vibo-mcp 2.3.1 → 2.4.0

package/dist/bundle.js

@@ -19782,7 +19782,7 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// node_modules/@modelcontextprotocol/core/dist/auth-CUe6YdwF.mjs
+// node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/auth-CGP0BDVq.mjs
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
@@ -20619,7 +20619,8 @@ var OAuthMetadataSchema = looseObject({
   introspection_endpoint_auth_signing_alg_values_supported: array(string2()).optional(),
   code_challenge_methods_supported: array(string2()).optional(),
   client_id_metadata_document_supported: boolean2().optional(),
-  authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0)
+  authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0),
+  dpop_signing_alg_values_supported: array(string2()).optional()
 });
 var OpenIdProviderMetadataSchema = looseObject({
   issuer: string2(),
@@ -20720,7 +20721,7 @@ var OAuthTokenRevocationRequestSchema = object({
   token_type_hint: string2().optional()
 }).strip();
 
-// node_modules/@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs
+// node_modules/@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs
 var BRANDS = /* @__PURE__ */ Symbol.for("mcp.sdk.errorBrands");
 function stampErrorBrands(instance, ctor) {
   const brands = /* @__PURE__ */ new Set();
@@ -20834,8 +20835,18 @@ var SdkError = class extends Error {
     if (typeof this !== "function") throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");
     return brandedHasInstance(this, value);
   }
-  constructor(code, message, data) {
-    super(message);
+  /**
+  * @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+  * @param message - Human-readable description.
+  * @param data - Optional structured payload (for example the HTTP status carried by
+  * {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+  * promoted to `Error.cause`.
+  * @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+  * failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+  * loggers and error trackers walk.
+  */
+  constructor(code, message, data, options) {
+    super(message, options);
     this.code = code;
     this.data = data;
     this.name = "SdkError";
@@ -20846,8 +20857,11 @@ var SdkHttpError = class extends SdkError {
   static {
     Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
   }
-  constructor(code, message, data) {
-    super(code, message, data);
+  /**
+  * @param options - Standard `ErrorOptions`, forwarded to `Error` (see {@linkcode SdkError}).
+  */
+  constructor(code, message, data, options) {
+    super(code, message, data, options);
     this.name = "SdkHttpError";
   }
   get status() {
@@ -23798,7 +23812,7 @@ var INBOUND_VALIDATION_LADDER = [
     evaluatedAt: "pre-dispatch",
     codes: [HEADER_MISMATCH_ERROR_CODE],
     conformance: ["http-header-validation"],
-    rationale: "SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
+    rationale: "SEP-2243 standard `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The spec requires `MCP-Protocol-Version` and `Mcp-Method` on every modern *request* POST (`Mcp-Name` only for the methods that mirror `params.name` / `params.uri` / `params.taskId`, see `MCP_NAME_HEADER_SOURCE`) and names them in that order, so a request missing several is answered by the earliest. Notification POSTs are exempt: the presence half runs on requests only, so a modern-enveloped notification is dispatched even with no standard headers at all. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half \u2014 including the missing `MCP-Protocol-Version` cell, which cannot live on the edge rung without breaking body-primary classification. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
   },
   {
     rung: "client-capabilities",
@@ -24599,7 +24613,7 @@ var Protocol = class {
     return this._requestHandlers.get(method);
   }
   async _oncancel(notification) {
-    if (!notification.params.requestId) return;
+    if (notification.params.requestId === void 0) return;
     this._requestHandlerAbortControllers.get(notification.params.requestId)?.abort(notification.params.reason);
   }
   _setupTimeout(messageId, timeout, maxTotalTimeout, onTimeout, resetTimeoutOnProgress = false) {
@@ -24998,19 +25012,20 @@ var Protocol = class {
       const cancel = (reason) => {
         if (responseReceived) return;
         this._progressHandlers.delete(messageId);
-        if (requestAbort === void 0) this._transport?.send(this._envelopeOutbound({
-          jsonrpc: "2.0",
-          method: "notifications/cancelled",
-          params: {
-            requestId: messageId,
-            reason: String(reason)
-          }
-        }), {
-          relatedRequestId,
-          resumptionToken,
-          onresumptiontoken
-        }).catch((error62) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error62}`)));
-        else requestAbort.abort();
+        if (requestAbort === void 0) {
+          if (request.method !== "initialize") this._transport?.send(this._envelopeOutbound({
+            jsonrpc: "2.0",
+            method: "notifications/cancelled",
+            params: {
+              requestId: messageId,
+              reason: String(reason)
+            }
+          }), {
+            relatedRequestId,
+            resumptionToken,
+            onresumptiontoken
+          }).catch((error62) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error62}`)));
+        } else requestAbort.abort();
         reject(reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason)));
       };
       this._responseHandlers.set(messageId, (response) => {
@@ -25090,7 +25105,7 @@ var Protocol = class {
       jsonrpc: "2.0",
       ...notification
     });
-    if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && !options?.relatedRequestId) {
+    if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && options?.relatedRequestId === void 0) {
       if (this._pendingDebouncedNotifications.has(notification.method)) return;
       this._pendingDebouncedNotifications.add(notification.method);
       Promise.resolve().then(() => {
@@ -32393,7 +32408,7 @@ var Ajv = import_ajv.Ajv;
 // node_modules/@modelcontextprotocol/server/dist/shimsNode.mjs
 import process2 from "node:process";
 
-// node_modules/@modelcontextprotocol/server/dist/mcp-DXXb3Vv3.mjs
+// node_modules/@modelcontextprotocol/server/dist/mcp-Dw2OlZ1f.mjs
 var COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -32586,6 +32601,9 @@ function notificationToServerEvent(method, uri) {
       };
   }
 }
+function supportsScopeChallengeResolver(transport) {
+  return typeof transport === "object" && transport !== null && "setScopeChallengeResolver" in transport && typeof transport.setScopeChallengeResolver === "function";
+}
 var DEFAULT_LEGACY_SHIM_MAX_ROUNDS = 8;
 var DEFAULT_LEGACY_SHIM_ROUND_TIMEOUT_MS = 6e5;
 function resolveLegacyShimOptions(options) {
@@ -33396,6 +33414,7 @@ var McpServer = class {
   * ```
   */
   async connect(transport) {
+    if (supportsScopeChallengeResolver(transport)) transport.setScopeChallengeResolver((context) => this.resolveScopeChallenge(context));
     return await this.server.connect(transport);
   }
   /**
@@ -33404,6 +33423,41 @@ var McpServer = class {
   async close() {
     await this.server.close();
   }
+  /** @internal */
+  resolveScopeChallenge = (context) => {
+    switch (context.request.method) {
+      case "tools/call": {
+        const toolName = context.request.params?.name;
+        if (typeof toolName !== "string") return;
+        const tool = this._registeredTools[toolName];
+        if (tool === void 0 || !tool.enabled) return;
+        return tool.scopeChallenge?.(context);
+      }
+      case "resources/read": {
+        const resourceUri = context.request.params?.uri;
+        if (typeof resourceUri !== "string") return;
+        let uri;
+        try {
+          uri = new URL(resourceUri);
+        } catch {
+          return;
+        }
+        const resource = this._registeredResources[uri.toString()];
+        if (resource !== void 0) return resource.enabled ? resource.scopeChallenge?.(context) : void 0;
+        for (const template of Object.values(this._registeredResourceTemplates)) if (template.resourceTemplate.uriTemplate.match(uri.toString())) return template.enabled ? template.scopeChallenge?.(context) : void 0;
+        return;
+      }
+      case "prompts/get": {
+        const promptName = context.request.params?.name;
+        if (typeof promptName !== "string") return;
+        const prompt = this._registeredPrompts[promptName];
+        if (prompt === void 0 || !prompt.enabled) return;
+        return prompt.scopeChallenge?.(context);
+      }
+      default:
+        return;
+    }
+  };
   _toolHandlersInitialized = false;
   setToolRequestHandlers() {
     if (this._toolHandlersInitialized) return;
@@ -33570,7 +33624,10 @@ var McpServer = class {
       }
       for (const template of Object.values(this._registeredResourceTemplates)) {
         const variables = template.resourceTemplate.uriTemplate.match(uri.toString());
-        if (variables) return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+        if (variables) {
+          if (!template.enabled) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Resource template ${template.resourceTemplate.uriTemplate} disabled`);
+          return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+        }
       }
       throw new ResourceNotFoundError(request.params.uri);
     });
@@ -33601,36 +33658,32 @@ var McpServer = class {
     this._promptHandlersInitialized = true;
   }
   registerResource(name, uriOrTemplate, config2, readCallback) {
-    const cacheHint = config2.cacheHint;
-    let metadata = config2;
-    if (cacheHint !== void 0) {
-      assertValidCacheHint(cacheHint, `resource ${name}`);
-      const rest = { ...config2 };
-      delete rest.cacheHint;
-      metadata = rest;
-    }
+    const { cacheHint, scopeChallenge, ...resourceMetadata } = config2;
+    const metadata = resourceMetadata;
+    if (cacheHint !== void 0) assertValidCacheHint(cacheHint, `resource ${name}`);
     if (typeof uriOrTemplate === "string") {
       if (this._registeredResources[uriOrTemplate]) throw new Error(`Resource ${uriOrTemplate} is already registered`);
-      const registeredResource = this._createRegisteredResource(name, config2.title, uriOrTemplate, metadata, readCallback);
+      const registeredResource = this._createRegisteredResource(name, config2.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
       if (cacheHint !== void 0) registeredResource.cacheHint = cacheHint;
       this.setResourceRequestHandlers();
       this.sendResourceListChanged();
       return registeredResource;
     } else {
       if (this._registeredResourceTemplates[name]) throw new Error(`Resource template ${name} is already registered`);
-      const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config2.title, uriOrTemplate, metadata, readCallback);
+      const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config2.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
       if (cacheHint !== void 0) registeredResourceTemplate.cacheHint = cacheHint;
       this.setResourceRequestHandlers();
       this.sendResourceListChanged();
       return registeredResourceTemplate;
     }
   }
-  _createRegisteredResource(name, title, uri, metadata, readCallback) {
+  _createRegisteredResource(name, title, uri, metadata, scopeChallenge, readCallback) {
     const registeredResource = {
       name,
       title,
       metadata,
       readCallback,
+      scopeChallenge,
       enabled: true,
       disable: () => registeredResource.update({ enabled: false }),
       enable: () => registeredResource.update({ enabled: true }),
@@ -33644,6 +33697,7 @@ var McpServer = class {
         if (updates.title !== void 0) registeredResource.title = updates.title;
         if (updates.metadata !== void 0) registeredResource.metadata = updates.metadata;
         if (updates.callback !== void 0) registeredResource.readCallback = updates.callback;
+        if (updates.scopeChallenge !== void 0) registeredResource.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates.enabled !== void 0) registeredResource.enabled = updates.enabled;
         this.sendResourceListChanged();
       }
@@ -33651,12 +33705,13 @@ var McpServer = class {
     this._registeredResources[uri] = registeredResource;
     return registeredResource;
   }
-  _createRegisteredResourceTemplate(name, title, template, metadata, readCallback) {
+  _createRegisteredResourceTemplate(name, title, template, metadata, scopeChallenge, readCallback) {
     const registeredResourceTemplate = {
       resourceTemplate: template,
       title,
       metadata,
       readCallback,
+      scopeChallenge,
       enabled: true,
       disable: () => registeredResourceTemplate.update({ enabled: false }),
       enable: () => registeredResourceTemplate.update({ enabled: true }),
@@ -33670,6 +33725,7 @@ var McpServer = class {
         if (updates.template !== void 0) registeredResourceTemplate.resourceTemplate = updates.template;
         if (updates.metadata !== void 0) registeredResourceTemplate.metadata = updates.metadata;
         if (updates.callback !== void 0) registeredResourceTemplate.readCallback = updates.callback;
+        if (updates.scopeChallenge !== void 0) registeredResourceTemplate.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates.enabled !== void 0) registeredResourceTemplate.enabled = updates.enabled;
         this.sendResourceListChanged();
       }
@@ -33679,7 +33735,7 @@ var McpServer = class {
     if (Array.isArray(variableNames) && variableNames.some((v) => !!template.completeCallback(v))) this.setCompletionRequestHandler();
     return registeredResourceTemplate;
   }
-  _createRegisteredPrompt(name, title, description, argsSchema, callback, icons, _meta) {
+  _createRegisteredPrompt(name, title, description, argsSchema, callback, icons, scopeChallenge, _meta) {
     let currentArgsSchema = argsSchema;
     let currentCallback = callback;
     const registeredPrompt = {
@@ -33687,6 +33743,7 @@ var McpServer = class {
       description,
       argsSchema,
       icons,
+      scopeChallenge,
       _meta,
       handler: createPromptHandler(name, argsSchema, callback),
       enabled: true,
@@ -33701,6 +33758,7 @@ var McpServer = class {
         if (updates.title !== void 0) registeredPrompt.title = updates.title;
         if (updates.description !== void 0) registeredPrompt.description = updates.description;
         if (updates.icons !== void 0) registeredPrompt.icons = updates.icons;
+        if (updates.scopeChallenge !== void 0) registeredPrompt.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates._meta !== void 0) registeredPrompt._meta = updates._meta;
         let needsHandlerRegen = false;
         if (updates.argsSchema !== void 0) {
@@ -33728,7 +33786,7 @@ var McpServer = class {
     }
     return registeredPrompt;
   }
-  _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, _meta, handler) {
+  _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
     validateAndWarnToolName(name);
     if (inputSchema !== void 0) try {
       const json2 = standardSchemaToJsonSchema(inputSchema, "input");
@@ -33747,6 +33805,7 @@ var McpServer = class {
       annotations,
       icons,
       execution,
+      scopeChallenge,
       _meta,
       handler,
       executor: createToolExecutor(inputSchema, handler),
@@ -33785,6 +33844,7 @@ var McpServer = class {
         }
         if (updates.annotations !== void 0) registeredTool.annotations = updates.annotations;
         if (updates.icons !== void 0) registeredTool.icons = updates.icons;
+        if (updates.scopeChallenge !== void 0) registeredTool.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
         if (updates._meta !== void 0) registeredTool._meta = updates._meta;
         if (updates.enabled !== void 0) registeredTool.enabled = updates.enabled;
         this.sendToolListChanged();
@@ -33797,13 +33857,13 @@ var McpServer = class {
   }
   registerTool(name, config2, cb) {
     if (this._registeredTools[name]) throw new Error(`Tool ${name} is already registered`);
-    const { title, description, inputSchema, outputSchema, annotations, icons, _meta } = config2;
-    return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, _meta, cb);
+    const { title, description, inputSchema, outputSchema, annotations, icons, scopeChallenge, _meta } = config2;
+    return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, scopeChallenge, _meta, cb);
   }
   registerPrompt(name, config2, cb) {
     if (this._registeredPrompts[name]) throw new Error(`Prompt ${name} is already registered`);
-    const { title, description, argsSchema, icons, _meta } = config2;
-    const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, _meta);
+    const { title, description, argsSchema, icons, scopeChallenge, _meta } = config2;
+    const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, scopeChallenge, _meta);
     this.setPromptRequestHandlers();
     this.sendPromptListChanged();
     return registeredPrompt;
@@ -33915,6 +33975,7 @@ function unwrapOptionalSchema(schema) {
 }
 
 // node_modules/@modelcontextprotocol/server/dist/stdio.mjs
+var swallowsErrorsAfterClose = /* @__PURE__ */ Symbol("swallowsErrorsAfterClose");
 var StdioServerTransport = class {
   _readBuffer;
   _started = false;
@@ -33941,18 +34002,27 @@ var StdioServerTransport = class {
     this.onerror?.(error62);
   };
   _onstdouterror = (error62) => {
+    if (this._closed) return;
     this.onerror?.(error62);
     this.close().catch(() => {
     });
   };
+  _onstdinclose = () => {
+    this.close().catch(() => {
+    });
+  };
   /**
   * Starts listening for messages on `stdin`.
   */
   async start() {
     if (this._started) throw new Error("StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.");
     this._started = true;
+    for (const listener of this._stdout.listeners("error")) if (listener[swallowsErrorsAfterClose]) this._stdout.off("error", listener);
+    if (this._stdin.readableEnded || this._stdin.destroyed) setImmediate(this._onstdinclose);
     this._stdin.on("data", this._ondata);
     this._stdin.on("error", this._onerror);
+    this._stdin.on("end", this._onstdinclose);
+    this._stdin.on("close", this._onstdinclose);
     this._stdout.on("error", this._onstdouterror);
   }
   processReadBuffer() {
@@ -33969,7 +34039,9 @@ var StdioServerTransport = class {
     this._closed = true;
     this._stdin.off("data", this._ondata);
     this._stdin.off("error", this._onerror);
-    this._stdout.off("error", this._onstdouterror);
+    this._stdin.off("end", this._onstdinclose);
+    this._stdin.off("close", this._onstdinclose);
+    this._onstdouterror[swallowsErrorsAfterClose] = true;
     if (this._stdin.listenerCount("data") === 0) this._stdin.pause();
     this._readBuffer.clear();
     this.onclose?.();
@@ -34246,6 +34318,7 @@ function serveStdio(factory, options = {}) {
         return;
       }
       if (state.era === "modern" && await tryServeListen(message)) return;
+      if (isTornDown()) return;
       state.instance.channel.deliver(message);
       return;
     }
@@ -34312,6 +34385,7 @@ function serveStdio(factory, options = {}) {
           };
         }
         if (await tryServeListen(message)) return;
+        if (isTornDown()) return;
         state.instance.channel.deliver(message, { classification: opening.classification });
         return;
       case "legacy": {
@@ -34398,6 +34472,9 @@ function toError(value) {
   return value instanceof Error ? value : new Error(String(value));
 }
 
+// node_modules/@modelcontextprotocol/server/dist/index.mjs
+var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
+
 // node_modules/@chrischall/mcp-utils/dist/errors/index.js
 var DEFAULT_ERROR_MESSAGE_MAX = 500;
 var McpToolError = class extends Error {
@@ -34419,11 +34496,12 @@ var SessionNotAuthenticatedError = class extends McpToolError {
     this.name = "SessionNotAuthenticatedError";
   }
 };
+var HEADER_NAME_RUN = "[a-z0-9_-]{0,40}";
 var BEARER_RE = /(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
-var JWT_RE = /\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/g;
+var JWT_RE = /(?<![A-Za-z0-9_-])[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}(?![A-Za-z0-9_-])/g;
 var BASIC_AUTH_RE = /(authorization\s*:\s*basic\s+)[A-Za-z0-9+/=_-]{6,}/gi;
-var SET_COOKIE_RE = /(\bset-cookie\s*:\s*)([^=;,\s]+)=[^;,\s]*/gi;
-var COOKIE_HEADER_RE = /((?<!set-)\bcookie\s*:\s*)((?:[^=;,\s]+=[^;,\s]*)(?:;\s*[^=;,\s]+=[^;,\s]*)*)/gi;
+var SET_COOKIE_RE = /(\bset-cookie\s*:\s*)([^=;,:\s]+)=[^;,\s]*/gi;
+var COOKIE_HEADER_RE = /((?<!set-)\bcookie\s*:\s*)((?:[^=;,:\s]+=[^;,\s]*)(?:;\s*[^=;,:\s]+=[^;,\s]*)*)/gi;
 var API_KEY_RE = new RegExp([
   "sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])",
   // OpenAI / Anthropic (incl. sk-ant-…)
@@ -34438,10 +34516,10 @@ var API_KEY_RE = new RegExp([
   "whsec_[A-Za-z0-9]{16,}\\b"
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
-var QUERY_SECRET_RE = /([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
 var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
 var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
-var HEADER_SECRET_RE = /(\b(?:x[-_][a-z0-9_-]*?(?:api[-_]?key|token|secret|auth)[a-z0-9_-]*|api[-_]?key)\s*:\s*)[^\s,;"'<>`]+/gi;
+var HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
 var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
 var JSON_SECRET_KEYS = [
   "(?:access|refresh|id|auth|session|bearer|csrf|xsrf)[_-]?token",
@@ -34449,7 +34527,8 @@ var JSON_SECRET_KEYS = [
   "api[_-]?secret",
   "(?:x[_-])?api[_-]?key",
   "private[_-]?key",
-  "x[_-][a-z0-9_-]*?(?:api[_-]?key|token|secret|auth)[a-z0-9_-]*",
+  `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
+  // bounded like HEADER_SECRET_RE
   "(?:proxy-)?authorization",
   "password",
   "passwd",
@@ -34458,12 +34537,30 @@ var JSON_SECRET_KEYS = [
 ].join("|");
 var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")(?:[^"\\\\]|\\\\.)*(")`, "gi");
 var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')(?:[^'\\\\]|\\\\.)*(')`, "gi");
+var JSON_SECRET_NUM_RE = new RegExp(`(["'](?:${JSON_SECRET_KEYS})["']\\s*:\\s*)-?\\d+(?:\\.\\d+)?(?![\\d.])`, "gi");
+var JSON_COOKIE_DQ_RE = /("((?:set-)?cookie)"\s*:\s*)("(?:[^"\\]|\\.)*"|\[\s*"(?:[^"\\]|\\.)*"(?:\s*,\s*"(?:[^"\\]|\\.)*")*)/gi;
+var JSON_COOKIE_SQ_RE = /('((?:set-)?cookie)'\s*:\s*)('(?:[^'\\]|\\.)*'|\[\s*'(?:[^'\\]|\\.)*'(?:\s*,\s*'(?:[^'\\]|\\.)*')*)/gi;
+var DQ_STRING_RE = /"((?:[^"\\]|\\.)*)"/g;
+var SQ_STRING_RE = /'((?:[^'\\]|\\.)*)'/g;
+function redactJsonCookie(quote) {
+  const stringRe = quote === '"' ? DQ_STRING_RE : SQ_STRING_RE;
+  return (_m, prefix, key, value) => {
+    const setCookie = key.toLowerCase() === "set-cookie";
+    const redacted = value.replace(stringRe, (_s, body) => {
+      const out = setCookie ? body.replace(/^(\s*[^=;]+)=[^;]*/, "$1=[REDACTED]") : body.replace(/=[^;]*/g, "=[REDACTED]");
+      return `${quote}${out}${quote}`;
+    });
+    return `${prefix}${redacted}`;
+  };
+}
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_COOKIE_DQ_RE, redactJsonCookie('"')).replace(JSON_COOKIE_SQ_RE, redactJsonCookie("'")).replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_NUM_RE, "$1[REDACTED]").replace(JWT_RE, "[REDACTED]");
 }
+var ERROR_REDACTION_INPUT_MAX = 64 * 1024;
 function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   const str = text === null || text === void 0 ? "" : String(text);
-  const redacted = redactSecrets(str);
+  const cap = Math.max(ERROR_REDACTION_INPUT_MAX, max);
+  const redacted = redactSecrets(str.length > cap ? str.slice(0, cap) : str);
   if (redacted.length <= max)
     return redacted;
   return `${redacted.slice(0, max)}\u2026 [truncated]`;
@@ -34828,6 +34925,9 @@ async function tokenConfirmation(action, fb) {
   const subject = await fb.subject();
   if (isToolResult(subject))
     return subject;
+  if (subject.payload === void 0) {
+    throw new TypeError(`confirm token: ${fb.tool}'s subject() returned no payload. Bind what the call will do (the arguments or the request body), or pass \`args\` to confirmationFromEnv.`);
+  }
   const binding = {
     tool: fb.tool,
     ...fb.account === void 0 ? {} : { account: fb.account },
@@ -34920,9 +35020,19 @@ function readConfirmMode(env = process.env) {
   }
   return "refuse";
 }
-function confirmTtlFromEnv(env = process.env) {
+function readConfirmTtl(env) {
   const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
-  return raw && /^[1-9]\d*$/.test(raw) ? Number(raw) : DEFAULT_TTL_SECONDS2;
+  if (!raw)
+    return DEFAULT_TTL_SECONDS2;
+  if (/^[1-9]\d*$/.test(raw))
+    return Number(raw);
+  const key = `ttl:${raw}`;
+  if (!warned.has(key)) {
+    warned.add(key);
+    process.stderr.write(`MCP_CONFIRM_TTL_SECONDS="${raw}" is not a positive whole number of seconds; gated writes will refuse on clients that cannot show a confirmation prompt until it is fixed.
+`);
+  }
+  return void 0;
 }
 var processKey;
 function confirmKeyFromEnv(env = process.env) {
@@ -34934,15 +35044,33 @@ function confirmKeyFromEnv(env = process.env) {
 }
 var CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
 var REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+var BAD_TTL_HINT = "MCP_CONFIRM_TTL_SECONDS on the server is not a positive whole number of seconds; fix it to allow two-step confirmation.";
+function boundArgs(args) {
+  if (args === null || typeof args !== "object" || Array.isArray(args) || !("confirmToken" in args))
+    return args;
+  const { confirmToken, ...rest } = args;
+  void confirmToken;
+  return rest;
+}
 function confirmationFromEnv(options) {
-  const { tool, account, confirmToken, subject, instruction, spent, env = process.env, ...confirmation } = options;
+  const { tool, account, confirmToken, subject, instruction, spent, args, env = process.env, ...rest } = options;
   const mode = readConfirmMode(env);
-  if (mode === "refuse") {
+  const ttlSeconds = readConfirmTtl(env);
+  const bound = args === void 0 ? void 0 : boundArgs(args);
+  const confirmation = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  if (mode === "refuse" || ttlSeconds === void 0) {
+    const hint = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
     return {
       ...confirmation,
-      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${REFUSE_HINT}` : REFUSE_HINT
+      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${hint}` : hint
     };
   }
+  const boundSubject = bound === void 0 ? subject : async () => {
+    const read = await subject();
+    if ("content" in read)
+      return read;
+    return { ...read, payload: { payload: read.payload, args: bound } };
+  };
   return {
     ...confirmation,
     tokenFallback: {
@@ -34950,8 +35078,8 @@ function confirmationFromEnv(options) {
       tool,
       ...account === void 0 ? {} : { account },
       ...confirmToken === void 0 ? {} : { confirmToken },
-      subject,
-      ttlSeconds: confirmTtlFromEnv(env),
+      subject: boundSubject,
+      ttlSeconds,
       instruction: mode === "auto" ? CONFIRM_TOKEN_AUTO_INSTRUCTION : instruction ?? CONFIRM_TOKEN_INSTRUCTION,
       ...spent === void 0 ? {} : { spent }
     }
@@ -35075,6 +35203,8 @@ function withGracefulShutdown(target, opts = {}) {
   };
   const handler = (signal) => {
     if (shuttingDown) {
+      if (signal === "stdin-eof")
+        return;
       if (Date.now() - firstSignalAt < repeatGraceMs)
         return;
       if (shouldExit) {
@@ -35110,6 +35240,10 @@ function withGracefulShutdown(target, opts = {}) {
   };
   process.on("SIGINT", () => handler("SIGINT"));
   process.on("SIGTERM", () => handler("SIGTERM"));
+  if (opts.stdin) {
+    opts.stdin.once("end", () => handler("stdin-eof"));
+    opts.stdin.once("close", () => handler("stdin-eof"));
+  }
 }
 function runMcp(opts) {
   if (opts.banner !== void 0) {
@@ -35128,7 +35262,8 @@ function runMcp(opts) {
   });
   const shutdown = opts.shutdown ?? true;
   if (shutdown !== false) {
-    withGracefulShutdown(handle, shutdown === true ? {} : shutdown);
+    const stdinDefault = spec === "stdio" ? { stdin: process.stdin } : {};
+    withGracefulShutdown(handle, { ...stdinDefault, ...shutdown === true ? {} : shutdown });
   }
   return handle;
 }
@@ -35165,7 +35300,7 @@ function toolAnnotations(opts = {}) {
 }
 
 // src/version.ts
-var VERSION = "2.3.1";
+var VERSION = "2.4.0";
 
 // src/client.ts
 import { createHash as createHash4 } from "crypto";
@@ -35374,6 +35509,7 @@ var REFRESH = `
 `;
 var AUTH_ERROR_CODES = /* @__PURE__ */ new Set(["UNAUTHORIZED", "UNAUTHENTICATED"]);
 var PERMISSION_ERROR_CODES = /* @__PURE__ */ new Set(["FORBIDDEN"]);
+var PERMISSION_MESSAGE_PATTERN = /\bnot allowed for user\b/i;
 var AUTH_MESSAGE_PATTERN = /not authoriz|unauthoriz|unauthenticated|invalid token|token (has )?expired|expired token|jwt (expired|malformed)|try to log ?in/i;
 function requestSignal() {
   return withAmbientCancellation(AbortSignal.timeout(REQUEST_TIMEOUT_MS));
@@ -35654,7 +35790,11 @@ var ViboClient = class {
   /** Signed in, but not allowed to do this (HTTP 403 / FORBIDDEN). */
   isPermissionError(status, errors) {
     if (status === 403) return true;
-    return (errors ?? []).some((e) => PERMISSION_ERROR_CODES.has(e.code ?? e.extensions?.code ?? ""));
+    return (errors ?? []).some((e) => {
+      const code = e.code ?? e.extensions?.code ?? "";
+      if (PERMISSION_ERROR_CODES.has(code)) return true;
+      return !AUTH_ERROR_CODES.has(code) && PERMISSION_MESSAGE_PATTERN.test(e.message ?? "");
+    });
   }
   unwrap(status, body) {
     if (this.isPermissionError(status, body.errors)) {
@@ -35766,6 +35906,39 @@ var LIST_SECTIONS = `
     }
   }
 `;
+var SECTIONS_FOR_WRITE = `
+  query sectionsForWrite($eventId: ID!) {
+    sections(eventId: $eventId) {
+      _id name type songsCount questionsCount answeredCount canRemove visibility
+      settings { canHostsOrderSongs canHostDeleteSection }
+    }
+  }
+`;
+var EVENT_PERMISSIONS = `
+  query eventPermissions($eventId: ID!) {
+    event(eventId: $eventId) {
+      _id role isLocked
+      settings { canHostCreateSections canHostReorderSections sectionSongsLimit sectionMustPlayLimit }
+    }
+  }
+`;
+var CREATE_SECTION = `
+  mutation createSection($eventId: ID!, $payload: CreateSectionInput!) {
+    createSection(eventId: $eventId, payload: $payload) {
+      _id name type time description visibility
+    }
+  }
+`;
+var REMOVE_SECTION = `
+  mutation removeSection($eventId: ID!, $sectionId: ID!) {
+    removeSection(eventId: $eventId, sectionId: $sectionId)
+  }
+`;
+var REORDER_SECTIONS = `
+  mutation reorderSections($eventId: ID!, $sourceSectionId: ID!, $targetSectionId: ID) {
+    reorderSections(eventId: $eventId, sourceSectionId: $sourceSectionId, targetSectionId: $targetSectionId)
+  }
+`;
 var GET_SECTION_SONGS = `
   query getSectionSongs($eventId: ID!, $sectionId: ID!, $filter: SectionSongsFilter, $pagination: PaginationInput, $sort: SongsSortInput) {
     getSectionSongs(eventId: $eventId, sectionId: $sectionId, filter: $filter, pagination: $pagination, sort: $sort) {
@@ -35781,6 +35954,15 @@ var GET_SECTION_SONGS = `
     }
   }
 `;
+var SECTION_SONG_IDS = `
+  query sectionSongIds($eventId: ID!, $sectionId: ID!, $pagination: PaginationInput) {
+    getSectionSongs(eventId: $eventId, sectionId: $sectionId, pagination: $pagination) {
+      songs { _id viboSongId artist title }
+      next { skip limit }
+      totalCount
+    }
+  }
+`;
 var SEARCH_SONGS = `
   query getSongs($eventId: ID!, $sectionId: ID!, $filter: SongsFilter!, $limit: Int!) {
     getSongs(eventId: $eventId, sectionId: $sectionId, filter: $filter, limit: $limit) {
@@ -36047,7 +36229,11 @@ var inlineFileSchema = external_exports.object({
 });
 var CONFIRM_NOTE = "Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).";
 function confirmWrite(ctx, options) {
-  const preview = { action: options.mutation, willSend: options.willSend };
+  const preview = {
+    action: options.mutation,
+    willSend: options.willSend,
+    ...options.context ? { context: options.context } : {}
+  };
   return requireConfirmationWithFallback(
     ctx,
     confirmationFromEnv({
@@ -36058,7 +36244,7 @@ function confirmWrite(ctx, options) {
       confirmToken: options.confirmToken,
       subject: () => ({
         target: options.target,
-        payload: options.payload ?? options.willSend,
+        payload: options.payload ?? (options.context ? { willSend: options.willSend, context: options.context } : options.willSend),
         preview
       })
     })
@@ -36345,7 +36531,61 @@ function annotateSearchResults(results, query, source = "searchField") {
   return { query: parsed, ...hint ? { hint } : {}, summary, results: annotated };
 }
 
+// src/tools/lookups.ts
+async function fetchSections(client2, eventId) {
+  const data = await client2.gql(SECTIONS_FOR_WRITE, { eventId });
+  return data.sections ?? [];
+}
+async function fetchEventPermissions(client2, eventId) {
+  const data = await client2.gql(EVENT_PERMISSIONS, { eventId });
+  return data.event;
+}
+function findSection(sections, sectionId) {
+  const section = sections.find((s) => s._id === sectionId);
+  if (!section) {
+    throw new McpToolError(`Section ${sectionId} is not in this event's timeline.`, {
+      hint: "Get section ids from vibo_list_sections for the same eventId."
+    });
+  }
+  return section;
+}
+async function fetchSectionSongs(client2, eventId, sectionId) {
+  const songs = [];
+  const limit = 100;
+  for (let page = 0; page < 50; page++) {
+    const data = await client2.gql(
+      SECTION_SONG_IDS,
+      { eventId, sectionId, pagination: { skip: songs.length, limit } }
+    );
+    const batch = data.getSectionSongs?.songs ?? [];
+    songs.push(...batch);
+    const total = data.getSectionSongs?.totalCount;
+    if (batch.length < limit || typeof total === "number" && songs.length >= total) break;
+  }
+  return songs;
+}
+function assertSongsInSection(songIds, songs) {
+  const have = new Set(songs.map((s) => s._id));
+  const missing = songIds.filter((id) => !have.has(id));
+  if (missing.length === 0) return;
+  const hints = missing.map((id) => {
+    const byVibo = songs.find((s) => s.viboSongId === id);
+    return byVibo ? `${id} is a viboSongId \u2014 its section-song _id is ${byVibo._id}` : null;
+  }).filter(Boolean);
+  throw new McpToolError(
+    `${missing.length} of ${songIds.length} song id(s) are not in this section: ${missing.join(", ")}. Nothing was sent.`,
+    {
+      hint: (hints.length ? hints.join("; ") + ". " : "") + "Use the song _id values from vibo_get_section_songs for this same section."
+    }
+  );
+}
+function isHost(perms) {
+  return perms.role === "host";
+}
+
 // src/tools/songs.ts
+var addVerifyDelaysMs = [0, 700, 1500];
+var sleep2 = (ms) => ms > 0 ? new Promise((r) => setTimeout(r, ms)) : Promise.resolve();
 function registerSongTools(server, client2) {
   server.registerTool(
     "vibo_get_section_songs",
@@ -36413,7 +36653,7 @@ function registerSongTools(server, client2) {
   server.registerTool(
     "vibo_add_song_to_section",
     {
-      description: "Add a song to a section. Pass a song from vibo_search_songs (songUrl is required; include viboSongId/title/artist when known). Before adding, check that result's `quality.confidence`: adding a `likely-not-original` result puts a cover, karaoke track or junk-metadata re-upload in front of a live DJ. If nothing looks original, report the closest matches back rather than adding a best guess. " + CONFIRM_NOTE,
+      description: "Add a song to a section. Pass a song from vibo_search_songs (songUrl is required; include viboSongId/title/artist when known). Before adding, check that result's `quality.confidence`: adding a `likely-not-original` result puts a cover, karaoke track or junk-metadata re-upload in front of a live DJ. If nothing looks original, report the closest matches back rather than adding a best guess. After adding, re-reads the section and reports an error if the song is not actually there (Vibo has answered added:true without adding). " + CONFIRM_NOTE,
       annotations: toolAnnotations({ title: "Add song to Vibo section", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
@@ -36445,7 +36685,35 @@ function registerSongTools(server, client2) {
         sectionId,
         payload
       });
-      return minifiedResult(data.addSongToSection);
+      const res = data.addSongToSection ?? {};
+      if (res.added === false) {
+        throw new McpToolError("Vibo did not add the song (added: false).", {
+          hint: "It may already be in this section, be on the do-not-play list, or the section may be full. Check with vibo_get_section_songs."
+        });
+      }
+      if (!res.songId && !viboSongId) {
+        return minifiedResult({
+          ...res,
+          verified: false,
+          note: "Vibo returned no songId and no viboSongId was passed, so the add could not be checked by re-reading. Check with vibo_get_section_songs before retrying."
+        });
+      }
+      const isOurs = (s) => !!res.songId && s._id === res.songId || !!viboSongId && s.viboSongId === viboSongId;
+      let found;
+      for (const delay of addVerifyDelaysMs) {
+        await sleep2(delay);
+        found = (await fetchSectionSongs(client2, eventId, sectionId)).find(isOurs);
+        if (found) break;
+      }
+      if (!found) {
+        throw new McpToolError(
+          "Vibo answered added:true, but the song is not in the section when re-read, so it was NOT added.",
+          {
+            hint: "Retry once; if it still fails, add it in the Vibo app. Details: " + JSON.stringify({ songId: res.songId ?? null, viboSongId: viboSongId ?? null, totalCount: res.totalCount })
+          }
+        );
+      }
+      return minifiedResult({ ...res, verified: true, song: found });
     }
   );
   server.registerTool(
@@ -36861,12 +37129,35 @@ function registerQuestionTools(server, client2, resolveUpload = nodeUploadResolv
   );
 }
 
+// src/reorder.ts
+function planMoves(order, sources, after) {
+  let current = [...order];
+  let anchor2 = after;
+  const moves = [];
+  for (const source of sources) {
+    const from = current.indexOf(source);
+    const rest = current.filter((id) => id !== source);
+    const to = anchor2 === null ? 0 : rest.indexOf(anchor2) + 1;
+    if (to !== from) {
+      moves.push({ source, target: anchor2 });
+      current = [...rest.slice(0, to), source, ...rest.slice(to)];
+    }
+    anchor2 = source;
+  }
+  return { moves, finalOrder: current };
+}
+function missingIds(wanted, have) {
+  const set2 = new Set(have);
+  return wanted.filter((id) => !set2.has(id));
+}
+
 // src/tools/song-management.ts
+var SONG_COMMENT_MAX = 90;
 function registerSongManagementTools(server, client2) {
   server.registerTool(
     "vibo_remove_song_from_section",
     {
-      description: "Remove one or more songs from a section. " + CONFIRM_NOTE,
+      description: "Remove one or more songs from a section. Every id is checked against the section first; if any is not there, nothing is sent and the missing ids are listed. " + CONFIRM_NOTE,
       annotations: toolAnnotations({ title: "Remove songs from Vibo section", readOnly: false, destructive: true }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
@@ -36876,6 +37167,8 @@ function registerSongManagementTools(server, client2) {
       })
     },
     async ({ eventId, sectionId, songIds, confirmToken }, ctx) => {
+      const songs = await fetchSectionSongs(client2, eventId, sectionId);
+      assertSongsInSection(songIds, songs);
       const vars = { eventId, sectionId, songIds };
       const gate = await confirmWrite(ctx, {
         tool: "vibo_remove_song_from_section",
@@ -36883,7 +37176,13 @@ function registerSongManagementTools(server, client2) {
         message: "Review and confirm removing these songs:",
         confirmToken,
         target: sectionId,
-        willSend: vars
+        willSend: vars,
+        context: {
+          songs: songIds.map((id) => {
+            const s = songs.find((x) => x._id === id);
+            return `${s.title ?? "?"} \u2014 ${s.artist ?? "?"}`;
+          })
+        }
       });
       if (gate) return gate;
       const data = await client2.gql(REMOVE_SECTION_SONGS, vars);
@@ -36893,7 +37192,7 @@ function registerSongManagementTools(server, client2) {
   server.registerTool(
     "vibo_update_song",
     {
-      description: "Update songs in a section: mark must-play, flag as do-not-play, and/or set a comment. Provide at least one field. " + CONFIRM_NOTE,
+      description: `Update songs in a section: mark must-play, flag as do-not-play, and/or set a comment. Provide at least one field. A comment can be at most ${SONG_COMMENT_MAX} characters (Vibo's limit; emoji count double; checked before anything is sent). ` + CONFIRM_NOTE,
       annotations: toolAnnotations({ title: "Update Vibo section songs", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
@@ -36901,7 +37200,7 @@ function registerSongManagementTools(server, client2) {
         songIds: external_exports.array(external_exports.string()).min(1).describe("Song _ids from vibo_get_section_songs."),
         isMustPlay: external_exports.boolean().optional(),
         isFlagged: external_exports.boolean().optional().describe("mark do-not-play / flagged"),
-        comment: external_exports.string().optional(),
+        comment: external_exports.string().optional().describe(`Comment for the DJ, at most ${SONG_COMMENT_MAX} characters.`),
         confirmToken: confirmTokenParam
       })
     },
@@ -36915,6 +37214,12 @@ function registerSongManagementTools(server, client2) {
           hint: "Pass isMustPlay, isFlagged, and/or comment to update the songs."
         });
       }
+      if (comment !== void 0 && comment.length > SONG_COMMENT_MAX) {
+        throw new McpToolError(
+          `Comment is ${comment.length} characters; Vibo allows at most ${SONG_COMMENT_MAX}. Nothing was sent.`,
+          { hint: `Shorten it to ${SONG_COMMENT_MAX} characters or fewer, or put the longer text in a section note.` }
+        );
+      }
       const vars = { eventId, sectionId, songIds, payload };
       const gate = await confirmWrite(ctx, {
         tool: "vibo_update_song",
@@ -36960,29 +37265,58 @@ function registerSongManagementTools(server, client2) {
   server.registerTool(
     "vibo_reorder_songs",
     {
-      description: "Reorder songs within a section. " + CONFIRM_NOTE,
+      description: "Reorder songs within a section: move sourceSongIds (in the given order) to directly after targetSongId, or to the top when it is omitted. Checks the ids against the section and, for a host, that the DJ allows hosts to order this section's songs. That setting is OFF for every section a host creates and only the DJ can turn it on, so a host usually cannot reorder songs in sections they added. Sends one reorderSongsBatch call per song that actually moves. " + CONFIRM_NOTE,
       annotations: toolAnnotations({ title: "Reorder Vibo section songs", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id."),
-        sourceSongIds: external_exports.array(external_exports.string()).min(1).describe("Song _ids from vibo_get_section_songs."),
-        targetSongId: external_exports.string().optional().describe("place the moved songs after this song _id; omit for start"),
+        sourceSongIds: external_exports.array(external_exports.string()).min(1).describe("Song _ids from vibo_get_section_songs, in the order they should end up."),
+        targetSongId: external_exports.string().optional().describe("place the moved songs directly after this song _id; omit for the top"),
         confirmToken: confirmTokenParam
       })
     },
     async ({ eventId, sectionId, sourceSongIds, targetSongId, confirmToken }, ctx) => {
-      const vars = { eventId, sectionId, sourceSongIds, targetSongId: targetSongId ?? null };
+      if (new Set(sourceSongIds).size !== sourceSongIds.length) {
+        throw new McpToolError("sourceSongIds contains a duplicate.", { hint: "List each song once." });
+      }
+      if (targetSongId !== void 0 && sourceSongIds.includes(targetSongId)) {
+        throw new McpToolError("targetSongId is also one of the songs being moved.", {
+          hint: "Pick a target outside sourceSongIds."
+        });
+      }
+      const [perms, sections, songs] = await Promise.all([
+        fetchEventPermissions(client2, eventId),
+        fetchSections(client2, eventId),
+        fetchSectionSongs(client2, eventId, sectionId)
+      ]);
+      const section = findSection(sections, sectionId);
+      if (isHost(perms) && section.settings?.canHostsOrderSongs === false) {
+        throw new McpToolError(
+          `The DJ has turned off host song ordering for "${section.name}", so Vibo refuses reorders from hosts there. Nothing was sent.`,
+          {
+            hint: "It's the section's canHostsOrderSongs setting. Vibo turns it off for sections a host creates, and only the DJ can turn it on (a host update is ignored). Ask the DJ, or leave a comment on the song instead."
+          }
+        );
+      }
+      assertSongsInSection([...sourceSongIds, ...targetSongId ? [targetSongId] : []], songs);
+      const { moves } = planMoves(songs.map((s) => s._id), sourceSongIds, targetSongId ?? null);
+      if (moves.length === 0) {
+        return minifiedResult({ changed: false, message: "Those songs are already in that order." });
+      }
+      const calls = moves.map((m) => ({ sourceSongIds: [m.source], targetSongId: m.target }));
       const gate = await confirmWrite(ctx, {
         tool: "vibo_reorder_songs",
         mutation: "reorderSongsBatch",
         message: "Review and confirm this reorder:",
         confirmToken,
         target: sectionId,
-        willSend: vars
+        willSend: { eventId, sectionId, calls }
       });
       if (gate) return gate;
-      const data = await client2.gql(REORDER_SONGS, vars);
-      return minifiedResult(data.reorderSongsBatch);
+      for (const c of calls) {
+        await client2.gql(REORDER_SONGS, { eventId, sectionId, ...c });
+      }
+      return minifiedResult({ changed: true, callsSent: calls.length });
     }
   );
 }
@@ -37369,6 +37703,264 @@ function registerSectionEditTools(server, client2) {
   );
 }
 
+// src/tools/section-manage.ts
+var SECTION_NAME_MAX = 45;
+var DEFAULT_SECTION_SETTINGS = {
+  timeEnabled: true,
+  songsEnabled: true,
+  notesEnabled: true,
+  canHostsOrderSongs: true,
+  canHostDeleteSection: true,
+  notesVisibleForHosts: true,
+  canHostChangeSectionName: true,
+  canHostChangeSectionTime: true
+};
+var VISIBILITY_SETTINGS = {
+  host: { visibleForGuests: false, visibleForHosts: true },
+  // "Me and DJ"
+  public: { visibleForGuests: true, visibleForHosts: true }
+  // "Guests"
+};
+var PROTECTED_TYPES = /* @__PURE__ */ new Set(["dontPlay", "headline"]);
+var TIME_PATTERN = /^(0?[1-9]|1[0-2]):([0-5]\d)\s*([ap])\.?m\.?$/i;
+function normalizeTime(time3) {
+  const m = TIME_PATTERN.exec(time3.trim());
+  if (!m) return void 0;
+  return `${m[1].padStart(2, "0")}:${m[2]} ${m[3].toLowerCase()}m`;
+}
+function assertCanWriteTimeline(perms, flag, what) {
+  if (!isHost(perms)) return;
+  if (perms.isLocked) {
+    throw new McpToolError(`This event is locked, so hosts can't ${what}. Nothing was sent.`, {
+      hint: "The DJ locks an event close to the date; ask them to unlock it or make the change."
+    });
+  }
+  if (perms.settings?.[flag] === false) {
+    throw new McpToolError(`The DJ has turned off "${flag}" for this event, so hosts can't ${what}. Nothing was sent.`, {
+      hint: "It's an event setting only the DJ can change \u2014 ask them to enable it or make the change."
+    });
+  }
+}
+var sectionLabel = (s) => ({ _id: s._id, name: s.name });
+function registerSectionManageTools(server, client2) {
+  server.registerTool(
+    "vibo_create_section",
+    {
+      description: `Create a new timeline section. Name is required, max ${SECTION_NAME_MAX} characters (Vibo's limit, checked before anything is sent). Place it with afterSectionId (directly after that section) or position (0-based index; 0 = first); with neither it goes at the end of the timeline, like the web app. visibility "host" (default) = "Me and DJ", "public" = visible to guests too. Vibo gives a section a host creates "hosts can order songs" = off, which only the DJ can turn on. Returns the new section _id. ` + CONFIRM_NOTE,
+      annotations: toolAnnotations({ title: "Create Vibo section", readOnly: false, destructive: false }),
+      inputSchema: external_exports.object({
+        eventId: external_exports.string().describe("Event id."),
+        name: external_exports.string().describe(`Section name, 1\u2013${SECTION_NAME_MAX} characters.`),
+        visibility: external_exports.enum(["host", "public"]).optional().describe('"host" (default) = Me and DJ only; "public" = guests can see it too.'),
+        time: external_exports.string().optional().describe('Scheduled time as "hh:mm am/pm", e.g. "05:30 pm".'),
+        note: external_exports.string().optional().describe("Note to the DJ (set right after creating, via updateSection)."),
+        afterSectionId: external_exports.string().optional().describe("Put the new section directly after this section _id."),
+        position: external_exports.number().int().min(0).optional().describe("0-based timeline index for the new section; past the end appends. Use instead of afterSectionId."),
+        confirmToken: confirmTokenParam
+      })
+    },
+    async ({ eventId, name, visibility, time: time3, note, afterSectionId, position, confirmToken }, ctx) => {
+      const trimmed = name.trim();
+      if (!trimmed) {
+        throw new McpToolError("Section name is empty.", { hint: "Pass a name of 1\u201345 characters." });
+      }
+      if (trimmed.length > SECTION_NAME_MAX) {
+        throw new McpToolError(
+          `Section name is ${trimmed.length} characters; Vibo allows at most ${SECTION_NAME_MAX}. Nothing was sent.`,
+          { hint: `Shorten the name to ${SECTION_NAME_MAX} characters or fewer.` }
+        );
+      }
+      let normalizedTime;
+      if (time3 !== void 0 && time3.trim() !== "") {
+        normalizedTime = normalizeTime(time3);
+        if (!normalizedTime) {
+          throw new McpToolError(`"${time3}" is not a 12-hour time.`, { hint: 'Use "hh:mm am/pm", e.g. "05:30 pm".' });
+        }
+      }
+      if (afterSectionId !== void 0 && position !== void 0) {
+        throw new McpToolError("Pass afterSectionId or position, not both.", {
+          hint: "afterSectionId places it after a named section; position places it at a 0-based index."
+        });
+      }
+      const [perms, sections] = await Promise.all([fetchEventPermissions(client2, eventId), fetchSections(client2, eventId)]);
+      assertCanWriteTimeline(perms, "canHostCreateSections", "add sections");
+      let insertBefore;
+      let placedAfter;
+      if (afterSectionId !== void 0) {
+        const anchor2 = findSection(sections, afterSectionId);
+        insertBefore = sections[sections.indexOf(anchor2) + 1];
+        placedAfter = anchor2;
+      } else if (position !== void 0) {
+        insertBefore = sections[position];
+        placedAfter = position === 0 ? null : sections[Math.min(position, sections.length) - 1] ?? null;
+      } else {
+        placedAfter = sections[sections.length - 1] ?? null;
+      }
+      const payload = {
+        type: "simple",
+        name: trimmed,
+        settings: {
+          ...DEFAULT_SECTION_SETTINGS,
+          ...perms.settings?.sectionSongsLimit != null ? { songsLimit: perms.settings.sectionSongsLimit } : {},
+          ...perms.settings?.sectionMustPlayLimit != null ? { mustPlayLimit: perms.settings.sectionMustPlayLimit } : {},
+          ...VISIBILITY_SETTINGS[visibility ?? "host"]
+        }
+      };
+      if (normalizedTime) payload.time = normalizedTime;
+      if (insertBefore) payload.insertBeforeSectionId = insertBefore._id;
+      const willSend = { eventId, payload };
+      if (note !== void 0) willSend.thenUpdateSection = { payload: { note } };
+      const gate = await confirmWrite(ctx, {
+        tool: "vibo_create_section",
+        mutation: note !== void 0 ? "createSection, then updateSection (note)" : "createSection",
+        message: `Review and confirm creating section "${trimmed}":`,
+        confirmToken,
+        target: eventId,
+        willSend,
+        context: { placedAfter: placedAfter ? sectionLabel(placedAfter) : "start of timeline" }
+      });
+      if (gate) return gate;
+      const created = (await client2.gql(CREATE_SECTION, {
+        eventId,
+        payload
+      })).createSection;
+      let noteResult;
+      if (note !== void 0) {
+        noteResult = (await client2.gql(UPDATE_SECTION, {
+          eventId,
+          sectionId: created._id,
+          payload: { note }
+        })).updateSection?.note;
+      }
+      let placement = "unverified";
+      const after = await fetchSections(client2, eventId);
+      const order = after.map((s) => s._id);
+      if (order.includes(created._id) && (!placedAfter || order.includes(placedAfter._id))) {
+        const { moves } = planMoves(order, [created._id], placedAfter?._id ?? null);
+        for (const m of moves) {
+          await client2.gql(REORDER_SECTIONS, { eventId, sourceSectionId: m.source, targetSectionId: m.target });
+        }
+        placement = moves.length ? "fixed-by-reorder" : "as-requested";
+      }
+      return minifiedResult({
+        ...created,
+        ...note !== void 0 ? { note: noteResult ?? note } : {},
+        placedAfter: placedAfter ? sectionLabel(placedAfter) : null,
+        placement
+      });
+    }
+  );
+  server.registerTool(
+    "vibo_delete_section",
+    {
+      description: `Delete a timeline section, with every song, answer and comment in it \u2014 this cannot be undone. The preview names the section and how many songs and answered questions it holds. Sections of type "dontPlay" (the DJ's do-not-play list) and "headline" (timeline dividers) are refused unless force:true. ` + CONFIRM_NOTE,
+      annotations: toolAnnotations({ title: "Delete Vibo section", readOnly: false, destructive: true }),
+      inputSchema: external_exports.object({
+        eventId: external_exports.string().describe("Event id."),
+        sectionId: external_exports.string().describe("Section _id from vibo_list_sections."),
+        force: external_exports.boolean().optional().describe('Required to delete a "dontPlay" or "headline" section.'),
+        confirmToken: confirmTokenParam
+      })
+    },
+    async ({ eventId, sectionId, force, confirmToken }, ctx) => {
+      const section = findSection(await fetchSections(client2, eventId), sectionId);
+      if (PROTECTED_TYPES.has(section.type) && !force) {
+        throw new McpToolError(
+          `"${section.name}" is a ${section.type} section${section.type === "dontPlay" ? " (the DJ's do-not-play list)" : " (a timeline divider)"}; refusing to delete it. Nothing was sent.`,
+          { hint: "Pass force:true only if the user explicitly wants this section gone." }
+        );
+      }
+      if (section.canRemove === false) {
+        throw new McpToolError(`Vibo reports you can't delete "${section.name}". Nothing was sent.`, {
+          hint: 'The DJ controls who may delete each section ("Who can delete section"); ask them to allow it or delete it.'
+        });
+      }
+      const summary = {
+        name: section.name,
+        type: section.type,
+        songsCount: section.songsCount,
+        questionsAnswered: `${section.answeredCount}/${section.questionsCount}`
+      };
+      const vars = { eventId, sectionId };
+      const gate = await confirmWrite(ctx, {
+        tool: "vibo_delete_section",
+        mutation: "removeSection",
+        message: `Delete section "${section.name}"? It holds ${section.songsCount} song(s) and ${section.answeredCount} of ${section.questionsCount} answered question(s). This cannot be undone.`,
+        confirmToken,
+        target: sectionId,
+        willSend: vars,
+        context: summary
+      });
+      if (gate) return gate;
+      const data = await client2.gql(REMOVE_SECTION, vars);
+      if (data.removeSection !== true) {
+        throw new McpToolError(`Vibo did not confirm deleting "${section.name}" (removeSection returned ${String(data.removeSection)}).`, {
+          hint: "Re-check with vibo_list_sections before retrying."
+        });
+      }
+      return minifiedResult({ deleted: true, section: { _id: sectionId, ...summary } });
+    }
+  );
+  server.registerTool(
+    "vibo_reorder_sections",
+    {
+      description: "Move one or more timeline sections to directly after targetSectionId (omit it to move them to the start), keeping the given order. Mirrors vibo_reorder_songs. Sends one reorderSections call per section that actually moves. " + CONFIRM_NOTE,
+      annotations: toolAnnotations({ title: "Reorder Vibo sections", readOnly: false, destructive: false }),
+      inputSchema: external_exports.object({
+        eventId: external_exports.string().describe("Event id."),
+        sourceSectionIds: external_exports.array(external_exports.string()).min(1).describe("Section _ids to move, in the order they should end up."),
+        targetSectionId: external_exports.string().optional().describe("Place the moved sections right after this section _id; omit for the start."),
+        confirmToken: confirmTokenParam
+      })
+    },
+    async ({ eventId, sourceSectionIds, targetSectionId, confirmToken }, ctx) => {
+      if (new Set(sourceSectionIds).size !== sourceSectionIds.length) {
+        throw new McpToolError("sourceSectionIds contains a duplicate.", { hint: "List each section once." });
+      }
+      if (targetSectionId !== void 0 && sourceSectionIds.includes(targetSectionId)) {
+        throw new McpToolError("targetSectionId is also one of the sections being moved.", {
+          hint: "Pick a target outside sourceSectionIds (the moved sections keep their given order)."
+        });
+      }
+      const [perms, sections] = await Promise.all([fetchEventPermissions(client2, eventId), fetchSections(client2, eventId)]);
+      const order = sections.map((s) => s._id);
+      const missing = missingIds([...sourceSectionIds, ...targetSectionId ? [targetSectionId] : []], order);
+      if (missing.length) {
+        throw new McpToolError(`Not in this event's timeline: ${missing.join(", ")}. Nothing was sent.`, {
+          hint: "Get section ids from vibo_list_sections for the same eventId."
+        });
+      }
+      assertCanWriteTimeline(perms, "canHostReorderSections", "reorder sections");
+      const byId = new Map(sections.map((s) => [s._id, s]));
+      const { moves, finalOrder } = planMoves(order, sourceSectionIds, targetSectionId ?? null);
+      const after = targetSectionId ? sectionLabel(byId.get(targetSectionId)) : "start of timeline";
+      if (moves.length === 0) {
+        return minifiedResult({ changed: false, message: "Those sections are already in that order.", after });
+      }
+      const calls = moves.map((m) => ({ sourceSectionId: m.source, targetSectionId: m.target }));
+      const gate = await confirmWrite(ctx, {
+        tool: "vibo_reorder_sections",
+        mutation: "reorderSections",
+        message: `Review and confirm moving ${sourceSectionIds.length} section(s):`,
+        confirmToken,
+        target: eventId,
+        willSend: { eventId, calls },
+        context: { moving: sourceSectionIds.map((id) => byId.get(id).name), after }
+      });
+      if (gate) return gate;
+      for (const c of calls) {
+        await client2.gql(REORDER_SECTIONS, { eventId, ...c });
+      }
+      return minifiedResult({
+        changed: true,
+        callsSent: calls.length,
+        after,
+        newPositions: sourceSectionIds.map((id) => ({ ...sectionLabel(byId.get(id)), index: finalOrder.indexOf(id) }))
+      });
+    }
+  );
+}
+
 // src/tools/uploads.ts
 function registerUploadTools(server, client2, resolveUpload = nodeUploadResolver) {
   server.registerTool(
@@ -37441,8 +38033,9 @@ async function captureViboSession(deps = {}) {
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
+    const bridgeHint = err?.hint;
     throw new McpToolError(`Vibo browser token capture failed: ${msg}`, {
-      hint: "Install the fetchproxy browser extension, sign into https://web.vibodj.com, approve the pair code, then retry.",
+      hint: typeof bridgeHint === "string" && bridgeHint ? bridgeHint : "Install the ContextMint Bridge browser extension (https://github.com/nullnet-app/contextmint-bridge/releases), sign into https://web.vibodj.com, approve the pair code, then retry.",
       cause: err
     });
   }
@@ -37450,7 +38043,7 @@ async function captureViboSession(deps = {}) {
   const refreshToken = session.localStorage?.["x-refresh-token"] ?? null;
   if (!accessToken) {
     throw new McpToolError("No Vibo token found in the signed-in browser tab.", {
-      hint: "Make sure you are signed into https://web.vibodj.com in the browser with the fetchproxy extension, then retry."
+      hint: "Make sure you are signed into https://web.vibodj.com in the browser with ContextMint Bridge, then retry."
     });
   }
   return { accessToken, refreshToken };
@@ -37461,7 +38054,7 @@ function registerSessionTools(server, client2) {
   server.registerTool(
     "vibo_capture_session",
     {
-      description: "Capture your Vibo login from a signed-in web.vibodj.com browser tab via the fetchproxy bridge \u2014 for accounts that sign in with Apple/Google/Facebook (no password). Requires the fetchproxy browser extension installed and you signed into https://web.vibodj.com; approve the pair code shown on first use. The token is saved locally and reused on future calls.",
+      description: "Capture your Vibo login from a signed-in web.vibodj.com browser tab via ContextMint Bridge \u2014 for accounts that sign in with Apple/Google/Facebook (no password). Requires the ContextMint Bridge browser extension installed and you signed into https://web.vibodj.com; approve the pair code shown on first use. The token is saved locally and reused on future calls.",
       annotations: toolAnnotations({ title: "Capture Vibo session (SSO)", readOnly: false, destructive: false })
     },
     async () => {
@@ -37502,13 +38095,14 @@ await runMcp({
     registerImportTools,
     registerCollaborationTools,
     registerSectionEditTools,
+    registerSectionManageTools,
     registerUploadTools,
     registerSessionTools
   ]
 });
 /*! Bundled license information:
 
-@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs:
+@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson