertString(raw.code, "inner.code");
     if (raw.op !== void 0) {
       if (typeof raw.op !== "string" || !KNOWN_RESPONSE_OPS.has(raw.op)) {
         throw new ProtocolError3(`inner.op: unknown response op ${JSON.stringify(raw.op)}`);
@@ -40908,6 +41088,38 @@ async function openEncryptedFrameDetailed(sessionKey, frame, direction) {
   }
 }
 
+// node_modules/@fetchproxy/server/dist/session-info.js
+function sessionInfoFromHello(hello) {
+  const raw = hello.unavailableCapabilities;
+  const known = /* @__PURE__ */ new Set();
+  if (Array.isArray(raw)) {
+    for (const c of raw) {
+      if (typeof c === "string" && KNOWN_CAPABILITIES.has(c))
+        known.add(c);
+    }
+  }
+  return { platform: hello.platform, unavailableCapabilities: [...known].sort() };
+}
+function capabilitiesForRequest(inner) {
+  if (inner.type !== "request")
+    return [];
+  if (inner.op === "graphql_query")
+    return ["graphql"];
+  if (inner.op === "fetch") {
+    return inner.init.inPage === true ? ["fetch", "fetch_in_page"] : ["fetch"];
+  }
+  return [inner.op];
+}
+function unavailableCapabilityFor(inner, info) {
+  if (!info || info.unavailableCapabilities.length === 0)
+    return null;
+  for (const c of capabilitiesForRequest(inner)) {
+    if (info.unavailableCapabilities.includes(c))
+      return c;
+  }
+  return null;
+}
+
 // node_modules/@fetchproxy/server/dist/election.js
 import { createServer, Server as HttpServer } from "node:http";
 var DEFAULT_BIND_TIMEOUT_MS = 5e3;
@@ -41153,7 +41365,7 @@ var FetchproxySessionNotReadyError = class extends Error {
   hint;
   constructor(info) {
     const pairing = info.pairCode !== null && info.pairCode !== "";
-    const hint = pairing ? `Open the Transporter extension popup and approve pair code ${info.pairCode} for "${info.mcpId}", then retry.` : `The extension is connected but hasn't confirmed a session for "${info.mcpId}" \u2014 sign in to the target site in that browser (and approve the requested scope if it changed), then retry.`;
+    const hint = pairing ? `Open the ContextMint Bridge extension popup and approve pair code ${info.pairCode} for "${info.mcpId}", then retry.` : `The extension is connected but hasn't confirmed a session for "${info.mcpId}" \u2014 sign in to the target site in that browser (and approve the requested scope if it changed), then retry.`;
     super(`fetchproxy: ${pairing ? "pairing not yet approved" : "no confirmed browser session"} for "${info.mcpId}". ${hint}`);
     this.name = "FetchproxySessionNotReadyError";
     this.reason = pairing ? "pair-required" : "not-ready";
@@ -41166,15 +41378,35 @@ var FetchproxySessionNotReadyError = class extends Error {
 var FetchproxyHelloRejectedError = class extends Error {
   mcpId;
   reason;
+  /**
+   * #418: when the reason is `unsupported-capability: a, b (not available in
+   * this browser)` — every capability this MCP declared is one the browser
+   * cannot serve — those capabilities, parsed out of it. Empty otherwise.
+   */
+  unavailableCapabilities;
+  /** #418: the refusing browser's platform, when this bridge knew it. */
+  platform;
+  /**
+   * #418: the remedy, when the reason is one this package knows how to
+   * explain — today only `unsupported-capability`, which blames the browser
+   * rather than the MCP. `null` otherwise.
+   */
+  hint;
   constructor(info) {
-    super(`fetchproxy: the extension refused the connection for "${info.mcpId}": ${info.reason}. This is the extension's own reason \u2014 it is not a timeout, and retrying unchanged will be refused the same way.`);
+    const unavailable = parseUnsupportedCapabilityReason(info.reason);
+    const platform = info.platform ?? null;
+    const hint = unavailable !== null ? `${platform ? `this browser (${platform})` : "this browser"} cannot serve any of the capabilities this MCP needs (${unavailable.join(", ")}) \u2014 ContextMint Bridge checked for the browser APIs and they are missing. Nothing is wrong with the MCP or your pairing, and updating will not change it: use this MCP from a browser that provides them (for example Chrome).` : null;
+    super(`fetchproxy: the extension refused the connection for "${info.mcpId}": ${info.reason}. ` + (hint !== null ? hint : `This is the extension's own reason \u2014 it is not a timeout, and retrying unchanged will be refused the same way.`));
     this.name = "FetchproxyHelloRejectedError";
     this.mcpId = info.mcpId;
     this.reason = info.reason;
+    this.unavailableCapabilities = unavailable ?? [];
+    this.platform = platform;
+    this.hint = hint;
     Object.setPrototypeOf(this, new.target.prototype);
   }
 };
-var MIN_VERSION = "3.0.0";
+var MIN_SERVER_VERSION = "3.0.0";
 var FetchproxyProtocolVersionError = class extends Error {
   /** The protocol version this process speaks. */
   ourVersion;
@@ -41182,7 +41414,7 @@ var FetchproxyProtocolVersionError = class extends Error {
   theirVersion;
   peer;
   constructor(info) {
-    const far = info.peer === "extension" ? `the attached browser extension speaks ${info.theirVersion} \u2014 update Transporter (the fetchproxy extension) to ${MIN_VERSION} or later` : `the MCP holding the bridge port speaks ${info.theirVersion} \u2014 upgrade @fetchproxy/server to ${MIN_VERSION} or later in that MCP`;
+    const far = info.peer === "extension" ? `the attached browser extension speaks ${info.theirVersion} \u2014 update ContextMint Bridge to a release that speaks fetchproxy protocol ${info.ourVersion}` : `the MCP holding the bridge port speaks ${info.theirVersion} \u2014 upgrade @fetchproxy/server to ${MIN_SERVER_VERSION} or later in that MCP`;
     super(`protocol version mismatch: this MCP speaks fetchproxy protocol ${info.ourVersion}, ${far}`);
     this.name = "FetchproxyProtocolVersionError";
     this.ourVersion = info.ourVersion;
@@ -41215,9 +41447,9 @@ async function awaitSessionReady(ready, opts) {
 }
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
-import { readFile as readFile2, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2, rm as rm2 } from "node:fs/promises";
+import { readFile as readFile3, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2, rm as rm2 } from "node:fs/promises";
 import { randomBytes as randomBytes5 } from "node:crypto";
-import { isAbsolute as isAbsolute4, join as join4 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join5 } from "node:path";
 
 // node_modules/@fetchproxy/server/dist/identity.js
 import { readFile, readdir, writeFile, mkdir, chmod, rename, rm, unlink, link, lstat } from "node:fs/promises";
@@ -41318,6 +41550,7 @@ async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
       throw e;
   }
   let unreadable = null;
+  let recovered = false;
   for (let attempt = 0; attempt < 5; attempt++) {
     const id = await generateIdentity();
     if (await publishIdentityIfAbsent(dir, serverName, id))
@@ -41331,6 +41564,11 @@ async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
       if (!(e instanceof SyntaxError))
         throw e;
       unreadable = e;
+      if (!recovered && await removeAbandonedIdentity(path)) {
+        recovered = true;
+        attempt--;
+        continue;
+      }
       await new Promise((r) => setTimeout(r, 20 * (attempt + 1)));
     }
   }
@@ -41372,6 +41610,192 @@ async function publishIdentityIfAbsent(dir, serverName, id) {
     await rm(tmp, { force: true });
   }
 }
+var ABANDONED_IDENTITY_MS = 5e3;
+var RECOVERY_LOCK_STALE_MS = 3e4;
+function looksAbandoned(text) {
+  const t = text.trim();
+  return t === "" || t.startsWith("{") && !t.endsWith("}");
+}
+function sameFile(a, b) {
+  return a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs;
+}
+async function takeRecoveryLock(lock) {
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      await writeFile(lock, `${process.pid}
+`, { mode: 384, flag: "wx" });
+      return await lstat(lock);
+    } catch (e) {
+      if (e.code !== "EEXIST")
+        return null;
+      const st = await lstat(lock).catch(() => null);
+      if (st === null)
+        continue;
+      if (Date.now() - st.mtimeMs < RECOVERY_LOCK_STALE_MS)
+        return null;
+      const again = await lstat(lock).catch(() => null);
+      if (again === null || !sameFile(st, again))
+        continue;
+      await unlink(lock).catch(() => void 0);
+    }
+  }
+  return null;
+}
+async function removeAbandonedIdentity(path) {
+  const lock = `${path}.recover.lock`;
+  const held = await takeRecoveryLock(lock);
+  if (held === null)
+    return false;
+  try {
+    const before = await lstat(path);
+    if (!before.isFile() || Date.now() - before.mtimeMs < ABANDONED_IDENTITY_MS)
+      return false;
+    if (!looksAbandoned(await readFile(path, "utf8")))
+      return false;
+    const now = await lstat(path);
+    if (!sameFile(before, now))
+      return false;
+    await unlink(path);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    const st = await lstat(lock).catch(() => null);
+    if (st !== null && sameFile(held, st))
+      await unlink(lock).catch(() => void 0);
+  }
+}
+
+// node_modules/@fetchproxy/server/dist/extension-pins.js
+import { readFile as readFile2 } from "node:fs/promises";
+import { join as join4 } from "node:path";
+var EXTENSION_PINS_FILE_VERSION = 1;
+var EXTENSION_PINS_ENV = "FETCHPROXY_EXTENSION_PINS";
+var ExtensionPinsError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ExtensionPinsError";
+    this.code = code;
+  }
+};
+function malformed(why) {
+  return new ExtensionPinsError("EXTENSION_PINS_MALFORMED", `malformed extension pin set: ${why}`);
+}
+function isKey(x) {
+  if (typeof x !== "string" || x === "")
+    return false;
+  let raw;
+  try {
+    raw = fromB64(x);
+  } catch {
+    return false;
+  }
+  return raw.length === 32 && toB64(raw) === x;
+}
+function parseExtensionPins(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw malformed("not JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw malformed("not an object");
+  }
+  const r = parsed;
+  if (r.v !== EXTENSION_PINS_FILE_VERSION) {
+    throw malformed(`"v" is not ${EXTENSION_PINS_FILE_VERSION}`);
+  }
+  if (r.managed !== true)
+    throw malformed('"managed" is not true');
+  if (r.managedBy !== void 0 && typeof r.managedBy !== "string") {
+    throw malformed('"managedBy" is not a string');
+  }
+  if (!Array.isArray(r.extensions))
+    throw malformed('"extensions" is not an array');
+  const extensions = r.extensions.map((e, i) => {
+    if (!e || typeof e !== "object" || Array.isArray(e)) {
+      throw malformed(`extensions[${i}] is not an object`);
+    }
+    const x = e;
+    if (!isKey(x.x25519Pub)) {
+      throw malformed(`extensions[${i}].x25519Pub is not canonical base64 of 32 bytes`);
+    }
+    if (!isKey(x.ed25519Pub)) {
+      throw malformed(`extensions[${i}].ed25519Pub is not canonical base64 of 32 bytes`);
+    }
+    if (x.label !== void 0 && typeof x.label !== "string") {
+      throw malformed(`extensions[${i}].label is not a string`);
+    }
+    return {
+      x25519Pub: x.x25519Pub,
+      ed25519Pub: x.ed25519Pub,
+      ...x.label !== void 0 ? { label: x.label } : {}
+    };
+  });
+  return {
+    v: EXTENSION_PINS_FILE_VERSION,
+    managed: true,
+    ...r.managedBy !== void 0 ? { managedBy: r.managedBy } : {},
+    extensions
+  };
+}
+function extensionPinsPath(serverName, trustDir) {
+  return join4(trustDir, `${safeIdentityFileBase(serverName)}.extension-pins.json`);
+}
+async function readExtensionPinsAt(path) {
+  let text;
+  try {
+    text = await readFile2(path, "utf8");
+  } catch (e) {
+    const code = e.code ?? "read failed";
+    throw new ExtensionPinsError("EXTENSION_PINS_MISSING", `no managed extension pin set at ${path} (${code})`);
+  }
+  try {
+    return parseExtensionPins(text);
+  } catch (e) {
+    const why = e instanceof ExtensionPinsError ? e.message : "malformed extension pin set";
+    throw new ExtensionPinsError("EXTENSION_PINS_MALFORMED", `${why} at ${path}`);
+  }
+}
+function decideManagedExtensionTrust(args) {
+  const { set: set2, hello, serverName } = args;
+  const listed = set2.extensions.some((e) => e.x25519Pub === hello.identityX25519Pub && e.ed25519Pub === hello.identityEd25519Pub);
+  if (listed)
+    return { decision: "pinned" };
+  return {
+    decision: "refused",
+    code: "EXTENSION_NOT_PINNED",
+    message: `[fetchproxy] ${serverName}: refusing an extension that is not in the host-managed pin set${args.location ? ` (${args.location})` : ""}. The host that runs this MCP decides which browsers it accepts; confirm this browser there.`
+  };
+}
+async function evaluateManagedExtensionTrust(port, hello, serverName) {
+  let set2;
+  try {
+    set2 = await port.read();
+  } catch (e) {
+    const code = e instanceof ExtensionPinsError ? e.code : "EXTENSION_PINS_MISSING";
+    const detail = e instanceof ExtensionPinsError ? e.message : `could not read ${port.location}`;
+    return {
+      decision: "refused",
+      code,
+      message: `[fetchproxy] ${serverName}: ${code}: ${detail} \u2014 refusing every extension until the host that manages this MCP's pins writes a valid set.`
+    };
+  }
+  return decideManagedExtensionTrust({ set: set2, hello, serverName, location: port.location });
+}
+function resolveExtensionPinsMode(explicit, env = process.env) {
+  if (explicit === "managed")
+    return "managed";
+  const raw = env[EXTENSION_PINS_ENV];
+  if (raw === void 0 || raw.trim() === "")
+    return "first-use";
+  if (raw === "managed")
+    return "managed";
+  console.warn(`[fetchproxy] ${EXTENSION_PINS_ENV}=${JSON.stringify(raw)} is not "managed" \u2014 treating it as managed anyway, because a set variable means a host manages this MCP's extension pins. Unset it for trust on first use.`);
+  return "managed";
+}
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
 var TRUST_DIR_ENV = "FETCHPROXY_TRUST_DIR";
@@ -41395,6 +41819,22 @@ function defaultTrustDir() {
 }
 function fileExtensionTrust(args) {
   const dir = resolveTrustDir(args.trustDir, args.dir);
+  if (args.extensionPins === "managed") {
+    const location = extensionPinsPath(args.serverName, dir);
+    return {
+      // Managed mode has no first-use pin: nothing to read, nothing to write,
+      // and no operator override. `write` REJECTS rather than no-ops, so a
+      // path that ever reached it would log the attempt instead of silently
+      // pretending to have pinned.
+      allowNew: false,
+      location,
+      read: async () => null,
+      write: async () => {
+        throw new Error(`refusing to write an extension pin: ${location} is host-managed and this MCP never pins on first use`);
+      },
+      managed: { location, read: () => readExtensionPinsAt(location) }
+    };
+  }
   return {
     allowNew: args.allowNew,
     location: extensionTrustPath(args.serverName, dir),
@@ -41428,13 +41868,13 @@ function decideExtensionTrust(args) {
   };
 }
 function extensionTrustPath(serverName, dir = defaultTrustDir()) {
-  return join4(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
+  return join5(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
 }
 function extensionTrustPathHint(serverName) {
   try {
     return extensionTrustPath(serverName);
   } catch {
-    return join4(defaultTrustDir(), "<server-name>.extension-trust.json");
+    return join5(defaultTrustDir(), "<server-name>.extension-trust.json");
   }
 }
 function isPin(x) {
@@ -41447,7 +41887,7 @@ async function readExtensionPin(serverName, dir = defaultTrustDir()) {
   const path = extensionTrustPath(serverName, dir);
   let raw;
   try {
-    raw = await readFile2(path, "utf8");
+    raw = await readFile3(path, "utf8");
   } catch (e) {
     if (e.code === "ENOENT")
       return null;
@@ -41620,6 +42060,7 @@ async function startHost(opts) {
     return true;
   }
   let extensionHello = null;
+  let ownSessionInfo = null;
   let extensionClaim = null;
   const pairCodeFor = async (hello, mint) => {
     if (!mint)
@@ -41638,6 +42079,7 @@ async function startHost(opts) {
       return;
     console.warn(`[fetchproxy] ${opts.ownServerName}: ${OWN_DECRYPT_FAILURES_BEFORE_REHANDSHAKE} frames in a row from the extension failed authentication under this MCP's session key \u2014 re-handshaking this MCP's session (the extension stays connected).`);
     ownSession = dropOwnSessionAndEphemeral();
+    ownSessionInfo = null;
     resetSessionPromise();
     const mintedKeypair = await generateSessionKeypair();
     const mintedHello = await buildServerHello({
@@ -41696,28 +42138,39 @@ async function startHost(opts) {
             return;
           }
           extensionClaim = ws;
-          let pin;
-          try {
-            pin = await opts.extensionTrust.read();
-          } catch (e) {
-            console.error(`[fetchproxy] ${String(e)}`);
-            if (extensionClaim === ws)
-              extensionClaim = null;
-            ws.close(1008, "extension pin unreadable");
-            return;
+          const managed = opts.extensionTrust.managed;
+          let outcome;
+          let refusalReason = "extension identity is not the pinned one";
+          if (managed) {
+            const decided = await evaluateManagedExtensionTrust(managed, frame, opts.ownServerName);
+            outcome = decided;
+            if (decided.decision === "refused") {
+              refusalReason = decided.code === "EXTENSION_NOT_PINNED" ? "extension identity is not in the managed pin set" : "extension pin set unavailable";
+            }
+          } else {
+            let pin;
+            try {
+              pin = await opts.extensionTrust.read();
+            } catch (e) {
+              console.error(`[fetchproxy] ${String(e)}`);
+              if (extensionClaim === ws)
+                extensionClaim = null;
+              ws.close(1008, "extension pin unreadable");
+              return;
+            }
+            outcome = decideExtensionTrust({
+              pin,
+              hello: frame,
+              allowNew: opts.extensionTrust.allowNew,
+              serverName: opts.ownServerName,
+              location: opts.extensionTrust.location
+            });
           }
-          const outcome = decideExtensionTrust({
-            pin,
-            hello: frame,
-            allowNew: opts.extensionTrust.allowNew,
-            serverName: opts.ownServerName,
-            location: opts.extensionTrust.location
-          });
           if (outcome.decision === "refused") {
             console.warn(outcome.message);
             if (extensionClaim === ws)
               extensionClaim = null;
-            ws.close(1008, "extension identity is not the pinned one");
+            ws.close(1008, refusalReason);
             return;
           }
           if (outcome.decision === "replace")
@@ -41812,8 +42265,9 @@ async function startHost(opts) {
               console.warn("[fetchproxy] discarding a ready for a session ephemeral this host no longer holds (the extension reconnected while a hello was in flight)");
               return;
             }
-            const extEdPub = fromB64(extensionHello.identityEd25519Pub);
-            const extNonce = fromB64(extensionHello.sessionNonce);
+            const verifiedHello = extensionHello;
+            const extEdPub = fromB64(verifiedHello.identityEd25519Pub);
+            const extNonce = fromB64(verifiedHello.sessionNonce);
             const msg = readySignaturePayload(held.nonce, extNonce, fromB64(frame.extensionSessionPub), held.pub);
             const sig = fromB64(frame.sessionSig);
             let sigOk = false;
@@ -41846,6 +42300,7 @@ async function startHost(opts) {
             if (extensionWs !== ws)
               return;
             ownSession = new SessionState(key);
+            ownSessionInfo = sessionInfoFromHello(verifiedHello);
             ownDecryptFailures = 0;
             ownPendingPairCode = null;
             resolveOwnSession(ownSession);
@@ -41916,7 +42371,11 @@ async function startHost(opts) {
         }
         if (frame.type === "hello-rejected" && identified === "extension") {
           if (frame.mcpId === opts.ownMcpId) {
-            rejectOwnSession(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
+            rejectOwnSession(new FetchproxyHelloRejectedError({
+              mcpId: frame.mcpId,
+              reason: frame.reason,
+              platform: extensionHello?.platform ?? null
+            }));
           } else {
             const slot = peers.get(frame.mcpId);
             if (slot?.helloFrame.accepts?.includes("hello-rejected")) {
@@ -41962,6 +42421,7 @@ async function startHost(opts) {
           rejectOwnSession(new Error("extension disconnected before ready"));
         }
         ownSession = dropOwnSessionAndEphemeral();
+        ownSessionInfo = null;
         ownDecryptFailures = 0;
         ownPendingPairCode = null;
         resetSessionPromise();
@@ -42008,6 +42468,7 @@ async function startHost(opts) {
       });
       if (!extensionWs)
         throw new Error("host: no extension connected");
+      opts.refuseOutbound?.(inner, ownSessionInfo);
       const plaintext = encodeOutboundInnerFrame(opts.ownMcpId, inner);
       const sealed = await sealInnerFrame(session.sessionKey, opts.ownMcpId, session.nextOutboundSeq(), plaintext, "s2e");
       extensionWs.send(JSON.stringify(sealed));
@@ -42023,7 +42484,8 @@ async function startHost(opts) {
     },
     pendingPairCode: () => ownPendingPairCode,
     extensionConnected: () => extensionWs !== null,
-    sessionLinked: () => ownSession !== null
+    sessionLinked: () => ownSession !== null,
+    sessionInfo: () => ownSession !== null ? ownSessionInfo : null
   };
 }
 
@@ -42108,6 +42570,7 @@ async function startPeer(opts) {
   const closeListeners = [];
   const extensionDisconnectListeners = [];
   let session = null;
+  let sessionInfo = null;
   let sessionEphemeral = null;
   function dropSessionEphemeral() {
     if (sessionEphemeral)
@@ -42173,6 +42636,15 @@ async function startPeer(opts) {
       console.warn(`[fetchproxy] ${opts.serverName}: extension session signature invalid \u2014 refusing (the concentrator may be answering in the browser's place)`);
       return null;
     }
+    const managed = opts.extensionTrust.managed;
+    if (managed) {
+      const decided = await evaluateManagedExtensionTrust(managed, hello2, opts.serverName);
+      if (decided.decision === "refused") {
+        console.warn(decided.message);
+        return null;
+      }
+      return hello2;
+    }
     if (cachedPin === void 0) {
       try {
         cachedPin = await opts.extensionTrust.read();
@@ -42240,6 +42712,7 @@ async function startPeer(opts) {
         extensionGone = true;
         dropSessionEphemeral();
         pendingPairCode = null;
+        sessionInfo = null;
         if (session !== null) {
           session = null;
           if (sessionPromiseSettled)
@@ -42272,6 +42745,7 @@ async function startPeer(opts) {
         }
         const isRenegotiation = session !== null;
         session = new SessionState(sessionKey);
+        sessionInfo = sessionInfoFromHello(authenticated);
         extensionGone = false;
         pendingPairCode = null;
         if (isRenegotiation) {
@@ -42282,7 +42756,11 @@ async function startPeer(opts) {
         return;
       }
       if (frame.type === "hello-rejected" && frame.mcpId === opts.mcpId) {
-        rejectFirstReady(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
+        rejectFirstReady(new FetchproxyHelloRejectedError({
+          mcpId: frame.mcpId,
+          reason: frame.reason,
+          platform: extensionHello?.platform ?? null
+        }));
       }
       if (frame.type === "pair-pending" && frame.mcpId === opts.mcpId) {
         const hello2 = extensionHello;
@@ -42382,6 +42860,7 @@ async function startPeer(opts) {
       const s = session;
       if (s === null)
         throw new Error("peer: extension disconnected");
+      opts.refuseOutbound?.(inner, sessionInfo);
       const plaintext = encodeOutboundInnerFrame(opts.mcpId, inner);
       const sealed = await sealInnerFrame(s.sessionKey, opts.mcpId, s.nextOutboundSeq(), plaintext, "s2e");
       if (ws.readyState !== import_websocket.default.OPEN)
@@ -42400,6 +42879,7 @@ async function startPeer(opts) {
     pendingPairCode: () => pendingPairCode,
     extensionConnected: () => extensionHello !== null,
     sessionLinked: () => session !== null && !extensionGone,
+    sessionInfo: () => session !== null && !extensionGone ? sessionInfo : null,
     onClose: (cb) => {
       closeListeners.push(cb);
     },
@@ -42412,7 +42892,9 @@ async function startPeer(opts) {
 }
 
 // node_modules/@fetchproxy/server/dist/error-kind.js
-function classifyFetchError(error62) {
+function classifyFetchError(error62, code) {
+  if (code === CAPABILITY_UNAVAILABLE_CODE)
+    return "capability_unavailable";
   if (/^(in-page )?fetch threw:/.test(error62)) {
     return "tab_fetch_failed";
   }
@@ -42428,6 +42910,9 @@ function classifyFetchError(error62) {
   if (/not in domains \[/.test(error62)) {
     return "domain_denied";
   }
+  if (parseCapabilityUnavailable(error62) !== null) {
+    return "capability_unavailable";
+  }
   if (/^capability .+ not granted/.test(error62)) {
     return "capability_denied";
   }
@@ -42506,7 +42991,7 @@ var FetchproxyBridgeDownError = class extends FetchproxyProtocolError {
     const retryAttempted = args.retryAttempted ?? false;
     const op = args.op ?? "fetch";
     const retryClause = retryAttempted ? `Server already burned a one-shot lazy-revive retry; SW is still down. ` : `Server lazy-revive retry was disabled (bridgeReviveDelayMs unset/0). `;
-    const hint = `the fetchproxy extension's service worker is not responding ("${args.originalError}"). Chrome evicts extension service workers after ~30s idle by default. ${retryClause}Make sure a tab for this domain is open, fully loaded, and signed in (the bridge fetches through that tab) \u2014 then retry. If it keeps happening, reload the extension from chrome://extensions and reload the tab.`;
+    const hint = `ContextMint Bridge's service worker is not responding ("${args.originalError}"). Chrome evicts extension service workers after ~30s idle by default. ${retryClause}Make sure a tab for this domain is open, fully loaded, and signed in (the bridge fetches through that tab) \u2014 then retry. If it keeps happening, reload the extension from chrome://extensions and reload the tab.`;
     super(`fetchproxy bridge down during ${op}${args.url ? ` (${args.url})` : ""}. ${hint}`);
     this.name = "FetchproxyBridgeDownError";
     this.originalError = args.originalError;
@@ -42533,7 +43018,7 @@ var FetchproxyHintedError = class extends FetchproxyProtocolError {
 };
 var FetchproxyScopeError = class extends FetchproxyHintedError {
   constructor(originalError) {
-    super(originalError, "the declared scope changed since you paired, so the extension is refusing the request. Revoke this MCP in the Transporter extension popup, then re-run \u2014 you will be asked to approve the new scope. This is not a version problem and does not need an update.");
+    super(originalError, "the declared scope changed since you paired, so the extension is refusing the request. Revoke this MCP in the ContextMint Bridge extension popup, then re-run \u2014 you will be asked to approve the new scope. This is not a version problem and does not need an update.");
     this.name = "FetchproxyScopeError";
   }
 };
@@ -42555,6 +43040,19 @@ var FetchproxyWaitedError = class extends FetchproxyHintedError {
     this.name = "FetchproxyWaitedError";
   }
 };
+var FetchproxyCapabilityUnavailableError = class extends FetchproxyHintedError {
+  /** The capability the browser cannot serve (`graphql` for a `graphql_query`). */
+  capability;
+  /** The browser, when known (`'safari'`); `null` when the extension did not say. */
+  platform;
+  constructor(originalError, info) {
+    const where = info.platform ? `this browser (${info.platform})` : "this browser";
+    super(originalError, `${where} cannot serve the "${info.capability}" capability \u2014 ContextMint Bridge checked for the browser API it needs and it is missing. The rest of this MCP still works here. Nothing is wrong with the MCP's code or your pairing, and neither updating nor re-approving will change it: use this tool from a browser that provides the API (for example Chrome).`);
+    this.name = "FetchproxyCapabilityUnavailableError";
+    this.capability = info.capability;
+    this.platform = info.platform;
+  }
+};
 function waitedHint(op) {
   const tail = " This is not a version problem and does not need an update.";
   if (op === "capture" || op === "capture_redirect") {
@@ -42568,7 +43066,15 @@ function waitedHint(op) {
 var SCOPE_REJECTION = /not in declared/;
 var NO_TAB_REJECTION = /no tab matching (?!.*(content script loaded|one is still opening))/;
 var TAB_OPENING_REJECTION = /no tab matching .*one is still opening/;
-function protocolErrorFrom(error62, op) {
+function protocolErrorFrom(error62, op, response) {
+  const unavailable = parseCapabilityUnavailable(error62);
+  if (unavailable !== null || response?.code === CAPABILITY_UNAVAILABLE_CODE) {
+    const fromOp = response?.op === "graphql_query" ? "graphql" : response?.op ?? "unknown";
+    return new FetchproxyCapabilityUnavailableError(error62, {
+      capability: unavailable?.capability ?? fromOp,
+      platform: unavailable?.platform ?? null
+    });
+  }
   if (error62 === "timeout")
     return new FetchproxyWaitedError(error62, op);
   if (SCOPE_REJECTION.test(error62))
@@ -42627,7 +43133,8 @@ var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
   constructor(args) {
     const graceMs = args.graceMs ?? VERB_DEADLINE_GRACE_MS;
     const callerChose = args.requestedTimeoutMs !== void 0 && args.timeoutMs === args.requestedTimeoutMs + graceMs;
-    super(`fetchproxy: ${args.url} did not respond within ${args.timeoutMs}ms` + (callerChose ? ` \u2014 the ${args.requestedTimeoutMs}ms this call asked for, plus ${graceMs}ms for the reply to reach this server. The extension runs its own timer on the value you passed, so a window that is genuinely too short reports what did not happen rather than this.` : ""));
+    const base = `fetchproxy: ${args.url} did not respond within ${args.timeoutMs}ms` + (callerChose ? ` \u2014 the ${args.requestedTimeoutMs}ms this call asked for, plus ${graceMs}ms for the reply to reach this server. The extension runs its own timer on the value you passed, so a window that is genuinely too short reports what did not happen rather than this.` : "");
+    super(args.retrySafe === false ? withNotResentNote(base) : base);
     this.name = "FetchproxyTimeoutError";
     this.url = args.url;
     this.timeoutMs = args.timeoutMs;
@@ -42639,6 +43146,10 @@ var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
     this.retrySafe = args.retrySafe ?? true;
   }
 };
+var TIMEOUT_NOT_RESENT_NOTE = "It was not re-sent because it may already have run in the browser \u2014 check before retrying.";
+function withNotResentNote(message) {
+  return `${message}${message.endsWith(".") ? " " : ". "}${TIMEOUT_NOT_RESENT_NOTE}`;
+}
 var SUBDOMAIN_LABEL_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
 function normalizeCookiePath(path) {
   if (path === void 0 || path === "")
@@ -42898,6 +43409,7 @@ var FetchproxyServer = class {
       identityDir: opts.identityDir,
       trustDir: opts.trustDir,
       allowNewExtensionIdentity: opts.allowNewExtensionIdentity,
+      extensionPins: opts.extensionPins,
       requireExtensionIdentity: opts.requireExtensionIdentity,
       onPairCode: opts.onPairCode
     };
@@ -42983,6 +43495,7 @@ var FetchproxyServer = class {
       this.role = "host";
       this.hostHandle = await startHost({
         httpServer: el.server,
+        refuseOutbound: (inner, info) => this.refuseIfUnavailable(inner, info),
         ownIdentity: identity,
         ownMcpId: mcpId,
         ownServerName: this.opts.serverName,
@@ -43013,6 +43526,7 @@ var FetchproxyServer = class {
     } else {
       this.role = "peer";
       this.peerHandle = await startPeer({
+        refuseOutbound: (inner, info) => this.refuseIfUnavailable(inner, info),
         host: this.opts.host,
         port: this.opts.port,
         identity,
@@ -43061,7 +43575,7 @@ var FetchproxyServer = class {
     }
   }
   pairingErrorMessage(code) {
-    return `fetchproxy transport error: pairing required for ${this.opts.serverName}. Tell the user to open the Transporter browser extension popup and approve the pair request. The pair code is: ${code} \u2014 display this code to the user so they can verify it matches.`;
+    return `fetchproxy transport error: pairing required for ${this.opts.serverName}. Tell the user to open the ContextMint Bridge browser extension popup and approve the pair request. The pair code is: ${code} \u2014 display this code to the user so they can verify it matches.`;
   }
   /**
    * Raw single-shot fetch through the bridge. Most callers should prefer
@@ -43191,13 +43705,28 @@ var FetchproxyServer = class {
    * every one of them.
    */
   extensionTrust() {
+    const allowNew = allowNewExtensionIdentity(this.opts.allowNewExtensionIdentity);
+    if (resolveExtensionPinsMode(this.opts.extensionPins) === "managed") {
+      if (allowNew && !this.warnedAllowNewIgnored) {
+        this.warnedAllowNewIgnored = true;
+        console.warn(`[fetchproxy] ${this.opts.serverName}: ignoring ${TRUST_NEW_EXTENSION_ENV} / allowNewExtensionIdentity \u2014 this MCP's extension pins are host-managed (${EXTENSION_PINS_ENV}=managed), so only the host's pin set decides which browsers it accepts.`);
+      }
+      return fileExtensionTrust({
+        serverName: this.opts.serverName,
+        dir: this.opts.identityDir,
+        trustDir: this.opts.trustDir,
+        allowNew: false,
+        extensionPins: "managed"
+      });
+    }
     return fileExtensionTrust({
       serverName: this.opts.serverName,
       dir: this.opts.identityDir,
       trustDir: this.opts.trustDir,
-      allowNew: allowNewExtensionIdentity(this.opts.allowNewExtensionIdentity)
+      allowNew
     });
   }
+  warnedAllowNewIgnored = false;
   noteActivityForKeepalive() {
     const intervalMs = this.opts.keepAliveIntervalMs;
     if (intervalMs <= 0)
@@ -43291,6 +43820,15 @@ var FetchproxyServer = class {
         resendable: isRetrySafeOnTimeout(init.method, fetchOpts.retryOnTimeout)
       });
     } catch (err) {
+      if (err instanceof FetchproxyCapabilityUnavailableError) {
+        return {
+          ok: false,
+          error: err.originalError,
+          kind: "capability_unavailable",
+          retryAttempted: false,
+          cause: err
+        };
+      }
       return {
         ok: false,
         error: err instanceof Error ? err.message : String(err),
@@ -43311,7 +43849,8 @@ var FetchproxyServer = class {
           timer = setTimeout(() => {
             this.pending.delete(id);
             const elapsedMs = Date.now() - start;
-            const error62 = `fetchproxy: ${init.url} did not respond within ${timeoutMs}ms`;
+            const base = `fetchproxy: ${init.url} did not respond within ${timeoutMs}ms`;
+            const error62 = isRetrySafeOnTimeout(init.method, fetchOpts.retryOnTimeout) ? base : withNotResentNote(base);
             resolve6({
               ok: false,
               error: error62,
@@ -43433,6 +43972,9 @@ var FetchproxyServer = class {
         port: this.opts.port
       });
     }
+    if (result.kind === "capability_unavailable") {
+      return protocolErrorFrom(result.error, void 0, { code: CAPABILITY_UNAVAILABLE_CODE, op });
+    }
     return protocolErrorFrom(result.error);
   }
   /**
@@ -43499,6 +44041,9 @@ var FetchproxyServer = class {
       if (result.kind === "session_not_ready" && result.cause instanceof Error) {
         throw result.cause;
       }
+      if (result.kind === "capability_unavailable" && result.cause instanceof FetchproxyCapabilityUnavailableError) {
+        throw result.cause;
+      }
       throw this._typedErrorFor(result, init.url, "fetch", result.retryAttempted ?? false, isRetrySafeOnTimeout(method, opts.retryOnTimeout));
     }
     const response = {
@@ -43681,7 +44226,9 @@ var FetchproxyServer = class {
         session_state: health.session.state,
         pending_pair_code: health.session.pairCode,
         extension_connected: health.session.extensionConnected,
-        last_extension_message_at: health.lastExtensionMessageAt
+        last_extension_message_at: health.lastExtensionMessageAt,
+        unavailable_capabilities: health.session.unavailableCapabilities,
+        platform: health.session.platform
       },
       ...error62 ? { error: error62 } : {}
     };
@@ -44327,7 +44874,7 @@ var FetchproxyServer = class {
         fetchCb({
           ok: false,
           error: inner.error,
-          kind: classifyFetchError(inner.error),
+          kind: classifyFetchError(inner.error, inner.code),
           retryAttempted: false
         });
       }
@@ -44343,7 +44890,7 @@ var FetchproxyServer = class {
           storageCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on storage awaiter`));
         }
       } else {
-        storageCb.reject(protocolErrorFrom(inner.error));
+        storageCb.reject(protocolErrorFrom(inner.error, void 0, inner));
       }
       return;
     }
@@ -44357,7 +44904,7 @@ var FetchproxyServer = class {
           captureCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on capture awaiter`));
         }
       } else {
-        captureCb.reject(protocolErrorFrom(inner.error, "capture"));
+        captureCb.reject(protocolErrorFrom(inner.error, "capture", inner));
       }
       return;
     }
@@ -44371,7 +44918,7 @@ var FetchproxyServer = class {
           redirectCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on capture_redirect awaiter`));
         }
       } else {
-        redirectCb.reject(protocolErrorFrom(inner.error, "capture_redirect"));
+        redirectCb.reject(protocolErrorFrom(inner.error, "capture_redirect", inner));
       }
       return;
     }
@@ -44385,7 +44932,7 @@ var FetchproxyServer = class {
           idbCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on read_indexed_db awaiter`));
         }
       } else {
-        idbCb.reject(protocolErrorFrom(inner.error));
+        idbCb.reject(protocolErrorFrom(inner.error, void 0, inner));
       }
       return;
     }
@@ -44399,7 +44946,7 @@ var FetchproxyServer = class {
           domListCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on read_dom_list awaiter`));
         }
       } else {
-        domListCb.reject(protocolErrorFrom(inner.error));
+        domListCb.reject(protocolErrorFrom(inner.error, void 0, inner));
       }
       return;
     }
@@ -44413,7 +44960,7 @@ var FetchproxyServer = class {
           downloadCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on download awaiter`));
         }
       } else {
-        downloadCb.reject(protocolErrorFrom(inner.error, "download"));
+        downloadCb.reject(protocolErrorFrom(inner.error, "download", inner));
       }
       return;
     }
@@ -44427,7 +44974,7 @@ var FetchproxyServer = class {
           graphqlCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on graphql_query awaiter`));
         }
       } else {
-        graphqlCb.reject(protocolErrorFrom(inner.error));
+        graphqlCb.reject(protocolErrorFrom(inner.error, void 0, inner));
       }
       return;
     }
@@ -44437,7 +44984,7 @@ var FetchproxyServer = class {
       if (inner.ok && inner.op === "write_cookies") {
         writeCookiesCb.resolve([...inner.written]);
       } else {
-        writeCookiesCb.reject(protocolErrorFrom(inner.ok ? "write_cookies response had the wrong op" : inner.error));
+        writeCookiesCb.reject(inner.ok ? protocolErrorFrom("write_cookies response had the wrong op") : protocolErrorFrom(inner.error, void 0, inner));
       }
       return;
     }
@@ -44627,11 +45174,38 @@ var FetchproxyServer = class {
     const handle = this.hostHandle ?? this.peerHandle;
     const pairCode = this.currentPendingPairCode();
     if (!handle || this.role === null) {
-      return { state: "not_listening", pairCode, extensionConnected: false };
+      return {
+        state: "not_listening",
+        pairCode,
+        extensionConnected: false,
+        unavailableCapabilities: [],
+        platform: null
+      };
     }
+    const info = handle.sessionInfo?.() ?? null;
     const extensionConnected = handle.extensionConnected();
     const state = handle.sessionLinked() ? "linked" : pairCode !== null ? "pair_pending" : !extensionConnected ? "extension_disconnected" : "no_session";
-    return { state, pairCode, extensionConnected };
+    return {
+      state,
+      pairCode,
+      extensionConnected,
+      unavailableCapabilities: info ? [...info.unavailableCapabilities] : [],
+      platform: info?.platform ?? null
+    };
+  }
+  /**
+   * #418: refuse, before a seq is claimed, a request whose capability the
+   * extension said this browser cannot serve. Called by the host / peer
+   * handle once the session is ready, so it judges against the list from the
+   * hello that session was verified against. Advisory: the list is unsigned,
+   * so it may only ever make this MCP refuse MORE — the extension still
+   * enforces from its own runtime check for anything that gets through.
+   */
+  refuseIfUnavailable(inner, info) {
+    const cap = unavailableCapabilityFor(inner, info);
+    if (cap === null || info === null)
+      return;
+    throw new FetchproxyCapabilityUnavailableError(capabilityUnavailableMessage(cap, info.platform), { capability: cap, platform: info.platform });
   }
   /**
    * 0.5.2+: throw `FetchproxyProtocolError` with the actionable pair-code
@@ -45105,7 +45679,7 @@ async function loginWithPassword(username, password) {
 // package.json
 var package_default = {
   name: "ofw-mcp",
-  version: "2.19.4",
+  version: "2.20.0",
   license: "MIT",
   mcpName: "io.github.chrischall/ofw-mcp",
   description: "OurFamilyWizard MCP server for Claude \u2014 developed and maintained by AI (Claude Code)",
@@ -45139,8 +45713,8 @@ var package_default = {
     typecheck: "tsc -p tsconfig.json --noEmit"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^2.6.0",
-    "@fetchproxy/bootstrap": "^3.2.0",
+    "@chrischall/mcp-utils": "^2.8.0",
+    "@fetchproxy/bootstrap": "^3.4.1",
     "@modelcontextprotocol/server": "^2.0.0",
     dotenv: "^18.0.0",
     zod: "^4.6.5"
@@ -45159,8 +45733,8 @@ var package_default = {
 function fetchproxyDisabled() {
   return parseBoolEnv("OFW_DISABLE_FETCHPROXY");
 }
-var NO_AUTH_CONFIGURED = "OFW auth: set OFW_USERNAME + OFW_PASSWORD, or install the fetchproxy extension and sign into ourfamilywizard.com (unset OFW_DISABLE_FETCHPROXY if it is set).";
-var BRIDGE_DOWN_PREFIX = "OFW auth: fetchproxy bridge is down";
+var NO_AUTH_CONFIGURED = "OFW auth: set OFW_USERNAME + OFW_PASSWORD, or install ContextMint Bridge and sign into ourfamilywizard.com (unset OFW_DISABLE_FETCHPROXY if it is set).";
+var BRIDGE_DOWN_PREFIX = "OFW auth: ContextMint Bridge is down";
 function isBridgeDown(e) {
   return e instanceof Error && e.message.startsWith(BRIDGE_DOWN_PREFIX);
 }
@@ -45202,7 +45776,7 @@ async function resolveAuth() {
         const expiryRaw = session.localStorage["tokenExpiry"];
         if (!token) {
           throw new Error(
-            'localStorage["auth"] missing on ourfamilywizard.com. Sign into OFW in your browser (with the fetchproxy extension installed) and retry.'
+            'localStorage["auth"] missing on ourfamilywizard.com. Sign into OFW in your browser (with ContextMint Bridge installed) and retry.'
           );
         }
         return {
@@ -45277,7 +45851,7 @@ function reportCacheWriteFailure(err) {
 // src/client.ts
 try {
   const dir = dirname3(fileURLToPath(import.meta.url));
-  await loadDotenvSafely({ path: join5(dir, "..", ".env") });
+  await loadDotenvSafely({ path: join6(dir, "..", ".env") });
 } catch {
 }
 function parseContentDispositionFilename(cd) {
@@ -45384,7 +45958,11 @@ var OFWClient = class {
       if (response.status === 429) throw new Error("Rate limited by OFW API");
     }
     if (!response.ok) {
-      throw new Error(`OFW API error: ${response.status} ${response.statusText} for ${method} ${path}`);
+      const errorBody = await response.text();
+      const safeBody = redactSecrets(errorBody).replace(/\s+/g, " ").trim().slice(0, 4e3);
+      throw new Error(
+        `OFW API error: ${response.status} ${response.statusText} for ${method} ${path}` + (safeBody ? ` \u2014 ${safeBody}` : "")
+      );
     }
     return response;
   }
@@ -45774,11 +46352,12 @@ async function requestWrite(client2, method, path, body) {
   }
 }
 function unconfirmedWriteResponse(e, opts) {
+  const fallback = /ourfamilywizard\.com/i.test(opts.checkWith) ? "" : " (or on ourfamilywizard.com)";
   return jsonErrorResponse({
     result: opts.result,
     mayHaveLanded: true,
     reason: `The request to ${opts.what} failed without a definitive answer from OFW: ${e.message}. It MAY HAVE BEEN APPLIED on OurFamilyWizard.`,
-    remedy: `Do NOT retry blindly \u2014 a second attempt can put a duplicate on the co-parent-visible record. First check with ${opts.checkWith} (or on ourfamilywizard.com), and retry only once you have confirmed it did not land.`
+    remedy: `Do NOT retry blindly \u2014 a second attempt can put a duplicate on the co-parent-visible record. First check with ${opts.checkWith}${fallback}, and retry only once you have confirmed it did not land.`
   });
 }
 async function postMessageAndRefetch(client2, payload, detailSchema, ctx) {
@@ -45861,12 +46440,12 @@ function registerHealthcheckTools(server, client2, resolve6 = resolveAuth) {
       kind: "transport",
       // The upstream `.hint` rides along in `error.message` — it carries
       // the actionable "click the toolbar icon" copy this cannot know.
-      hint: "The fetchproxy bridge is down, so the browser path could not be tried. This is not a credential problem: OFW_USERNAME/OFW_PASSWORD, if set, were not reached either. See error.message for the extension-specific fix."
+      hint: "ContextMint Bridge is down, so the browser path could not be tried. This is not a credential problem: OFW_USERNAME/OFW_PASSWORD, if set, were not reached either. See error.message for the extension-specific fix."
     } : void 0,
     hints: {
       // Now means exactly what it says: nothing is set up. A configured path
       // that was tried and failed no longer lands here.
-      no_credential: "No OFW credential is configured. Either set OFW_USERNAME + OFW_PASSWORD, or install the fetchproxy extension and sign in to ourfamilywizard.com in a tab (unsetting OFW_DISABLE_FETCHPROXY if you set it).",
+      no_credential: "No OFW credential is configured. Either set OFW_USERNAME + OFW_PASSWORD, or install ContextMint Bridge and sign in to ourfamilywizard.com in a tab (unsetting OFW_DISABLE_FETCHPROXY if you set it).",
       credential_rejected: "OurFamilyWizard rejected the credential. If it came from `env`, the password changed or the account is locked; if from `fetchproxy`, the browser session expired \u2014 sign in again in the tab. Retrying will not fix either."
     }
   });
@@ -46293,19 +46872,19 @@ async function syncAll(client2, opts, store) {
 // src/config.ts
 import { createHash as createHash5 } from "node:crypto";
 import { homedir as homedir4 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function readCacheIdentity() {
   return readEnvVar("OFW_CACHE_IDENTITY") ?? readEnvVar("OFW_USERNAME") ?? "_default";
 }
 function getCacheDir() {
   const override = process.env.OFW_CACHE_DIR;
   if (override && override.trim().length > 0) return override.trim();
-  return join6(homedir4(), ".cache", "ofw-mcp");
+  return join7(homedir4(), ".cache", "ofw-mcp");
 }
 function getCacheDbPath() {
   const identity = readCacheIdentity();
   const hash2 = createHash5("sha256").update(identity).digest("hex").slice(0, 16);
-  return join6(getCacheDir(), `${hash2}.db`);
+  return join7(getCacheDir(), `${hash2}.db`);
 }
 function getAttachmentsDir() {
   const override = process.env.OFW_ATTACHMENTS_DIR;
@@ -46313,13 +46892,30 @@ function getAttachmentsDir() {
   return getDefaultAttachmentsDir();
 }
 function getDefaultAttachmentsDir() {
-  return join6(homedir4(), "Downloads", "ofw-mcp");
+  return join7(homedir4(), "Downloads", "ofw-mcp");
 }
 function getUploadDir() {
   const override = process.env.OFW_UPLOAD_DIR;
   if (override && override.trim().length > 0) return override.trim();
   return getAttachmentsDir();
 }
+function restrictiveBoolEnv(name) {
+  const raw = process.env[name];
+  if (typeof raw !== "string" || raw.trim().length === 0) return false;
+  const value = raw.trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(value)) return true;
+  if (["0", "false", "no", "off"].includes(value)) return false;
+  console.error(
+    `[ofw-mcp] Unrecognized ${name} "${raw.trim()}" \u2014 failing closed to "true" (restriction enabled). Valid values: true, false.`
+  );
+  return true;
+}
+function getExpenseUploadOnly() {
+  return restrictiveBoolEnv("OFW_EXPENSE_UPLOAD_ONLY");
+}
+function getExpenseOnly() {
+  return getExpenseUploadOnly() || restrictiveBoolEnv("OFW_EXPENSE_ONLY");
+}
 function getWriteMode() {
   const raw = process.env.OFW_WRITE_MODE;
   if (typeof raw !== "string" || raw.trim().length === 0) return "all";
@@ -47856,6 +48452,7 @@ var NodeAttachmentIO = class {
 };
 
 // src/tools/delivery.ts
+var MAX_INLINE_BYTES = 10 * 1024 * 1024;
 async function tryExtract(bytes, mimeType, fileName, opts) {
   try {
     const extracted = await extractAttachment(bytes, mimeType, fileName, {
@@ -47870,6 +48467,17 @@ async function tryExtract(bytes, mimeType, fileName, opts) {
     return { reason: `extraction failed: ${err instanceof Error ? err.message : String(err)}` };
   }
 }
+function assertInlineSize(input2, rawRequested) {
+  const { bytes, fileName, fileId, diskAvailable } = input2;
+  if (bytes.length <= MAX_INLINE_BYTES) return;
+  const hints = [];
+  if (rawRequested) hints.push("omit extract:false to get the file's extracted text instead, if it is a readable document type");
+  if (diskAvailable) hints.push("pass inline:false to save it to disk and get the path");
+  hints.push("or open it directly in OurFamilyWizard");
+  throw new Error(
+    `Attachment ${fileId} (${fileName}) is ${bytes.length} bytes, over the ${MAX_INLINE_BYTES / (1024 * 1024)} MiB limit for returning a file inline (a larger result would exceed the host's response size limit). To get it: ${hints.join("; ")}.`
+  );
+}
 async function buildInlineDelivery(input2) {
   const { fileId, fileName, mimeType, bytes, forcedInline, options } = input2;
   const meta3 = {
@@ -47882,6 +48490,7 @@ async function buildInlineDelivery(input2) {
   if (forcedInline) meta3.forcedInline = true;
   const block = () => ({ type: "text", text: JSON.stringify(meta3, null, 2) });
   if (isHostRenderableImage(mimeType)) {
+    assertInlineSize(input2, false);
     meta3.deliveredVia = "image";
     return { content: [block(), { type: "image", data: bytes.toString("base64"), mimeType }] };
   }
@@ -47899,6 +48508,7 @@ async function buildInlineDelivery(input2) {
     }
     attempts.push(outcome.reason ?? "extraction produced no content");
   }
+  assertInlineSize(input2, options.extract === false);
   meta3.deliveredVia = "blob";
   meta3.deliveryAttempts = attempts;
   meta3.note = "Returned as raw bytes. Some hosts cannot render an embedded resource of this type; if it came back unreadable, the file has no text extractor here (see deliveryAttempts).";
@@ -47915,7 +48525,7 @@ async function buildInlineDelivery(input2) {
 }
 
 // src/tools/messages.ts
-import { basename as basename2, join as join7, resolve as resolve5 } from "node:path";
+import { basename as basename2, join as join8, resolve as resolve5 } from "node:path";
 
 // src/tools/pagination.ts
 function pageState(input2) {
@@ -49186,7 +49796,7 @@ ${text}` : text);
     });
   });
   server.registerTool("ofw_download_attachment", {
-    description: "Download an OFW message attachment by fileId and return content you can actually read. Inline delivery walks a ladder and returns the first rung that works: (1) host-renderable images (PNG/JPEG/GIF/WEBP) come back as ImageContent; (2) .xlsx/.csv/.tsv, .pdf, .docx, .pptx and text files come back as EXTRACTED CONTENT \u2014 per-sheet CSV, per-page/slide text, document text \u2014 in the response JSON under `extracted`; (3) anything else comes back as an EmbeddedResource blob of the raw bytes. The meta block names the rung as `deliveredVia` and, when it falls through to bytes, lists what was tried in `deliveryAttempts`. Reported mime types are always normalized to a bare media type (no charset/name parameters). In disk mode the bytes are saved to ~/Downloads/ofw-mcp/ and the response carries the absolute path; pass extract:true to ALSO get the extracted content in that response. The default for `inline` can be flipped server-side via the OFW_INLINE_ATTACHMENTS env var. On a hosted deployment with no filesystem, disk mode is unavailable, so inline is forced (forcedInline:true) rather than failing \u2014 a saveTo path never costs you the content. fileId comes from attachments[].fileId on ofw_get_message. Override disk destination with OFW_ATTACHMENTS_DIR or saveTo; saveTo must stay inside the attachments directory, and an existing file is never overwritten unless force:true. Re-downloading to the same path is a no-op (disk mode only).",
+    description: "Download an OFW message attachment by fileId and return content you can actually read. Inline delivery walks a ladder and returns the first rung that works: (1) host-renderable images (PNG/JPEG/GIF/WEBP) come back as ImageContent; (2) .xlsx/.csv/.tsv, .pdf, .docx, .pptx and text files come back as EXTRACTED CONTENT \u2014 per-sheet CSV, per-page/slide text, document text \u2014 in the response JSON under `extracted`; (3) anything else comes back as an EmbeddedResource blob of the raw bytes. Images and raw bytes are only returned inline up to 10 MiB; a larger file fails with a tool error that says how to get it instead (extracted text is unaffected \u2014 it is bounded by maxChars). The meta block names the rung as `deliveredVia` and, when it falls through to bytes, lists what was tried in `deliveryAttempts`. Reported mime types are always normalized to a bare media type (no charset/name parameters). In disk mode the bytes are saved to ~/Downloads/ofw-mcp/ and the response carries the absolute path; pass extract:true to ALSO get the extracted content in that response. The default for `inline` can be flipped server-side via the OFW_INLINE_ATTACHMENTS env var. On a hosted deployment with no filesystem, disk mode is unavailable, so inline is forced (forcedInline:true) rather than failing \u2014 a saveTo path never costs you the content. fileId comes from attachments[].fileId on ofw_get_message. Override disk destination with OFW_ATTACHMENTS_DIR or saveTo; saveTo must stay inside the attachments directory, and an existing file is never overwritten unless force:true. Re-downloading to the same path is a no-op (disk mode only).",
     annotations: { readOnlyHint: false, destructiveHint: false },
     inputSchema: external_exports.object({
       fileId: external_exports.number().describe("Attachment file id (from ofw_get_message \u2192 attachments[].fileId)"),
@@ -49230,7 +49840,8 @@ ${text}` : text);
         mimeType: mimeType2,
         bytes,
         forcedInline,
-        options: deliveryOptions
+        options: deliveryOptions,
+        diskAvailable: attachmentIO.supportsDisk
       });
     }
     let dest;
@@ -49239,12 +49850,12 @@ ${text}` : text);
     if (args.saveTo) {
       const isDirArg = args.saveTo.endsWith("/") || args.saveTo.endsWith("\\");
       const abs = resolve5(root, args.saveTo.startsWith("~") ? expandPath2(args.saveTo) : args.saveTo);
-      dest = isDirArg ? join7(abs, `${fileId}-${safeName}`) : abs;
+      dest = isDirArg ? join8(abs, `${fileId}-${safeName}`) : abs;
       if (!isWithin(root, dest)) {
         throw new Error(`Refusing to save to ${dest}: it is outside the attachments directory (${root}). Downloads can only be written inside it \u2014 pass a path or subdirectory under it, or set OFW_ATTACHMENTS_DIR to move it.`);
       }
     } else {
-      dest = join7(root, `${fileId}-${safeName}`);
+      dest = join8(root, `${fileId}-${safeName}`);
     }
     const extractOnDisk = args.extract === true;
     if (!args.force && cached2.downloadedPath === dest) {
@@ -49760,75 +50371,474 @@ function registerCalendarTools(server, client2) {
 }
 
 // src/tools/expenses.ts
-function registerExpenseTools(server, client2) {
-  const allowWrites = getWriteMode() === "all";
-  server.registerTool("ofw_get_expense_totals", {
+var UploadedExpenseFileSchema = external_exports.looseObject({
+  fileId: external_exports.number(),
+  fileName: external_exports.string().optional(),
+  label: external_exports.string().optional(),
+  fileType: external_exports.string().optional(),
+  sizeInBytes: external_exports.number().optional(),
+  shareClass: external_exports.string().optional()
+});
+var PDF_MIME = "application/pdf";
+var MAX_REMOTE_PDF_BYTES = MAX_UPLOAD_BYTES;
+var MAX_REMOTE_REDIRECTS = 5;
+var REMOTE_FETCH_TIMEOUT_MS = 3e4;
+function isPdf(bytes) {
+  return bytes.byteLength >= 5 && bytes[0] === 37 && bytes[1] === 80 && bytes[2] === 68 && bytes[3] === 70 && bytes[4] === 45;
+}
+function assertReceiptUrl(url2) {
+  if (url2.protocol !== "https:") {
+    throw new Error("Remote expense receipt URLs must use HTTPS.");
+  }
+  if (!url2.hostname.toLowerCase().endsWith(".oaiusercontent.com")) {
+    throw new Error("Remote expense receipt URLs must be signed oaiusercontent.com file URLs.");
+  }
+}
+async function readCapped(response, cap) {
+  const tooLarge = () => new Error(`Expense receipt exceeds ${cap} bytes.`);
+  const declared = Number(response.headers.get("content-length") ?? 0);
+  if (Number.isFinite(declared) && declared > cap) throw tooLarge();
+  const chunks = [];
+  let total = 0;
+  if (response.body) {
+    const reader = response.body.getReader();
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > cap) {
+        await reader.cancel();
+        throw tooLarge();
+      }
+      chunks.push(value);
+    }
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk2 of chunks) {
+    bytes.set(chunk2, offset);
+    offset += chunk2.byteLength;
+  }
+  return bytes;
+}
+async function resolveRemotePdf(urlValue, fileNameValue) {
+  const fileName = fileNameValue?.trim() || "receipt.pdf";
+  if (!fileName.toLowerCase().endsWith(".pdf")) {
+    throw new Error(`Expense receipts must use a .pdf filename; received ${fileName}`);
+  }
+  let url2 = new URL(urlValue);
+  let response;
+  for (let hop = 0; ; hop++) {
+    assertReceiptUrl(url2);
+    response = await fetch(url2, { redirect: "manual", signal: AbortSignal.timeout(REMOTE_FETCH_TIMEOUT_MS) });
+    const location = response.headers.get("location");
+    if (response.status < 300 || response.status >= 400 || location === null) break;
+    if (hop >= MAX_REMOTE_REDIRECTS) {
+      throw new Error(`Remote expense receipt redirected more than ${MAX_REMOTE_REDIRECTS} times.`);
+    }
+    url2 = new URL(location, url2);
+  }
+  if (!response.ok) {
+    throw new Error(`Unable to fetch remote expense receipt: HTTP ${response.status}`);
+  }
+  const bytes = await readCapped(response, MAX_REMOTE_PDF_BYTES);
+  if (!isPdf(bytes)) {
+    throw new Error("Remote expense receipt is not a valid PDF file.");
+  }
+  return {
+    blob: new Blob([bytes], { type: PDF_MIME }),
+    fileName,
+    mimeType: PDF_MIME,
+    sizeBytes: bytes.byteLength
+  };
+}
+function expenseParties(args) {
+  return {
+    payerUserId: args.payerId,
+    categoryId: args.categoryId,
+    childUserIds: args.children,
+    idsNote: "payerUserId is the parent this claim is billed to; confirm it names the right parent before approving (ofw_get_profile, where registered, or the OFW web app). categoryId is from ofw_list_expense_categories."
+  };
+}
+var EXPENSE_FIELDS = [
+  "title",
+  "amount",
+  "purchaseDate",
+  "categoryId",
+  "payerId",
+  "children",
+  "isPrivate",
+  "description",
+  "fileIds"
+];
+var ARG_FOR = {
+  title: "title",
+  amount: "amount",
+  purchaseDate: "purchaseDate",
+  categoryId: "categoryId",
+  payerId: "payerId",
+  children: "children",
+  isPrivate: "privateExpense",
+  description: "description",
+  fileIds: "receiptFileId"
+};
+var isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var positiveInt = (v) => typeof v === "number" && Number.isInteger(v) && v > 0 ? v : void 0;
+var refId = (v, key) => positiveInt(v) ?? (isRecord2(v) ? positiveInt(v[key]) ?? positiveInt(v.id) : void 0);
+var idList = (v, key) => {
+  if (!Array.isArray(v)) return void 0;
+  const ids = v.map((x) => refId(x, key));
+  return ids.every((id) => id !== void 0) ? ids : void 0;
+};
+function readExpenseState(raw) {
+  const d = isRecord2(raw) && isRecord2(raw.data) ? raw.data : raw;
+  if (!isRecord2(d)) return {};
+  const out = {};
+  if (typeof d.title === "string" && d.title.trim()) out.title = d.title;
+  const amount = typeof d.amount === "string" ? Number(d.amount) : d.amount;
+  if (typeof amount === "number" && Number.isFinite(amount) && amount > 0) out.amount = amount;
+  const dateRaw = isRecord2(d.purchaseDate) ? d.purchaseDate.dateTime : d.purchaseDate;
+  if (typeof dateRaw === "string" && /^\d{4}-\d{2}-\d{2}/.test(dateRaw)) out.purchaseDate = dateRaw.slice(0, 10);
+  const categoryId = positiveInt(d.categoryId) ?? (isRecord2(d.category) ? positiveInt(d.category.id) : void 0);
+  if (categoryId !== void 0) out.categoryId = categoryId;
+  const payerId = positiveInt(d.payerId) ?? refId(d.payer, "userId");
+  if (payerId !== void 0) out.payerId = payerId;
+  const children = idList(d.children, "userId");
+  if (children !== void 0 && children.length > 0) out.children = children;
+  const isPrivate = typeof d.isPrivate === "boolean" ? d.isPrivate : d.private;
+  if (typeof isPrivate === "boolean") out.isPrivate = isPrivate;
+  if ("description" in d) {
+    if (d.description === null || d.description === "") out.description = null;
+    else if (typeof d.description === "string") out.description = d.description;
+  }
+  for (const key of ["fileIds", "files"]) {
+    if (!(key in d)) continue;
+    const ids = d[key] === null ? [] : idList(d[key], "fileId");
+    if (ids !== void 0) out.fileIds = ids;
+    break;
+  }
+  return out;
+}
+function registerExpenseTools(server, client2, attachmentIO) {
+  const writeMode = getWriteMode();
+  const uploadOnly = getExpenseUploadOnly();
+  const checkIn = uploadOnly ? "the Expenses log on ourfamilywizard.com (ofw_list_expenses is not available in this deployment)" : "ofw_list_expenses";
+  const allowWrites = writeMode === "all";
+  const allowReceiptUploads = allowWrites && attachmentIO !== void 0;
+  if (!uploadOnly) server.registerTool("ofw_get_expense_totals", {
     description: "Get OurFamilyWizard expense summary totals (owed/paid)",
     annotations: { readOnlyHint: true }
   }, async () => {
     const data = await client2.request("GET", "/pub/v2/expense/expenses/totals");
     return jsonResponse(data);
   });
-  server.registerTool("ofw_list_expenses", {
-    description: "List OurFamilyWizard expenses. Offset-paged via start/max. The response leads with its paging state \u2014 `hasMore` and `nextStart` (null when the list is exhausted) \u2014 BEFORE the records, so a truncated or partially-read response still says whether more remain. Never state an expense total or an absence from one page.",
+  if (!uploadOnly) server.registerTool("ofw_list_expense_categories", {
+    description: "List OurFamilyWizard expense categories, including preset and custom categories with their responsibility split metadata. Read-only.",
+    annotations: { readOnlyHint: true }
+  }, async () => {
+    const data = await client2.request("GET", "/pub/v2/expense/categories");
+    return jsonResponse(data);
+  });
+  if (!uploadOnly) server.registerTool("ofw_list_expenses", {
+    description: "List OurFamilyWizard expenses. OFW pages this endpoint with 1-based page/size parameters; its older start/max parameters are ignored and repeatedly return page 1. The response leads with hasMore and nextPage (null when exhausted) before the records. Continue by passing nextPage.",
     annotations: { readOnlyHint: true },
     inputSchema: external_exports.object({
-      start: external_exports.number().int().min(0).describe("Start offset, 0-based (default 0). To continue a listing, pass the `nextStart` from the previous response.").optional(),
-      max: external_exports.number().int().min(1).describe("Max results (default 20)").optional()
+      page: external_exports.number().int().min(1).describe("1-based page number (default 1). To continue, pass the nextPage returned by the previous response.").optional(),
+      size: external_exports.number().int().min(1).max(100).describe("Requested page size (default 20). OFW may cap or normalize this value.").optional()
     })
   }, async (args) => {
-    const start = args.start ?? 0;
-    const max = args.max ?? 20;
-    const data = await client2.request("GET", `/pub/v2/expense/expenses?start=${start}&max=${max}`);
+    const page = args.page ?? 1;
+    const size = args.size ?? 20;
+    const data = await client2.request("GET", `/pub/v2/expense/expenses?page=${page}&size=${size}`);
     const { returned, total, last } = readUpstreamPaging(data);
-    const wrapped = withPaginationFirst({
-      state: offsetState({ start, max, returned, total, last, base: 0 }),
-      start,
-      max,
+    const body = typeof data === "object" && data !== null && !Array.isArray(data) ? data : null;
+    if (body === null) return jsonResponse(data);
+    const metadata = typeof body.metadata === "object" && body.metadata !== null && !Array.isArray(body.metadata) ? body.metadata : null;
+    const upstreamPage = metadata !== null && typeof metadata.currentPage === "number" ? metadata.currentPage : metadata !== null && typeof metadata.page === "number" ? metadata.page : page;
+    const upstreamSize = metadata !== null && typeof metadata.perPage === "number" ? metadata.perPage : size;
+    const hasMore = last !== null ? !last : total !== null ? upstreamPage * upstreamSize < total : returned >= upstreamSize;
+    const nextPage = hasMore ? upstreamPage + 1 : null;
+    const scope = total !== null ? ` of ${total}` : "";
+    const head = {
+      hasMore,
+      nextPage,
+      page: upstreamPage,
+      size: upstreamSize,
       returned,
-      total,
-      hint: `Re-call ofw_list_expenses with start:${start + max}.`,
-      payload: data
+      ...total !== null ? { total } : {},
+      paginationNote: hasMore ? `PARTIAL: this response holds ${returned} record(s) on page ${upstreamPage}${scope}. Re-call ofw_list_expenses with page:${nextPage}. Do not state a total or an absence from this response alone.` : `This response reaches the end of the expense list${scope === "" ? "" : ` (${total} record(s) in total)`}.`
+    };
+    return jsonResponse({ ...head, ...body, ...head });
+  });
+  if (allowReceiptUploads) server.registerTool("ofw_upload_expense_pdf", {
+    description: "Upload a PDF to OurFamilyWizard My Files for later attachment to an expense. Accepts either a local path or a signed ChatGPT/oaiusercontent HTTPS URL plus fileName. Exactly one of path or url must be supplied. This tool accepts PDF files only and uploads them using the same SHARED file metadata as the OFW expense form so the returned fileId can be attached to an expense. A SHARED file is visible to the co-parent in My Files immediately, whatever the visibility of the expense it is later attached to (that is set separately by ofw_create_expense privateExpense). " + CONFIRM_NOTE,
+    annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    inputSchema: external_exports.object({
+      path: external_exports.string().describe("Path to a local PDF file inside the upload directory (OFW_UPLOAD_DIR). Tilde (~) is expanded by the configured attachment I/O implementation. Mutually exclusive with url.").optional(),
+      url: external_exports.string().describe("Signed HTTPS oaiusercontent.com URL for a PDF supplied by the ChatGPT host. Mutually exclusive with path.").optional(),
+      fileName: external_exports.string().describe("Filename to use for a remote URL upload. Must end in .pdf. Defaults to receipt.pdf.").optional(),
+      label: external_exports.string().describe("Display label for the file in OFW (default: filename)").optional(),
+      description: external_exports.string().describe("Description shown in OFW My Files (default: filename)").optional(),
+      confirmToken: confirmTokenParam
+    })
+  }, async (args, ctx) => {
+    const io = attachmentIO;
+    if ((args.path ? 1 : 0) + (args.url ? 1 : 0) !== 1) {
+      throw new Error("Pass exactly one of path or url to ofw_upload_expense_pdf.");
+    }
+    const { blob, fileName, mimeType, sizeBytes } = args.url ? await resolveRemotePdf(args.url, args.fileName) : await io.resolveUpload(args.path);
+    if (!fileName.toLowerCase().endsWith(".pdf") || mimeType !== PDF_MIME) {
+      throw new Error(`Expense receipts must be PDF files; received ${fileName} (${mimeType})`);
+    }
+    const bytes = new Uint8Array(await blob.arrayBuffer());
+    if (!isPdf(bytes)) {
+      throw new Error(`Expense receipts must be PDF files; ${fileName} does not start with a PDF header.`);
+    }
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+    const sha2562 = Array.from(digest, (b) => b.toString(16).padStart(2, "0")).join("");
+    const label = args.label ?? fileName;
+    const description = args.description ?? fileName;
+    const gate = await confirmWrite(ctx, {
+      tool: "ofw_upload_expense_pdf",
+      action: "ofw.file.share",
+      message: `Review and confirm uploading the receipt "${fileName}" to OurFamilyWizard. It is uploaded SHARED, so the co-parent can see it in My Files immediately \u2014 even if the expense it is attached to is private.`,
+      target: `file:${fileName}`,
+      payload: { fileName, sizeBytes, sha256: sha2562, label, description, shareClass: "SHARED", source: "expense" },
+      preview: {
+        action: "Upload and SHARE an expense receipt on OurFamilyWizard",
+        fileName,
+        sizeBytes,
+        mimeType,
+        label,
+        description,
+        shareClass: "SHARED",
+        from: args.url ? `hosted file (${new URL(args.url).hostname})` : "local file",
+        warning: "Visible to the co-parent immediately in My Files, whatever the visibility of the expense it is attached to; the file becomes part of the court-visible record."
+      },
+      confirmToken: args.confirmToken
+    });
+    if (gate) return gate;
+    const form = new FormData();
+    form.append("file", blob, fileName);
+    form.append("source", "expense");
+    form.append("description", args.description ?? fileName);
+    form.append("label", args.label ?? fileName);
+    form.append("fileName", fileName);
+    form.append("shared", "true");
+    form.append("shareClass", "SHARED");
+    const meta3 = parseLenient(
+      UploadedExpenseFileSchema,
+      await client2.request("POST", "/pub/v3/myfiles/multipart", form),
+      { label: "ofw-mcp", context: "POST /pub/v3/myfiles/multipart (ofw_upload_expense_pdf)", mode: "strict" }
+    );
+    return jsonResponse({
+      fileId: meta3.fileId,
+      fileName: meta3.fileName ?? fileName,
+      mimeType: meta3.fileType ?? mimeType,
+      sizeBytes: meta3.sizeInBytes ?? sizeBytes,
+      shareClass: meta3.shareClass ?? "SHARED",
+      note: "Pass fileId to ofw_create_expense as receiptFileId. Expense visibility is controlled separately by privateExpense."
+    });
+  });
+  if (allowWrites) server.registerTool("ofw_update_expense", {
+    description: `Change an existing OurFamilyWizard expense. Pass expenseId plus ONLY the fields you want to change; every field you omit keeps its current value. The tool reads the expense from OFW first and sends the merged result, because OFW's update replaces the whole expense and a field left out would otherwise be erased. If a field you did not pass cannot be read back from OFW, the update is refused as EXPENSE_FIELDS_UNREADABLE and names the field; pass it explicitly (description:null or receiptFileId:null to send none). receiptFileId REPLACES all current receipts; omit it to keep them. Set privateExpense=false to publish a private expense to the co-parent. The confirmation is bound to the expense exactly as read, so if it changes on OFW in between, the update is refused instead of overwriting that change. If the request fails without a definitive answer the result is EXPENSE_UNCONFIRMED: the update may already have been applied, so check ${checkIn} before retrying. ` + CONFIRM_NOTE,
+    annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+    inputSchema: external_exports.object({
+      expenseId: external_exports.number().int().positive().describe("Existing OFW expense entity id"),
+      title: external_exports.string().trim().min(1).describe("New title (omit to keep)").optional(),
+      amount: external_exports.number().positive().describe("New full expense amount (omit to keep)").optional(),
+      purchaseDate: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("New expense date, YYYY-MM-DD (omit to keep)").optional(),
+      categoryId: external_exports.number().int().positive().describe("New OFW expense category id (omit to keep)").optional(),
+      payerId: external_exports.number().int().positive().describe("New payer: the userId of the parent who owes (omit to keep)").optional(),
+      children: external_exports.array(external_exports.number().int().positive()).min(1).describe("New child userIds, replacing the current list (omit to keep)").optional(),
+      description: external_exports.string().trim().min(1).nullable().describe("New description; null removes it (omit to keep)").optional(),
+      privateExpense: external_exports.boolean().describe("true = visible only to you; false = shared with the co-parent (omit to keep)").optional(),
+      receiptFileId: external_exports.number().int().positive().nullable().describe("Receipt fileId that REPLACES all current receipts; null removes them (omit to keep)").optional(),
+      confirmToken: confirmTokenParam
+    })
+  }, async (args, ctx) => {
+    const { expenseId, confirmToken } = args;
+    const path = `/pub/v2/expense/expenses/${expenseId}`;
+    const supplied = {};
+    if (args.title !== void 0) supplied.title = args.title;
+    if (args.amount !== void 0) supplied.amount = args.amount;
+    if (args.purchaseDate !== void 0) supplied.purchaseDate = args.purchaseDate;
+    if (args.categoryId !== void 0) supplied.categoryId = args.categoryId;
+    if (args.payerId !== void 0) supplied.payerId = args.payerId;
+    if (args.children !== void 0) supplied.children = args.children;
+    if (args.privateExpense !== void 0) supplied.isPrivate = args.privateExpense;
+    if (args.description !== void 0) supplied.description = args.description;
+    if (args.receiptFileId !== void 0) supplied.fileIds = args.receiptFileId === null ? [] : [args.receiptFileId];
+    if (Object.keys(supplied).length === 0) {
+      return jsonErrorResponse({
+        result: "NO_CHANGES",
+        expenseId,
+        remedy: "Pass the fields to change alongside expenseId (for example privateExpense:false to publish it). Nothing was sent."
+      });
+    }
+    let current = {};
+    let readError;
+    try {
+      const raw = await client2.request("GET", path);
+      current = readExpenseState(parseLenient(external_exports.looseObject({}), raw, { label: "ofw-mcp", context: `GET ${path}` }));
+    } catch (e) {
+      readError = e instanceof Error ? e.message : String(e);
+    }
+    const merged = { ...current, ...supplied };
+    const missing = EXPENSE_FIELDS.filter((f) => merged[f] === void 0);
+    if (missing.length > 0) {
+      return jsonErrorResponse({
+        result: "EXPENSE_FIELDS_UNREADABLE",
+        expenseId,
+        missing: missing.map((f) => ARG_FOR[f]),
+        reason: readError !== void 0 ? `Could not read expense ${expenseId} from OFW (${readError}), so the fields you did not pass have no known value.` : `OFW's copy of expense ${expenseId} did not include a readable value for these fields.`,
+        remedy: `OFW replaces the whole expense on update, so sending without these would erase them. Pass them explicitly (description:null or receiptFileId:null if the expense should have none). Nothing was sent.`
+      });
+    }
+    const next = merged;
+    const payload = {
+      title: next.title,
+      amount: next.amount,
+      purchaseDate: next.purchaseDate,
+      categoryId: next.categoryId,
+      payerId: next.payerId,
+      children: next.children,
+      isPrivate: next.isPrivate
+    };
+    if (next.description !== null) payload.description = next.description;
+    if (next.fileIds.length > 0) payload.fileIds = next.fileIds;
+    const changes = {};
+    for (const f of Object.keys(supplied)) {
+      const from = current[f];
+      if (JSON.stringify(from) !== JSON.stringify(next[f])) {
+        changes[ARG_FOR[f]] = { from: from === void 0 ? "unknown (not readable from OFW)" : from, to: next[f] };
+      }
+    }
+    const baseRead = readError === void 0;
+    if (baseRead && Object.keys(changes).length === 0) {
+      return jsonErrorResponse({
+        result: "NO_CHANGES",
+        expenseId,
+        remedy: "Every field you passed already has that value on OFW, so there is nothing to update. Nothing was sent."
+      });
+    }
+    const gate = await confirmWrite(ctx, {
+      tool: "ofw_update_expense",
+      action: "ofw.expense.update",
+      message: next.isPrivate ? `Review and confirm this update to the private OurFamilyWizard expense "${next.title}".` : `Review and confirm this update to the OurFamilyWizard expense "${next.title}". The expense will be SHARED: it appears in the ledger the co-parent sees immediately, and cannot be deleted through this server.`,
+      target: `expense:${expenseId}`,
+      ...baseRead ? { revision: stateRevision(current) } : {},
+      payload,
+      preview: {
+        action: next.isPrivate ? "Update private OurFamilyWizard expense" : "Update shared OurFamilyWizard expense",
+        expenseId,
+        changes,
+        after: {
+          title: next.title,
+          amount: next.amount,
+          purchaseDate: next.purchaseDate,
+          ...expenseParties(next),
+          description: next.description,
+          visibility: next.isPrivate ? "private (only you)" : "shared with the co-parent",
+          receiptFileIds: next.fileIds
+        },
+        ...baseRead ? {} : { baseNote: `The current expense could not be read from OFW (${readError}); every field comes from this call, and nothing is carried over.` },
+        ...next.isPrivate ? {} : { warning: "Visible to the co-parent immediately as a claim in the shared expense ledger; part of the court-visible record." }
+      },
+      confirmToken
+    });
+    if (gate) return gate;
+    let data;
+    try {
+      data = await requestWrite(client2, "PUT", path, payload);
+    } catch (e) {
+      if (!(e instanceof UnconfirmedWriteError)) throw e;
+      return unconfirmedWriteResponse(e, {
+        result: "EXPENSE_UNCONFIRMED",
+        what: `update expense ${expenseId}`,
+        checkWith: `${checkIn} (compare this expense against the values you sent)`
+      });
+    }
+    const warnings = [];
+    try {
+      const after = readExpenseState(await client2.request("GET", path));
+      for (const f of EXPENSE_FIELDS) {
+        if (after[f] !== void 0 && JSON.stringify(after[f]) !== JSON.stringify(next[f])) {
+          warnings.push(`OFW reports ${ARG_FOR[f]} as ${JSON.stringify(after[f])} after the update, not the ${JSON.stringify(next[f])} that was sent.`);
+        }
+      }
+    } catch (e) {
+      warnings.push(`The update was accepted but could not be read back to verify it (${e instanceof Error ? e.message : String(e)}); check ${checkIn}.`);
+    }
+    return jsonResponse({
+      result: "EXPENSE_UPDATED",
+      expenseId,
+      changed: Object.keys(changes),
+      kept: EXPENSE_FIELDS.filter((f) => supplied[f] === void 0).map((f) => ARG_FOR[f]),
+      ...warnings.length > 0 ? { warnings } : {},
+      response: data
     });
-    return jsonResponse(wrapped ?? data);
   });
   if (allowWrites) server.registerTool("ofw_create_expense", {
-    description: "Log a new expense in OurFamilyWizard. The expense is a money claim that appears in the shared ledger in front of the co-parent immediately, and this server cannot delete it. If the request fails without a definitive answer the result is EXPENSE_UNCONFIRMED: the expense may already exist, so do NOT retry until ofw_list_expenses shows it did not land. " + CONFIRM_NOTE,
-    // Not a harmless local write: the claim is co-parent-visible at once and
-    // this server has no way to take it back. destructiveHint keeps a host
+    description: `Log a new expense in OurFamilyWizard using the current web-app expense contract. Required fields are title, amount, purchaseDate, categoryId, payerId (the parent who owes), and at least one child user id. Supports one previously-uploaded receipt PDF and private entries. privateExpense=true creates an expense visible only to you; false/default creates the normal shared expense. receiptFileId should come from ofw_upload_expense_pdf. A shared expense is a money claim that appears in the ledger in front of the co-parent immediately, and this server cannot delete it. If the request fails without a definitive answer the result is EXPENSE_UNCONFIRMED: the expense may already exist, so do NOT retry until ${checkIn} shows it did not land. ` + CONFIRM_NOTE,
+    // Not a harmless local write: a shared claim is co-parent-visible at once
+    // and this server has no way to take it back. destructiveHint keeps a host
     // that auto-approves "non-destructive" tools from running it silently.
     annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     inputSchema: external_exports.object({
-      amount: external_exports.number().describe("Expense amount"),
-      description: external_exports.string().describe("Expense description"),
+      title: external_exports.string().trim().min(1).describe("Expense title/name shown in the OFW expense log"),
+      amount: external_exports.number().positive().describe("Full expense amount before OFW applies the category split"),
+      purchaseDate: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("Date the expense was incurred, YYYY-MM-DD"),
+      categoryId: external_exports.number().int().positive().describe("OFW expense category id (for example General is commonly id 1; use the id from OFW, not the category display name)"),
+      payerId: external_exports.number().int().positive().describe("OFW userId of the parent who owes/reimburses this expense"),
+      children: external_exports.array(external_exports.number().int().positive()).min(1).describe("One or more OFW child userIds associated with the expense"),
+      description: external_exports.string().trim().min(1).describe("Optional supporting description/details for the expense").optional(),
+      privateExpense: external_exports.boolean().describe("true = visible only to you; false/default = shared with co-parent").optional(),
+      receiptFileId: external_exports.number().int().positive().describe("Single OFW My Files fileId to attach as the receipt, normally returned by ofw_upload_expense_pdf").optional(),
       confirmToken: confirmTokenParam
     })
   }, async (args, ctx) => {
-    const { confirmToken, ...payload } = args;
+    const payload = {
+      title: args.title,
+      amount: args.amount,
+      purchaseDate: args.purchaseDate,
+      categoryId: args.categoryId,
+      payerId: args.payerId,
+      children: args.children
+    };
+    if (args.description !== void 0) payload.description = args.description;
+    if (args.privateExpense !== void 0) payload.isPrivate = args.privateExpense;
+    if (args.receiptFileId !== void 0) payload.fileIds = [args.receiptFileId];
+    const isPrivate = args.privateExpense === true;
     const gate = await confirmWrite(ctx, {
       tool: "ofw_create_expense",
       action: "ofw.expense.create",
-      message: "Review and confirm this OurFamilyWizard expense. It is logged in the shared ledger the co-parent sees immediately, and cannot be deleted through this server.",
+      message: isPrivate ? "Review and confirm this private OurFamilyWizard expense (visible only to you)." : "Review and confirm this OurFamilyWizard expense. It is logged in the shared ledger the co-parent sees immediately, and cannot be deleted through this server.",
       target: "expense:new",
       payload,
       preview: {
-        action: "Log OurFamilyWizard expense",
-        amount: payload.amount,
-        description: payload.description,
-        warning: "Visible to the co-parent immediately as a claim in the shared expense ledger; part of the court-visible record."
+        action: isPrivate ? "Log private OurFamilyWizard expense" : "Log OurFamilyWizard expense",
+        title: args.title,
+        amount: args.amount,
+        purchaseDate: args.purchaseDate,
+        ...expenseParties(args),
+        ...args.description !== void 0 ? { description: args.description } : {},
+        visibility: isPrivate ? "private (only you)" : "shared with the co-parent",
+        ...args.receiptFileId !== void 0 ? { receiptFileId: args.receiptFileId } : {},
+        ...isPrivate ? {} : { warning: "Visible to the co-parent immediately as a claim in the shared expense ledger; part of the court-visible record." }
       },
-      confirmToken
+      confirmToken: args.confirmToken
     });
     if (gate) return gate;
     let data;
     try {
-      data = await requestWrite(client2, "POST", "/pub/v2/expense/expenses", payload);
+      data = await requestWrite(client2, "POST", "/pub/v2/expense", payload);
     } catch (e) {
       if (!(e instanceof UnconfirmedWriteError)) throw e;
       return unconfirmedWriteResponse(e, {
         result: "EXPENSE_UNCONFIRMED",
         what: "log this expense",
-        checkWith: "ofw_list_expenses (look for this amount and description among the newest expenses)"
+        checkWith: `${checkIn} (look for this title and amount among the newest expenses)`
       });
     }
     return jsonResponse(data);
@@ -50499,6 +51509,12 @@ var OFWCache = class _OFWCache extends LocalCacheStore {
   }
 };
 
+// src/tool-surface.ts
+function selectToolRegistrars(r) {
+  if (getExpenseOnly()) return [r.healthcheck, r.expenses];
+  return [r.healthcheck, r.user, r.messages, r.calendar, r.expenses, r.journal];
+}
+
 // src/index.ts
 var originalEmit = process.emit.bind(process);
 process.emit = function(event, ...args) {
@@ -50513,24 +51529,27 @@ process.emit = function(event, ...args) {
 var nodeCache;
 var nodeCacheProvider = () => nodeCache ??= OFWCache.open(getCacheDbPath());
 var nodeAttachmentIO = new NodeAttachmentIO();
+var expenseRegistrar = (server, deps) => registerExpenseTools(server, deps, nodeAttachmentIO);
+var messageRegistrar = (server, deps) => registerMessageTools(server, deps, nodeCacheProvider, nodeAttachmentIO);
+var tools = selectToolRegistrars({
+  healthcheck: registerHealthcheckTools,
+  user: registerUserTools,
+  messages: messageRegistrar,
+  calendar: registerCalendarTools,
+  expenses: expenseRegistrar,
+  journal: registerJournalTools
+});
 await runMcp({
   name: "ofw",
-  version: "2.19.4",
+  version: "2.20.0",
   // x-release-please-version
   deps: client,
-  tools: [
-    registerHealthcheckTools,
-    registerUserTools,
-    (server, deps) => registerMessageTools(server, deps, nodeCacheProvider, nodeAttachmentIO),
-    registerCalendarTools,
-    registerExpenseTools,
-    registerJournalTools
-  ],
+  tools,
   banner: "[ofw-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion."
 });
 /*! Bundled license information:
 
-@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs:
+@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson