untappd-mcp 2.1.1 → 2.1.3

package/dist/bundle.js

@@ -1585,8 +1585,8 @@ var require_regexes = __commonJS({
     }
     exports.ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
     exports.ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-    var mac3 = (delimiter) => {
-      const escapedDelim = util.escapeRegex(delimiter ?? ":");
+    var mac3 = (delimiter2) => {
+      const escapedDelim = util.escapeRegex(delimiter2 ?? ":");
       return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
     };
     exports.mac = mac3;
@@ -2282,7 +2282,7 @@ var require_versions = __commonJS({
     exports.version = {
       major: 4,
       minor: 6,
-      patch: 4
+      patch: 5
     };
     (function() {
       var keys = Object.getOwnPropertyNames(exports);
@@ -4851,7 +4851,7 @@ var require_memoizer = __commonJS({
     var NONE2 = 0;
     var ASSUMED2 = 1;
     var PROVEN2 = 2;
-    function isRecursive2(inst, stack, resolve) {
+    function isRecursive2(inst, stack, resolve3) {
       const cached2 = recursive2.get(inst);
       if (cached2 !== void 0)
         return cached2 ? PROVEN2 : NONE2;
@@ -4861,7 +4861,7 @@ var require_memoizer = __commonJS({
       let result = NONE2;
       const check2 = (child) => {
         if (result !== PROVEN2 && child?._zod) {
-          const answer = isRecursive2(child, stack, resolve);
+          const answer = isRecursive2(child, stack, resolve3);
           if (answer > result)
             result = answer;
         }
@@ -4872,7 +4872,7 @@ var require_memoizer = __commonJS({
           const desc = Object.getOwnPropertyDescriptor(sh, key);
           if (spread && !desc.enumerable)
             continue;
-          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve) : NONE2;
+          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve3) : NONE2;
           if (child > answer)
             answer = child;
         }
@@ -4936,7 +4936,7 @@ var require_memoizer = __commonJS({
           break;
         // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
         case "lazy": {
-          const inner = def._cachedInner ?? (resolve ? inst._zod.innerType : void 0);
+          const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
           merge2(inner ? isRecursive2(inner, stack, false) : ASSUMED2);
           break;
         }
@@ -5000,7 +5000,7 @@ var require_memoizer = __commonJS({
       return bucket;
     }
     var handoff2;
-    var open2 = [];
+    var open3 = [];
     var memo3 = {
       alloc(_inst, payload, empty) {
         const bucket = handoff2;
@@ -5009,7 +5009,7 @@ var require_memoizer = __commonJS({
         handoff2 = void 0;
         const entry = { value: empty, issues: null };
         bucket.set(payload.value, entry);
-        open2.push(entry);
+        open3.push(entry);
         return empty;
       },
       guard(inst) {
@@ -5080,10 +5080,10 @@ var require_memoizer = __commonJS({
               return payload;
             }
             handoff2 = bucket;
-            const depth = open2.length;
+            const depth = open3.length;
             const result = base(payload, ctx);
             handoff2 = void 0;
-            const entry = open2.length > depth ? open2.pop() : void 0;
+            const entry = open3.length > depth ? open3.pop() : void 0;
             if (result instanceof Promise) {
               return result.then((r) => {
                 if (entry)
@@ -27718,14 +27718,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve();
+      resolve3();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -28519,7 +28519,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve3, reject) => {
       const earlyReject = (error62) => {
         reject(error62);
       };
@@ -28587,7 +28587,7 @@ var Protocol = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve(manualInputRequiredValue(decoded));
+          if (options?.allowInputRequired === true) return resolve3(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -28599,11 +28599,11 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve(this._resolveNonCompleteResult(decoded, flow));
+          return resolve3(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve(parseResult.data);
+          if (parseResult.success) resolve3(parseResult.data);
           else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -31515,7 +31515,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve.call(this, root, ref);
+    let _sch = resolve3.call(this, root, ref);
     if (_sch === void 0) {
       const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
@@ -31541,7 +31541,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve(root, ref) {
+  function resolve3(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -31991,47 +31991,47 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     else if (typeof uri === "object") uri = parse3(serialize(uri, options), options);
     return uri;
   }
-  function resolve(baseURI, relativeURI, options) {
+  function resolve3(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
-  function resolveComponent(base, relative, options, skipNormalization) {
+  function resolveComponent(base, relative2, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
       base = parse3(serialize(base, options), options);
-      relative = parse3(serialize(relative, options), options);
+      relative2 = parse3(serialize(relative2, options), options);
     }
     options = options || {};
-    if (!options.tolerant && relative.scheme) {
-      target.scheme = relative.scheme;
-      target.userinfo = relative.userinfo;
-      target.host = relative.host;
-      target.port = relative.port;
-      target.path = removeDotSegments(relative.path || "");
-      target.query = relative.query;
+    if (!options.tolerant && relative2.scheme) {
+      target.scheme = relative2.scheme;
+      target.userinfo = relative2.userinfo;
+      target.host = relative2.host;
+      target.port = relative2.port;
+      target.path = removeDotSegments(relative2.path || "");
+      target.query = relative2.query;
     } else {
-      if (relative.userinfo !== void 0 || relative.host !== void 0 || relative.port !== void 0) {
-        target.userinfo = relative.userinfo;
-        target.host = relative.host;
-        target.port = relative.port;
-        target.path = removeDotSegments(relative.path || "");
-        target.query = relative.query;
+      if (relative2.userinfo !== void 0 || relative2.host !== void 0 || relative2.port !== void 0) {
+        target.userinfo = relative2.userinfo;
+        target.host = relative2.host;
+        target.port = relative2.port;
+        target.path = removeDotSegments(relative2.path || "");
+        target.query = relative2.query;
       } else {
-        if (!relative.path) {
+        if (!relative2.path) {
           target.path = base.path;
-          if (relative.query !== void 0) target.query = relative.query;
+          if (relative2.query !== void 0) target.query = relative2.query;
           else target.query = base.query;
         } else {
-          if (relative.path[0] === "/") target.path = removeDotSegments(relative.path);
+          if (relative2.path[0] === "/") target.path = removeDotSegments(relative2.path);
           else {
-            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative.path;
-            else if (!base.path) target.path = relative.path;
-            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
+            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative2.path;
+            else if (!base.path) target.path = relative2.path;
+            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative2.path;
             target.path = removeDotSegments(target.path);
           }
-          target.query = relative.query;
+          target.query = relative2.query;
         }
         target.userinfo = base.userinfo;
         target.host = base.host;
@@ -32039,7 +32039,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       }
       target.scheme = base.scheme;
     }
-    target.fragment = relative.fragment;
+    target.fragment = relative2.fragment;
     return target;
   }
   function equal(uriA, uriB, options) {
@@ -32165,7 +32165,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize,
-    resolve,
+    resolve: resolve3,
     resolveComponent,
     equal,
     serialize,
@@ -37538,7 +37538,7 @@ var StdioServerTransport = class {
   }
   send(message) {
     if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve3, reject) => {
       const json2 = serializeMessage(message);
       let settled = false;
       const onError = (error62) => {
@@ -37553,14 +37553,14 @@ var StdioServerTransport = class {
         settled = true;
         this._stdout.off("error", onError);
         this._stdout.off("drain", onDrain);
-        resolve();
+        resolve3();
       };
       this._stdout.once("error", onError);
       if (this._stdout.write(json2)) {
         if (settled) return;
         settled = true;
         this._stdout.off("error", onError);
-        resolve();
+        resolve3();
       } else if (!settled) this._stdout.once("drain", onDrain);
     });
   }
@@ -37614,14 +37614,14 @@ var StdioConnectionChannel = class {
   */
   async whenRequestsAnswered(timeoutMs) {
     if (this._closed || this._pendingRequests.size === 0) return true;
-    return await new Promise((resolve) => {
+    return await new Promise((resolve3) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve(true);
+        resolve3(true);
       };
       const timer = setTimeout(() => {
         this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-        resolve(false);
+        resolve3(false);
       }, timeoutMs);
       this._drainWaiters.push(waiter);
     });
@@ -38019,13 +38019,28 @@ var API_KEY_RE = new RegExp([
   "whsec_[A-Za-z0-9]{16,}\\b"
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
-var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var QUERY_SECRET_RE = /([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
+var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
+var HEADER_SECRET_RE = /(\b(?:x[-_][a-z0-9_-]*?(?:api[-_]?key|token|secret|auth)[a-z0-9_-]*|api[-_]?key)\s*:\s*)[^\s,;"'<>`]+/gi;
 var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
-var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
-var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
-var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
+var JSON_SECRET_KEYS = [
+  "(?:access|refresh|id|auth|session|bearer|csrf|xsrf)[_-]?token",
+  "client[_-]?secret",
+  "api[_-]?secret",
+  "(?:x[_-])?api[_-]?key",
+  "private[_-]?key",
+  "x[_-][a-z0-9_-]*?(?:api[_-]?key|token|secret|auth)[a-z0-9_-]*",
+  "(?:proxy-)?authorization",
+  "password",
+  "passwd",
+  "secret",
+  "token"
+].join("|");
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")(?:[^"\\\\]|\\\\.)*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')(?:[^'\\\\]|\\\\.)*(')`, "gi");
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
 }
 function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   const str2 = text === null || text === void 0 ? "" : String(text);
@@ -40037,8 +40052,8 @@ function emoji() {
 }
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-var mac = (delimiter) => {
-  const escapedDelim = escapeRegex(delimiter ?? ":");
+var mac = (delimiter2) => {
+  const escapedDelim = escapeRegex(delimiter2 ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -40630,7 +40645,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 4
+  patch: 5
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -43066,7 +43081,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve) {
+function isRecursive(inst, stack, resolve3) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -43076,7 +43091,7 @@ function isRecursive(inst, stack, resolve) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve);
+      const answer = isRecursive(child, stack, resolve3);
       if (answer > result)
         result = answer;
     }
@@ -43087,7 +43102,7 @@ function isRecursive(inst, stack, resolve) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -43151,7 +43166,7 @@ function isRecursive(inst, stack, resolve) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -57844,13 +57859,47 @@ async function createMcpServer(opts) {
   }
   return server;
 }
+var DEFAULT_SHUTDOWN_TIMEOUT_MS = 5e3;
+var DEFAULT_REPEAT_SIGNAL_GRACE_MS = 500;
 function withGracefulShutdown(target, opts = {}) {
   const shouldExit = opts.exit ?? true;
+  if (opts.timeoutMs !== void 0 && !(Number.isFinite(opts.timeoutMs) && opts.timeoutMs > 0)) {
+    throw new RangeError("withGracefulShutdown: timeoutMs must be a finite number greater than 0.");
+  }
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS;
+  if (opts.repeatSignalGraceMs !== void 0 && !(Number.isFinite(opts.repeatSignalGraceMs) && opts.repeatSignalGraceMs >= 0)) {
+    throw new RangeError("withGracefulShutdown: repeatSignalGraceMs must be a finite number >= 0.");
+  }
+  const repeatGraceMs = opts.repeatSignalGraceMs ?? DEFAULT_REPEAT_SIGNAL_GRACE_MS;
   let shuttingDown = false;
+  let firstSignalAt = 0;
+  let exited = false;
+  const exitOnce = () => {
+    if (exited)
+      return;
+    exited = true;
+    process.exit(0);
+  };
   const handler = (signal) => {
-    if (shuttingDown)
+    if (shuttingDown) {
+      if (Date.now() - firstSignalAt < repeatGraceMs)
+        return;
+      if (shouldExit) {
+        console.error(`[mcp-utils] second ${signal} during shutdown \u2014 exiting now`);
+        exitOnce();
+      }
       return;
+    }
     shuttingDown = true;
+    firstSignalAt = Date.now();
+    let timer;
+    if (shouldExit) {
+      timer = setTimeout(() => {
+        console.error(`[mcp-utils] graceful shutdown on ${signal} did not finish in ${timeoutMs}ms \u2014 exiting`);
+        exitOnce();
+      }, timeoutMs);
+      timer.unref?.();
+    }
     void (async () => {
       try {
         if (opts.onSignal)
@@ -57859,8 +57908,10 @@ function withGracefulShutdown(target, opts = {}) {
       } catch (err) {
         console.error(`[mcp-utils] error during graceful shutdown on ${signal}: ${err instanceof Error ? err.message : String(err)}`);
       } finally {
+        if (timer !== void 0)
+          clearTimeout(timer);
         if (shouldExit)
-          process.exit(0);
+          exitOnce();
       }
     })();
   };
@@ -57890,6 +57941,8 @@ function runMcp(opts) {
 }
 
 // node_modules/@chrischall/mcp-utils/dist/config/index.js
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
 var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
 function readEnvVar(key, opts = {}) {
   const env = opts.env ?? process.env;
@@ -57902,6 +57955,15 @@ function readEnvVar(key, opts = {}) {
   }
   return opts.default;
 }
+function expandPath(p) {
+  let expanded = p;
+  if (p === "~") {
+    expanded = homedir();
+  } else if (p.startsWith("~/")) {
+    expanded = join(homedir(), p.slice(2));
+  }
+  return isAbsolute(expanded) ? expanded : resolve(expanded);
+}
 async function loadDotenvSafely(opts = {}) {
   try {
     const mod = await import(
@@ -57921,10 +57983,67 @@ async function loadDotenvSafely(opts = {}) {
 
 // node_modules/@chrischall/mcp-utils/dist/fs/index.js
 import { openAsBlob } from "node:fs";
+import { open as open2 } from "node:fs/promises";
+
+// node_modules/@chrischall/mcp-utils/dist/fs/confine.js
+import { existsSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "node:path";
+function isInside(root, target) {
+  const rel = relative(root, target);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute2(rel);
+}
+function realPathAllowingMissing(p) {
+  const abs = resolve2(p);
+  let existing = abs;
+  const tail = [];
+  while (!existsSync(existing)) {
+    const parent = dirname(existing);
+    if (parent === existing)
+      break;
+    tail.unshift(existing.slice(parent.length).replace(/^[/\\]+/, ""));
+    existing = parent;
+  }
+  let real;
+  try {
+    real = realpathSync(existing);
+  } catch {
+    real = existing;
+  }
+  return tail.length > 0 ? resolve2(real, ...tail) : real;
+}
+function assertPathWithinRoots(path, roots) {
+  const target = realPathAllowingMissing(expandPath(path));
+  for (const root of roots) {
+    if (isInside(realPathAllowingMissing(expandPath(root)), target))
+      return target;
+  }
+  throw new Error(`Path is outside the allowed directories: ${path}`);
+}
+
+// node_modules/@chrischall/mcp-utils/dist/fs/output.js
+function sniffMimeBytes(bytes) {
+  const buf = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (buf.length >= 8 && buf.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) {
+    return "image/png";
+  }
+  if (buf.length >= 3 && buf[0] === 255 && buf[1] === 216 && buf[2] === 255) {
+    return "image/jpeg";
+  }
+  if (buf.length >= 12 && buf.subarray(0, 4).toString("latin1") === "RIFF" && buf.subarray(8, 12).toString("latin1") === "WEBP") {
+    return "image/webp";
+  }
+  if (buf.length >= 4 && buf.subarray(0, 4).toString("latin1") === "GIF8") {
+    return "image/gif";
+  }
+  return void 0;
+}
+
+// node_modules/@chrischall/mcp-utils/dist/fs/index.js
 async function fileBlob(path, opts = {}) {
+  const target = opts.allowedRoots ? assertPathWithinRoots(path, opts.allowedRoots) : path;
   let blob;
   try {
-    blob = await openAsBlob(path, opts.type !== void 0 ? { type: opts.type } : void 0);
+    blob = await openAsBlob(target, opts.type !== void 0 ? { type: opts.type } : void 0);
   } catch {
     throw new Error(`Cannot read file for upload: ${path}`);
   }
@@ -57933,6 +58052,22 @@ async function fileBlob(path, opts = {}) {
   }
   return blob;
 }
+async function readFileHead(path, bytes, opts = {}) {
+  const target = opts.allowedRoots ? assertPathWithinRoots(path, opts.allowedRoots) : path;
+  let fh;
+  try {
+    fh = await open2(target, "r");
+  } catch {
+    throw new Error(`Cannot read file: ${path}`);
+  }
+  try {
+    const buf = Buffer.alloc(bytes);
+    const { bytesRead } = await fh.read(buf, 0, bytes, 0);
+    return buf.subarray(0, bytesRead);
+  } finally {
+    await fh.close();
+  }
+}
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
 function buildQueryString(params) {
@@ -57978,9 +58113,12 @@ var pageSchema = {
   page_size: external_exports.number().int().min(1).max(200).default(50).describe("Number of items per page (1-200).")
 };
 function toolAnnotations(opts = {}) {
+  if (opts.readOnly === true && opts.destructive === true) {
+    throw new Error("toolAnnotations: readOnly: true contradicts destructive: true \u2014 a destructive tool is not read-only.");
+  }
   return {
     ...opts.title !== void 0 ? { title: opts.title } : {},
-    readOnlyHint: opts.readOnly ?? true,
+    readOnlyHint: opts.readOnly ?? opts.destructive === void 0,
     ...opts.idempotent !== void 0 ? { idempotentHint: opts.idempotent } : {},
     ...opts.destructive !== void 0 ? { destructiveHint: opts.destructive } : {},
     ...opts.openWorld !== void 0 ? { openWorldHint: opts.openWorld } : {}
@@ -57988,14 +58126,14 @@ function toolAnnotations(opts = {}) {
 }
 
 // src/version.ts
-var VERSION = "2.1.1";
+var VERSION = "2.1.3";
 
 // src/client.ts
-import { dirname, join } from "path";
+import { dirname as dirname2, join as join2 } from "path";
 import { fileURLToPath } from "url";
 if (import.meta.url) {
-  const __dirname = dirname(fileURLToPath(import.meta.url));
-  await loadDotenvSafely({ path: join(__dirname, "..", ".env"), override: false });
+  const __dirname = dirname2(fileURLToPath(import.meta.url));
+  await loadDotenvSafely({ path: join2(__dirname, "..", ".env"), override: false });
 }
 var BASE_URL = "https://api.untappd.com/v4";
 var SERVICE = "Untappd";
@@ -58495,7 +58633,9 @@ var SCHEMA_STATEMENTS = [
      beers_offset       INTEGER,
      beers_total        INTEGER,
      beers_complete     INTEGER NOT NULL DEFAULT 0,
-     served_backfill_last INTEGER NOT NULL DEFAULT 0
+     served_backfill_last INTEGER NOT NULL DEFAULT 0,
+     beers_accepted_gap INTEGER NOT NULL DEFAULT 0,
+     beers_rescan_target INTEGER
    )`
 ];
 var MIGRATIONS = [
@@ -58504,7 +58644,9 @@ var MIGRATIONS = [
   "ALTER TABLE sync_state ADD COLUMN beers_offset INTEGER",
   "ALTER TABLE sync_state ADD COLUMN beers_total INTEGER",
   "ALTER TABLE sync_state ADD COLUMN beers_complete INTEGER NOT NULL DEFAULT 0",
-  "ALTER TABLE sync_state ADD COLUMN served_backfill_last INTEGER NOT NULL DEFAULT 0"
+  "ALTER TABLE sync_state ADD COLUMN served_backfill_last INTEGER NOT NULL DEFAULT 0",
+  "ALTER TABLE sync_state ADD COLUMN beers_accepted_gap INTEGER NOT NULL DEFAULT 0",
+  "ALTER TABLE sync_state ADD COLUMN beers_rescan_target INTEGER"
 ];
 var CheckinStoreCore = class {
   constructor(db) {
@@ -58626,7 +58768,9 @@ var CheckinStoreCore = class {
       beers_offset: num(row.beers_offset),
       beers_total: num(row.beers_total),
       beers_complete: Number(row.beers_complete) === 1,
-      served_backfill_last: Number(row.served_backfill_last) === 1
+      served_backfill_last: Number(row.served_backfill_last) === 1,
+      beers_accepted_gap: num(row.beers_accepted_gap) ?? 0,
+      beers_rescan_target: num(row.beers_rescan_target)
     };
   }
   /**
@@ -58650,19 +58794,22 @@ var CheckinStoreCore = class {
       beers_offset: pick2("beers_offset", null),
       beers_total: pick2("beers_total", null),
       beers_complete: pick2("beers_complete", false),
-      served_backfill_last: pick2("served_backfill_last", false)
+      served_backfill_last: pick2("served_backfill_last", false),
+      beers_accepted_gap: pick2("beers_accepted_gap", 0),
+      beers_rescan_target: pick2("beers_rescan_target", null)
     };
     this.db.run(
       `INSERT INTO sync_state
-         (username, oldest_max_id, newest_checkin_id, catchup_max_id, last_synced_at, backfill_complete, total_checkins, checkins_truncated, beers_offset, beers_total, beers_complete, served_backfill_last)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         (username, oldest_max_id, newest_checkin_id, catchup_max_id, last_synced_at, backfill_complete, total_checkins, checkins_truncated, beers_offset, beers_total, beers_complete, served_backfill_last, beers_accepted_gap, beers_rescan_target)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        ON CONFLICT(username) DO UPDATE SET
          oldest_max_id=excluded.oldest_max_id, newest_checkin_id=excluded.newest_checkin_id,
          catchup_max_id=excluded.catchup_max_id, last_synced_at=excluded.last_synced_at,
          backfill_complete=excluded.backfill_complete, total_checkins=excluded.total_checkins,
          checkins_truncated=excluded.checkins_truncated, beers_offset=excluded.beers_offset,
          beers_total=excluded.beers_total, beers_complete=excluded.beers_complete,
-         served_backfill_last=excluded.served_backfill_last`,
+         served_backfill_last=excluded.served_backfill_last, beers_accepted_gap=excluded.beers_accepted_gap,
+         beers_rescan_target=excluded.beers_rescan_target`,
       [
         key,
         next.oldest_max_id,
@@ -58675,7 +58822,9 @@ var CheckinStoreCore = class {
         next.beers_offset,
         next.beers_total,
         next.beers_complete ? 1 : 0,
-        next.served_backfill_last ? 1 : 0
+        next.served_backfill_last ? 1 : 0,
+        next.beers_accepted_gap,
+        next.beers_rescan_target
       ]
     );
   }
@@ -59637,19 +59786,108 @@ function registerWishlistTools(server, client2) {
 }
 
 // src/tools/checkin.ts
-import { existsSync } from "node:fs";
-import { extname } from "node:path";
+import { realpathSync as realpathSync2, statSync } from "node:fs";
+import { delimiter, extname } from "node:path";
 var CheckinIdSchema = external_exports.number().int().positive().describe("Untappd check-in id");
 var PHOTO_CONTENT_TYPES = { jpg: "image/jpeg", png: "image/png" };
 function photoExt(path) {
   const ext = extname(path).slice(1).toLowerCase();
   return ext === "jpeg" ? "jpg" : ext;
 }
+var MAX_PHOTO_BYTES = 15 * 1024 * 1024;
+function photoRoots() {
+  const raw = readEnvVar("UNTAPPD_PHOTO_DIR");
+  const roots = raw?.split(delimiter).filter(Boolean);
+  return roots && roots.length > 0 ? roots : void 0;
+}
+async function checkPhoto(photoPath) {
+  const ext = photoExt(photoPath);
+  if (!(ext in PHOTO_CONTENT_TYPES)) {
+    throw createHelpfulError(`Unsupported photo type "${ext || "(none)"}".`, {
+      hint: "Attach a .jpg, .jpeg, or .png file."
+    });
+  }
+  const roots = photoRoots();
+  if (roots) {
+    try {
+      assertPathWithinRoots(photoPath, roots);
+    } catch {
+      throw createHelpfulError("The photo is outside the allowed photo directory.", {
+        hint: "UNTAPPD_PHOTO_DIR restricts which files can be attached to a check-in."
+      });
+    }
+  }
+  let real;
+  let size;
+  try {
+    real = realpathSync2(photoPath);
+    const st = statSync(real);
+    if (!st.isFile()) throw new Error("not a file");
+    size = st.size;
+  } catch {
+    throw new McpToolError("Photo file not found or not readable.");
+  }
+  if (size > MAX_PHOTO_BYTES) {
+    throw createHelpfulError(`Photo is too large (${size} bytes; the limit is ${MAX_PHOTO_BYTES}).`, {
+      hint: "Attach a normal-sized JPEG or PNG photo."
+    });
+  }
+  const sniffed = sniffMimeBytes(await readFileHead(real, 16));
+  if (sniffed !== PHOTO_CONTENT_TYPES[ext]) {
+    throw createHelpfulError(
+      sniffed === "image/jpeg" || sniffed === "image/png" ? `Photo content (${sniffed}) does not match its .${ext} extension.` : "The file is not a JPEG or PNG image.",
+      { hint: "Attach a real .jpg/.jpeg or .png photo." }
+    );
+  }
+  return { path: real, size_bytes: size, ext, content_type: sniffed };
+}
 var RatingSchema = external_exports.number().min(0).max(5).refine((r) => Math.round(r * 4) === r * 4, { message: "rating must be a multiple of 0.25" });
-function localTimezone() {
-  const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
-  const gmt_offset = -(/* @__PURE__ */ new Date()).getTimezoneOffset() / 60;
-  return { timezone, gmt_offset };
+function gmtOffsetHours(timeZone, at) {
+  const name = new Intl.DateTimeFormat("en-US", { timeZone, timeZoneName: "longOffset" }).formatToParts(at).find((p) => p.type === "timeZoneName")?.value;
+  const m = /GMT([+-])(\d{1,2})(?::(\d{2}))?/.exec(name ?? "");
+  if (!m) return 0;
+  const hours = Number(m[2]) + Number(m[3] ?? 0) / 60;
+  return m[1] === "-" ? -hours : hours;
+}
+function checkinTimezone(requested) {
+  const timezone = requested ?? readEnvVar("UNTAPPD_TIMEZONE") ?? (Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC");
+  try {
+    return { timezone, gmt_offset: gmtOffsetHours(timezone, /* @__PURE__ */ new Date()) };
+  } catch {
+    throw createHelpfulError(`Unknown timezone "${timezone}".`, {
+      hint: 'Pass an IANA timezone name such as "America/New_York" or "Europe/London".'
+    });
+  }
+}
+var RECOVERY_WINDOW_MS = 3e4;
+async function nonIdempotentWrite(run, unknownOutcome) {
+  try {
+    return await run();
+  } catch (e) {
+    if (e instanceof UnreachableError) throw new McpToolError(unknownOutcome);
+    throw e;
+  }
+}
+async function findRecentCheckin(client2, bid, sentAt) {
+  const self = client2.loginName;
+  if (!self) return null;
+  try {
+    const data = await client2.get(
+      `/user/checkins/${encodeURIComponent(self)}`,
+      { limit: 5 }
+    );
+    const matches = [];
+    for (const it of data?.checkins?.items ?? []) {
+      const c = it;
+      const at = Date.parse(c.created_at ?? "");
+      if (c.beer?.bid === bid && typeof c.checkin_id === "number" && at >= sentAt - RECOVERY_WINDOW_MS) {
+        matches.push(c.checkin_id);
+      }
+    }
+    if (matches.length === 1) return matches[0];
+  } catch {
+  }
+  return null;
 }
 function registerCheckinTools(server, client2) {
   server.registerTool(
@@ -59672,7 +59910,10 @@ function registerCheckinTools(server, client2) {
           note: "Dry run \u2014 re-run with confirm: true to toggle your toast on this check-in."
         });
       }
-      const data = await client2.write("POST", `/checkin/toast/${checkin_id}`);
+      const data = await nonIdempotentWrite(
+        () => client2.write("POST", `/checkin/toast/${checkin_id}`),
+        `Untappd did not answer the toast request for check-in ${checkin_id} in time, so it may or may not have been applied. Toast is a TOGGLE: retrying could remove a toast that did land. Check with untappd_checkin_info (checkin_id ${checkin_id}) before retrying.`
+      );
       return minifiedResult({ toggled: true, checkin_id, result: data?.result, like_type: data?.like_type });
     }
   );
@@ -59698,7 +59939,10 @@ function registerCheckinTools(server, client2) {
           note: "Dry run \u2014 re-run with confirm: true to post this comment to your Untappd account."
         });
       }
-      const data = await client2.write("POST", `/checkin/addcomment/${checkin_id}`, { form: { comment } });
+      const data = await nonIdempotentWrite(
+        () => client2.write("POST", `/checkin/addcomment/${checkin_id}`, { form: { comment } }),
+        `Untappd did not answer in time, so the comment may have been posted already. Check the comments with untappd_checkin_info (checkin_id ${checkin_id}) before retrying, or it may be posted twice.`
+      );
       return minifiedResult({ posted: true, checkin_id, response: data });
     }
   );
@@ -59761,24 +60005,21 @@ function registerCheckinTools(server, client2) {
         rating: RatingSchema.optional().describe("Rating 0\u20135 in 0.25 increments (omit for no rating)"),
         shout: external_exports.string().max(2e3).optional().describe("Optional shout / comment text for the check-in"),
         foursquare_id: external_exports.string().optional().describe("Optional Foursquare venue id to tag the check-in location"),
-        photo_path: external_exports.string().optional().describe("Optional path to a local JPEG/PNG photo to attach to the check-in"),
+        photo_path: external_exports.string().optional().describe(
+          "Optional path to a local JPEG/PNG photo (max 15 MB) to attach \u2014 it is published publicly. Only use a file the user explicitly chose; the dry run shows the resolved path and size for them to confirm."
+        ),
         geolat: external_exports.number().optional().describe("Optional latitude of the check-in"),
         geolng: external_exports.number().optional().describe("Optional longitude of the check-in"),
         container_id: external_exports.number().int().optional().describe("Optional serving container id (e.g. 1 = draft, 2 = bottle, 3 = can)"),
+        timezone: external_exports.string().min(1).optional().describe(
+          "The drinker's IANA timezone (e.g. America/New_York), which sets the check-in's local time. Defaults to UNTAPPD_TIMEZONE, else the server's own zone \u2014 which on a hosted connector is usually UTC, so pass it when you know where the user is."
+        ),
         confirm: schemaConfirm
       })
     },
-    async ({ bid, rating, shout, foursquare_id, photo_path, geolat, geolng, container_id, confirm }) => {
-      const { timezone, gmt_offset } = localTimezone();
-      let ext;
-      if (photo_path !== void 0) {
-        ext = photoExt(photo_path);
-        if (!(ext in PHOTO_CONTENT_TYPES)) {
-          throw createHelpfulError(`Unsupported photo type "${ext || "(none)"}".`, {
-            hint: "Attach a .jpg, .jpeg, or .png file."
-          });
-        }
-      }
+    async ({ bid, rating, shout, foursquare_id, photo_path, geolat, geolng, container_id, timezone: requestedTz, confirm }) => {
+      const { timezone, gmt_offset } = checkinTimezone(requestedTz);
+      const photo = photo_path !== void 0 ? await checkPhoto(photo_path) : void 0;
       const form = {
         bid,
         rating: rating !== void 0 ? rating.toFixed(2) : void 0,
@@ -59789,8 +60030,8 @@ function registerCheckinTools(server, client2) {
         container_id,
         timezone,
         gmt_offset,
-        is_photo: photo_path !== void 0 ? "true" : "false",
-        photo_file_ext: photo_path !== void 0 ? ext : void 0,
+        is_photo: photo ? "true" : "false",
+        photo_file_ext: photo?.ext,
         platform: "ios"
       };
       if (confirm !== true) {
@@ -59798,22 +60039,41 @@ function registerCheckinTools(server, client2) {
           dryRun: true,
           action: "checkin",
           form,
-          photo: photo_path !== void 0 ? { path: photo_path, note: "will be uploaded after the check-in is created" } : void 0,
+          photo: photo ? { ...photo, note: "this exact file will be uploaded PUBLICLY after the check-in is created" } : void 0,
           note: "Dry run \u2014 re-run with confirm: true to POST this check-in to your public Untappd feed."
         });
       }
       let blob;
-      if (photo_path !== void 0) {
-        if (!existsSync(photo_path)) throw new McpToolError(`Photo file not found: ${photo_path}`);
-        blob = await fileBlob(photo_path);
+      if (photo) {
+        blob = await fileBlob(photo.path, { maxBytes: MAX_PHOTO_BYTES, label: "Photo", allowedRoots: photoRoots() });
+      }
+      const sentAt = Date.now();
+      let data;
+      try {
+        data = await client2.write("POST", "/checkin/add", { form });
+      } catch (e) {
+        if (!(e instanceof UnreachableError)) throw e;
+        const found = await findRecentCheckin(client2, bid, sentAt);
+        if (found === null) {
+          throw new McpToolError(
+            "Untappd did not answer the check-in request in time, so the check-in may have been created anyway (it could not be confirmed either way). Look at your latest check-ins with untappd_user_checkins before retrying \u2014 retrying a check-in that did land posts it twice."
+          );
+        }
+        return minifiedResult({
+          checked_in: true,
+          checkin_id: found,
+          recovered: true,
+          photo_attached: false,
+          ...photo ? { photo_error: `Check-in ${found} was created, but its photo upload URL was lost with the timed-out response, so no photo was attached.` } : {},
+          note: "Untappd did not answer in time, but the check-in was found on your account \u2014 it was created. Do not retry."
+        });
       }
-      const data = await client2.write("POST", "/checkin/add", { form });
       let photo_attached = false;
       let photo_error;
-      if (photo_path !== void 0) {
+      if (photo) {
         if (data?.photo_upload?.url && data.checkin_id) {
           try {
-            await client2.putBinary(data.photo_upload.url, blob, PHOTO_CONTENT_TYPES[ext]);
+            await client2.putBinary(data.photo_upload.url, blob, photo.content_type);
             await client2.write("POST", "/photo/uploadComplete", {
               form: { checkin_id: data.checkin_id, destination_url: data.photo_upload.destination_url }
             });
@@ -60123,6 +60383,7 @@ async function syncCheckins(client2, cache, rawUsername, options = {}) {
 
 // src/cache/sync-beers.ts
 var PAGE_LIMIT2 = 50;
+var RESUME_OVERLAP = 10;
 async function fetchBeersPage(client2, encodedUser, offset) {
   const data = await client2.get(
     `/user/beers/${encodedUser}`,
@@ -60145,8 +60406,11 @@ async function syncUserBeers(client2, cache, rawUsername, maxPages = 10) {
   const now = () => (/* @__PURE__ */ new Date()).toISOString();
   const prior = await cache.getState(rawUsername);
   const incremental = (prior?.beers_complete ?? false) && !!prior?.last_synced_at;
-  let offset = incremental ? 0 : prior?.beers_offset ?? 0;
+  let refreshing = incremental;
+  let offset = incremental ? 0 : Math.max(0, (prior?.beers_offset ?? 0) - RESUME_OVERLAP);
   let total = prior?.beers_total ?? null;
+  let acceptedGap = prior?.beers_accepted_gap ?? 0;
+  let rescanTarget = incremental ? null : prior?.beers_rescan_target ?? null;
   let complete = false;
   let pages = 0;
   let added = 0;
@@ -60160,31 +60424,41 @@ async function syncUserBeers(client2, cache, rawUsername, maxPages = 10) {
       });
     }
   };
+  const gapNow = async () => total === null ? 0 : total - await cache.distinctBeersCount(rawUsername);
   for (; pages < maxPages && !complete; ) {
     const page = pages === 0 ? await firstFetch(offset) : await fetchBeersPage(client2, encodedUser, offset);
     pages++;
     if (page.total !== null) total = page.total;
-    if (page.items.length === 0) {
-      complete = true;
-      await cache.setState(rawUsername, {
-        beers_offset: incremental ? total ?? offset : offset,
-        beers_total: total,
-        beers_complete: true,
-        last_synced_at: now()
-      });
-      break;
+    let atEnd = page.items.length === 0;
+    if (!atEnd) {
+      const rows = rowsOf2(rawUsername, page.items);
+      const netNew = await cache.upsertDistinctBeers(rawUsername, rows);
+      added += netNew;
+      offset += page.items.length;
+      if (total !== null && offset >= total) atEnd = true;
+      else if (page.items.length < PAGE_LIMIT2) atEnd = true;
+      else if (refreshing && netNew === 0) atEnd = true;
+      else if (rescanTarget !== null && await gapNow() <= rescanTarget) atEnd = true;
+    }
+    if (atEnd) {
+      const gap = await gapNow();
+      if (gap > acceptedGap && rescanTarget === null) {
+        rescanTarget = acceptedGap;
+        acceptedGap = gap;
+        refreshing = false;
+        offset = 0;
+      } else {
+        complete = true;
+        rescanTarget = null;
+        acceptedGap = Math.max(0, gap);
+      }
     }
-    const rows = rowsOf2(rawUsername, page.items);
-    const netNew = await cache.upsertDistinctBeers(rawUsername, rows);
-    added += netNew;
-    offset += page.items.length;
-    if (total !== null && offset >= total) complete = true;
-    else if (page.items.length < PAGE_LIMIT2) complete = true;
-    else if (incremental && netNew === 0) complete = true;
     await cache.setState(rawUsername, {
-      beers_offset: incremental ? total ?? offset : offset,
+      beers_offset: refreshing ? total ?? offset : offset,
       beers_total: total,
       beers_complete: complete,
+      beers_accepted_gap: acceptedGap,
+      beers_rescan_target: rescanTarget,
       last_synced_at: now()
     });
   }
@@ -60518,8 +60792,8 @@ function registerCacheTools(server, client2, cacheProvider) {
 // src/cache/db.ts
 import { DatabaseSync } from "node:sqlite";
 import { mkdirSync } from "node:fs";
-import { dirname as dirname2, join as join2 } from "node:path";
-import { homedir } from "node:os";
+import { dirname as dirname3, join as join3 } from "node:path";
+import { homedir as homedir2 } from "node:os";
 var NodeSqlDriver = class {
   constructor(db) {
     this.db = db;
@@ -60556,7 +60830,7 @@ var CheckinCache = class _CheckinCache extends LocalCacheStore {
   db;
   /** Open (creating parent dirs) a file-backed cache, or `:memory:` for tests. */
   static open(path) {
-    if (path !== ":memory:") mkdirSync(dirname2(path), { recursive: true });
+    if (path !== ":memory:") mkdirSync(dirname3(path), { recursive: true });
     return new _CheckinCache(new DatabaseSync(path));
   }
   close() {
@@ -60564,7 +60838,7 @@ var CheckinCache = class _CheckinCache extends LocalCacheStore {
   }
 };
 function defaultCachePath() {
-  return readEnvVar("UNTAPPD_CACHE_DB") ?? join2(homedir(), ".untappd-mcp", "checkins.db");
+  return readEnvVar("UNTAPPD_CACHE_DB") ?? join3(homedir2(), ".untappd-mcp", "checkins.db");
 }
 
 // src/index.ts