mcp-scraper 0.1.6 → 0.1.8

package/dist/{server-2Y27U4TO.js → server-QXVVTKJP.js}

@@ -3,8 +3,10 @@ import {
   CaptureSerpSnapshotInputSchema,
   HttpMcpToolExecutor,
   buildPaaExtractorMcpServer,
-  harvestTimeoutBudget
-} from "./chunk-6TWZS2FQ.js";
+  configureReportSaving,
+  harvestTimeoutBudget,
+  liveWebToolAnnotations
+} from "./chunk-RE6HCRYC.js";
 import {
   BALANCE_PACK_LABELS,
   BALANCE_PRICE_IDS,
@@ -20,20 +22,27 @@ import {
   harvestProblemResponse,
   insufficientBalanceResponse,
   serializeHarvestProblem
-} from "./chunk-7HB7NDOY.js";
+} from "./chunk-ZK456YXN.js";
 import {
   BrowserDriver,
-  CaptchaError,
   MapsPlaceOptionsSchema,
+  MapsSearchOptionsSchema,
   MapsSelectors,
   RawMapsAboutAttributeSchema,
   RawMapsHoursRowSchema,
   RawMapsOverviewSchema,
   RawMapsReviewStatsSchema,
+  browserServiceApiKey,
+  browserServiceProxyId,
   buildYouTubeChannelVideosUrl,
   harvest,
   resolveKernelProxyId
-} from "./chunk-W4P2U5VF.js";
+} from "./chunk-TM22BLWP.js";
+import {
+  CaptchaError,
+  RECAPTCHA_INSTRUCTIONS,
+  sanitizeVendorName
+} from "./chunk-ZMOWIBMK.js";
 import {
   SiteAuditJobRowSchema,
   cancelJob,
@@ -77,6 +86,53 @@ import {
   verifyPassword
 } from "./chunk-D4CJBZBY.js";
 
+// src/api/outbound-sanitize.ts
+var KEY_RENAMES = {
+  kernel: "browserRuntime",
+  kernel_session_id: "browser_session_id",
+  kernel_delete_started: "session_cleanup_started",
+  kernel_delete_succeeded: "session_cleanup_succeeded",
+  kernel_delete_error: "session_cleanup_error",
+  kernelSessionId: "browserSessionId",
+  kernelDeleteStarted: "sessionCleanupStarted",
+  kernelDeleteSucceeded: "sessionCleanupSucceeded",
+  kernelDeleteError: "sessionCleanupError",
+  kernelProxyId: "proxyId"
+};
+var SANITIZED_VALUE_KEYS = /error|message/i;
+function sanitizeOutboundDiagnostics(value, parentKey = "") {
+  if (typeof value === "string") {
+    if (SANITIZED_VALUE_KEYS.test(parentKey) && /kernel/i.test(value)) {
+      return sanitizeVendorName(value);
+    }
+    return value;
+  }
+  if (Array.isArray(value)) return value.map((v) => sanitizeOutboundDiagnostics(v, parentKey));
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key, val] of Object.entries(value)) {
+      const renamed = KEY_RENAMES[key] ?? key;
+      out[renamed] = sanitizeOutboundDiagnostics(val, key);
+    }
+    return out;
+  }
+  return value;
+}
+function sanitizeAttempts(attempts) {
+  return attempts.map((a) => sanitizeOutboundDiagnostics(a));
+}
+function sanitizeHarvestResult(result) {
+  const diagnostics = result?.diagnostics;
+  if (!diagnostics?.debug) return result;
+  return {
+    ...result,
+    diagnostics: {
+      ...diagnostics,
+      debug: sanitizeOutboundDiagnostics(diagnostics.debug)
+    }
+  };
+}
+
 // src/blog/registry.ts
 var posts = [
   {
@@ -3439,7 +3495,7 @@ import TurndownService from "turndown";
 import Kernel from "@onkernel/sdk";
 import { chromium } from "playwright";
 async function fetchWithKernel(url) {
-  const apiKey = process.env.KERNEL_API_KEY;
+  const apiKey = browserServiceApiKey();
   if (!apiKey) throw new Error("Browser backend API key not set");
   const client = new Kernel({ apiKey });
   const kb = await client.browsers.create({ stealth: true, timeout_seconds: 60 });
@@ -3474,9 +3530,9 @@ async function extractKpo(opts) {
           redirect: "manual"
         });
         if (res.status >= 300 && res.status < 400) {
-          const location = res.headers.get("location");
-          if (!location) return null;
-          const next = new URL(location, target).href;
+          const location2 = res.headers.get("location");
+          if (!location2) return null;
+          const next = new URL(location2, target).href;
           const checkedRedirect = await validatePublicHttpUrl(next, { field: "redirect URL" });
           if (checkedRedirect.error || !checkedRedirect.parsed) return null;
           target = checkedRedirect.parsed.href;
@@ -7606,7 +7662,7 @@ async function writeOutputs(result, outputDir) {
   }
 }
 async function ytHarvest(rawOptions) {
-  const kernelApiKey = process.env.KERNEL_API_KEY;
+  const kernelApiKey = browserServiceApiKey();
   if (!kernelApiKey) {
     throw new Error("A browser backend API key is required \u2014 YouTube harvesting requires a stealth session.");
   }
@@ -7701,7 +7757,7 @@ function parseTimedtextXml(xml) {
   return results;
 }
 async function fetchViaKernelInnertube(videoId) {
-  const kernelApiKey = process.env.KERNEL_API_KEY;
+  const kernelApiKey = browserServiceApiKey();
   if (!kernelApiKey) return null;
   const driver = new BrowserDriver();
   const start = Date.now();
@@ -7845,7 +7901,7 @@ async function attemptKernelWhisper(videoId, kernelApiKey, falKey, start) {
   }
 }
 async function fetchViaKernelWhisper(videoId) {
-  const kernelApiKey = process.env.KERNEL_API_KEY;
+  const kernelApiKey = browserServiceApiKey();
   const falKey = process.env.FAL_KEY;
   if (!kernelApiKey || !falKey) return null;
   const start = Date.now();
@@ -8116,7 +8172,7 @@ screenshotApp.post("/", async (c) => {
     }
     const device2 = body.device === "mobile" ? "mobile" : "desktop";
     try {
-      const buf = await captureScreenshot(parsedFallback.href, process.env.KERNEL_API_KEY?.trim(), device2);
+      const buf = await captureScreenshot(parsedFallback.href, browserServiceApiKey(), device2);
       return new Response(new Uint8Array(buf), {
         status: 200,
         headers: {
@@ -8132,7 +8188,7 @@ screenshotApp.post("/", async (c) => {
   }
   const device = body.device === "mobile" ? "mobile" : "desktop";
   try {
-    const buf = await captureScreenshot(urlCheck.parsed.href, process.env.KERNEL_API_KEY?.trim(), device);
+    const buf = await captureScreenshot(urlCheck.parsed.href, browserServiceApiKey(), device);
     return new Response(new Uint8Array(buf), {
       status: 200,
       headers: {
@@ -8959,23 +9015,23 @@ function buildPageIntelUrl(body, country) {
   return `https://www.facebook.com/ads/library/?active_status=all&ad_type=all&country=${country}&q=${encodeURIComponent(body.query.trim())}&search_type=keyword_unordered`;
 }
 function kernelLaunchOpts() {
-  return { headless: true, kernelApiKey: process.env.KERNEL_API_KEY?.trim(), kernelProxyId: process.env.KERNEL_PROXY_ID?.trim(), viewport: { width: 1280, height: 900 }, locale: "en-US" };
+  return { headless: true, kernelApiKey: browserServiceApiKey(), kernelProxyId: browserServiceProxyId(), viewport: { width: 1280, height: 900 }, locale: "en-US" };
 }
 async function kernelLaunchOptsResidential() {
-  let proxyId = process.env.KERNEL_PROXY_ID?.trim();
+  let proxyId = browserServiceProxyId();
   try {
     const resolution = await resolveKernelProxyId({
-      kernelApiKey: process.env.KERNEL_API_KEY?.trim(),
+      kernelApiKey: browserServiceApiKey(),
       proxyMode: "location",
-      configuredKernelProxyId: process.env.KERNEL_PROXY_ID?.trim(),
+      configuredKernelProxyId: browserServiceProxyId(),
       location: "New York, NY",
       gl: "us"
     });
     if (resolution.kernelProxyId) proxyId = resolution.kernelProxyId;
   } catch {
-    proxyId = process.env.KERNEL_PROXY_ID?.trim();
+    proxyId = browserServiceProxyId();
   }
-  return { headless: true, kernelApiKey: process.env.KERNEL_API_KEY?.trim(), kernelProxyId: proxyId, viewport: { width: 1280, height: 900 }, locale: "en-US" };
+  return { headless: true, kernelApiKey: browserServiceApiKey(), kernelProxyId: proxyId, viewport: { width: 1280, height: 900 }, locale: "en-US" };
 }
 var facebookAdApp = new Hono4();
 facebookAdApp.post("/ad", createApiKeyAuth(), async (c) => {
@@ -9242,8 +9298,8 @@ var MapsNavigator = class {
     this.page = page;
   }
   page;
-  async navigateToPlacePage(businessName, location) {
-    const query = `${businessName} ${location}`;
+  async navigateToPlacePage(businessName, location2) {
+    const query = `${businessName} ${location2}`;
     const searchUrl = `https://www.google.com/maps/search/${encodeURIComponent(query)}`;
     await this.page.goto(searchUrl, { waitUntil: "domcontentloaded", timeout: 45e3 });
     const onPlacePage = await this.page.evaluate(() => /\/maps\/place\//.test(window.location.href));
@@ -9668,8 +9724,213 @@ var MapsExtractor = class {
   }
 };
 
+// src/extractor/MapsSearchExtractor.ts
+var MAPS_SEARCH_SCROLL_BUDGET_MS = 6e4;
+var MAPS_SEARCH_SCROLL_STEP_MS = 1200;
+var MAPS_SEARCH_MAX_NO_GROWTH_ROUNDS = 4;
+var MapsSearchExtractor = class {
+  constructor(driver) {
+    this.driver = driver;
+  }
+  driver;
+  async extract(options) {
+    const startMs = Date.now();
+    const searchQuery = [options.query, options.location].filter(Boolean).join(" ");
+    const searchUrl = `https://www.google.com/maps/search/${encodeURIComponent(searchQuery)}?hl=${encodeURIComponent(options.hl)}`;
+    const config = {
+      headless: options.headless,
+      kernelApiKey: options.kernelApiKey,
+      kernelProxyId: options.kernelProxyId,
+      viewport: { width: 1280, height: 900 },
+      locale: `${options.hl}-${options.gl.toUpperCase()}`
+    };
+    try {
+      await this.driver.launch(config);
+      const page = this.driver.getPage();
+      await page.goto(searchUrl, { waitUntil: "domcontentloaded", timeout: 6e4 });
+      await page.waitForTimeout(3e3);
+      const blocked = await this.detectBlock(page);
+      if (blocked) throw new CaptchaError(RECAPTCHA_INSTRUCTIONS);
+      const results = await this.collectResults(page, options.maxResults);
+      return {
+        query: options.query,
+        location: options.location ?? null,
+        searchQuery,
+        searchUrl,
+        extractedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        requestedMaxResults: options.maxResults,
+        resultCount: results.length,
+        results,
+        durationMs: Date.now() - startMs
+      };
+    } finally {
+      await this.driver.close();
+    }
+  }
+  async detectBlock(page) {
+    return page.evaluate(() => {
+      const text = document.body.innerText.slice(0, 2e3);
+      return /unusual traffic|captcha|recaptcha|about this page/i.test(text) || /\/sorry\//.test(location.href);
+    });
+  }
+  async collectResults(page, maxResults) {
+    const seen = /* @__PURE__ */ new Map();
+    const started = Date.now();
+    let noGrowthRounds = 0;
+    while (Date.now() - started < MAPS_SEARCH_SCROLL_BUDGET_MS) {
+      const before = seen.size;
+      const batch = await this.extractVisibleResults(page);
+      for (const result of batch) {
+        const key = this.resultKey(result);
+        if (!seen.has(key)) seen.set(key, { ...result, position: seen.size + 1 });
+        if (seen.size >= maxResults) break;
+      }
+      if (seen.size >= maxResults) break;
+      if (seen.size === before) noGrowthRounds += 1;
+      else noGrowthRounds = 0;
+      if (noGrowthRounds >= MAPS_SEARCH_MAX_NO_GROWTH_ROUNDS) break;
+      await page.evaluate(() => {
+        const feed = document.querySelector('[role="feed"]');
+        if (feed) {
+          feed.scrollTop = feed.scrollHeight;
+        } else {
+          window.scrollTo(0, document.body.scrollHeight);
+        }
+      });
+      await page.waitForTimeout(MAPS_SEARCH_SCROLL_STEP_MS);
+    }
+    return [...seen.values()].slice(0, maxResults);
+  }
+  resultKey(result) {
+    return result.cidDecimal ?? result.placeUrl.replace(/[?&].*$/, "") ?? result.name;
+  }
+  async extractVisibleResults(page) {
+    return page.evaluate(() => {
+      function normalizeText(value) {
+        const text = value?.replace(/\s+/g, " ").trim() ?? "";
+        return text || null;
+      }
+      function cidFromUrl(url) {
+        const fid = url.match(/!1s(0x[0-9a-f]+):(0x[0-9a-f]+)/i);
+        if (!fid) return { cid: null, cidDecimal: null };
+        let cidDecimal = null;
+        try {
+          cidDecimal = BigInt(fid[2]).toString();
+        } catch {
+        }
+        return { cid: `${fid[1]}:${fid[2]}`, cidDecimal };
+      }
+      function textParts(card) {
+        if (!card) return [];
+        const parts = [];
+        card.querySelectorAll("div, span").forEach((el2) => {
+          const text = Array.from(el2.childNodes).filter((node) => node.nodeType === 3).map((node) => node.textContent?.trim() ?? "").filter((text2) => text2.length > 1 && text2.length < 140).join(" ");
+          if (text && !parts.includes(text)) parts.push(text);
+        });
+        return parts;
+      }
+      function firstMatching(parts, pattern) {
+        const value = parts.find((part) => pattern.test(part));
+        return value ?? null;
+      }
+      const out = [];
+      const seen = /* @__PURE__ */ new Set();
+      const anchors = Array.from(document.querySelectorAll('a[href*="/maps/place/"]'));
+      for (const anchor of anchors) {
+        const placeUrl = anchor.href;
+        const stableUrl = placeUrl.replace(/[?&].*$/, "");
+        if (seen.has(stableUrl)) continue;
+        seen.add(stableUrl);
+        const card = anchor.closest('.Nv2PK, [role="article"], .bfdHYd') ?? anchor.parentElement;
+        const parts = textParts(card);
+        const aria = normalizeText(anchor.getAttribute("aria-label"));
+        const heading = normalizeText(card?.querySelector('.qBF1Pd, .fontHeadlineSmall, [role="heading"]')?.textContent);
+        const name = aria ?? heading ?? parts[0] ?? stableUrl;
+        const links = Array.from(card?.querySelectorAll("a[href]") ?? []);
+        const websiteUrl = links.find((link) => link.href.startsWith("http") && !link.href.includes("google."))?.href ?? null;
+        const directionsUrl = links.find((link) => /google\.[^/]+\/maps\/dir|\/dir\//i.test(link.href))?.href ?? null;
+        const rating = firstMatching(parts, /^\d(?:\.\d)?$/);
+        const reviewCountRaw = firstMatching(parts, /^\(?[\d,]+\)?$/);
+        const category = parts.find((part) => !/^\d(?:\.\d)?$|^\(?[\d,]+\)?$|open|closed|directions|website/i.test(part)) ?? null;
+        const address = parts.find((part) => /\b[A-Z]{2}\s+\d{5}\b|\b(?:St|Street|Ave|Avenue|Rd|Road|Blvd|Drive|Dr)\b/i.test(part)) ?? null;
+        const { cid, cidDecimal } = cidFromUrl(placeUrl);
+        out.push({
+          position: out.length + 1,
+          name,
+          placeUrl,
+          cid,
+          cidDecimal,
+          rating,
+          reviewCount: reviewCountRaw ? reviewCountRaw.replace(/[()]/g, "") : null,
+          category,
+          address,
+          websiteUrl,
+          directionsUrl,
+          metadata: parts.slice(0, 20)
+        });
+      }
+      return out;
+    });
+  }
+};
+
 // src/api/maps-routes.ts
+function mapsErrorResponse(c, msg, errorCode) {
+  const blocked = msg.includes("CAPTCHA") || msg.includes("blocked");
+  return c.json({
+    error: sanitizeVendorName(msg),
+    error_code: blocked ? "captcha_or_blocked" : errorCode,
+    retryable: blocked
+  }, blocked ? 503 : 500);
+}
 var mapsApp = new Hono5();
+mapsApp.post("/search", createApiKeyAuth(), async (c) => {
+  const user = c.get("user");
+  const body = await c.req.json().catch(() => ({}));
+  const parsed = MapsSearchOptionsSchema.safeParse({
+    kernelApiKey: process.env.KERNEL_API_KEY,
+    ...body
+  });
+  if (!parsed.success) {
+    return c.json({ error: parsed.error.issues[0]?.message ?? "Invalid request" }, 400);
+  }
+  const { ok, balance_mc } = await debitMc(
+    user.id,
+    MC_COSTS.maps_search,
+    LedgerOperation.MAPS_SEARCH,
+    [parsed.data.query, parsed.data.location].filter(Boolean).join(" ")
+  );
+  if (!ok) return c.json(insufficientBalanceResponse(balance_mc, MC_COSTS.maps_search), 402);
+  const driver = new BrowserDriver();
+  const extractor = new MapsSearchExtractor(driver);
+  try {
+    const result = await extractor.extract(parsed.data);
+    await logRequestEvent({
+      userId: user.id,
+      source: "maps_search",
+      status: "done",
+      query: result.searchQuery,
+      location: parsed.data.location,
+      resultCount: result.resultCount,
+      result
+    });
+    return c.json(result);
+  } catch (err) {
+    await creditMc(user.id, MC_COSTS.maps_search, LedgerOperation.REFUND, "failed maps_search call");
+    const msg = err instanceof Error ? err.message : String(err);
+    await logRequestEvent({
+      userId: user.id,
+      source: "maps_search",
+      status: "failed",
+      query: [parsed.data.query, parsed.data.location].filter(Boolean).join(" "),
+      location: parsed.data.location,
+      error: msg
+    });
+    return mapsErrorResponse(c, msg, "maps_search_failed");
+  } finally {
+    await driver.close();
+  }
+});
 mapsApp.post("/place", createApiKeyAuth(), async (c) => {
   const user = c.get("user");
   const body = await c.req.json().catch(() => ({}));
@@ -9736,10 +9997,7 @@ mapsApp.post("/place", createApiKeyAuth(), async (c) => {
       location: parsed.data.location,
       error: msg
     });
-    if (msg.includes("CAPTCHA") || msg.includes("blocked")) {
-      return c.json({ error: msg }, 503);
-    }
-    return c.json({ error: msg }, 500);
+    return mapsErrorResponse(c, msg, "maps_place_failed");
   } finally {
     await driver.close();
   }
@@ -10419,8 +10677,8 @@ async function captureSerpIntelligenceSnapshot(rawInput, runtimeOptions = {}) {
       debug,
       serpOnly: true,
       headless: runtimeOptions.headless ?? true,
-      kernelApiKey: runtimeOptions.kernelApiKey ?? process.env.KERNEL_API_KEY?.trim(),
-      kernelProxyId: runtimeOptions.kernelProxyId ?? process.env.KERNEL_PROXY_ID?.trim(),
+      kernelApiKey: runtimeOptions.kernelApiKey ?? browserServiceApiKey(),
+      kernelProxyId: runtimeOptions.kernelProxyId ?? browserServiceProxyId(),
       format: "json",
       outputDir: runtimeOptions.outputDir ?? "/tmp/serp-intelligence-output",
       signal: runtimeOptions.signal,
@@ -10431,7 +10689,7 @@ async function captureSerpIntelligenceSnapshot(rawInput, runtimeOptions = {}) {
     const pageSnapshotLimit = normalizePageSnapshotLimit(parsedInput);
     const pageSnapshotTargets = collectPageSnapshotTargets(harvestResult, pageSnapshotLimit);
     const pageSnapshotArtifacts = pageSnapshotTargets.length > 0 ? (await capturePageSnapshotsFn(pageSnapshotTargets, {
-      kernelApiKey: runtimeOptions.kernelApiKey ?? process.env.KERNEL_API_KEY?.trim(),
+      kernelApiKey: runtimeOptions.kernelApiKey ?? browserServiceApiKey(),
       timeoutMs: runtimeOptions.pageSnapshotTimeoutMs,
       maxConcurrency: runtimeOptions.pageSnapshotMaxConcurrency,
       debug,
@@ -10539,8 +10797,8 @@ serpIntelligenceApp.post("/capture", async (c) => {
   if (!ok) return c.json(insufficientBalanceResponse(balance_mc, cost), 402);
   try {
     const result = await captureSerpIntelligenceSnapshot(parsed.data, {
-      kernelApiKey: process.env.KERNEL_API_KEY?.trim(),
-      kernelProxyId: process.env.KERNEL_PROXY_ID?.trim(),
+      kernelApiKey: browserServiceApiKey(),
+      kernelProxyId: browserServiceProxyId(),
       signal: c.req.raw.signal,
       billing: { creditsUsed: cost / 1e3 }
     });
@@ -10595,7 +10853,7 @@ serpIntelligenceApp.post("/page-snapshots", async (c) => {
   if (!ok) return c.json(insufficientBalanceResponse(balance_mc, cost), 402);
   try {
     const result = await capturePageSnapshots(targets, {
-      kernelApiKey: process.env.KERNEL_API_KEY?.trim(),
+      kernelApiKey: browserServiceApiKey(),
       timeoutMs: parsed.data.timeoutMs,
       maxConcurrency: parsed.data.maxConcurrency,
       debug: parsed.data.debug
@@ -10631,6 +10889,7 @@ serpIntelligenceApp.post("/page-snapshots", async (c) => {
 // src/mcp/mcp-routes.ts
 import { Hono as Hono7 } from "hono";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+configureReportSaving(false);
 function mcpAuthError() {
   const body = JSON.stringify({
     jsonrpc: "2.0",
@@ -10657,15 +10916,18 @@ async function requireMcpCallerKey(c) {
 }
 var mcpApp = new Hono7();
 function registerSerpIntelligenceCaptureTools(server, executor) {
-  const serpExecutor = executor;
   server.registerTool("capture_serp_snapshot", {
+    title: "SERP Intelligence Snapshot",
     description: "Capture a structured SERP Intelligence Google snapshot through POST /serp-intelligence/capture, the same product capture path used by Phoenix. Split query from location, infer gl/hl, use proxyMode location for localized residential proxy evidence, configured for the static residential proxy, and none only for direct-network debugging. Set debug true when investigating location evidence, proxy behavior, CAPTCHA, or capture reliability.",
-    inputSchema: CaptureSerpSnapshotInputSchema
-  }, async (input) => serpExecutor.captureSerpSnapshot ? serpExecutor.captureSerpSnapshot(input) : Promise.resolve({ content: [{ type: "text", text: "{}" }], isError: true }));
+    inputSchema: CaptureSerpSnapshotInputSchema,
+    annotations: liveWebToolAnnotations("SERP Intelligence Snapshot")
+  }, async (input) => executor.captureSerpSnapshot(input));
   server.registerTool("capture_serp_page_snapshots", {
+    title: "SERP Intelligence Page Snapshots",
     description: "Capture public ranking-page evidence through POST /serp-intelligence/page-snapshots, the same product page snapshot path used by Phoenix. Provide urls for simple captures or targets when preserving organic, AI citation, local-pack, configured target, or site-subject source metadata. Private IPs, localhost, file URLs, and internal URLs are rejected by the service. Use timeoutMs for slow pages and debug true for sanitized proxy/browser diagnostics.",
-    inputSchema: CaptureSerpPageSnapshotsInputSchema
-  }, async (input) => serpExecutor.captureSerpPageSnapshots ? serpExecutor.captureSerpPageSnapshots(input) : Promise.resolve({ content: [{ type: "text", text: "{}" }], isError: true }));
+    inputSchema: CaptureSerpPageSnapshotsInputSchema,
+    annotations: liveWebToolAnnotations("SERP Intelligence Page Snapshots")
+  }, async (input) => executor.captureSerpPageSnapshots(input));
 }
 mcpApp.all("/", async (c) => {
   try {
@@ -10678,7 +10940,7 @@ mcpApp.all("/", async (c) => {
       sessionIdGenerator: void 0,
       enableJsonResponse: true
     });
-    const server = buildPaaExtractorMcpServer(executor);
+    const server = buildPaaExtractorMcpServer(executor, { savesReportsLocally: false });
     registerSerpIntelligenceCaptureTools(server, executor);
     await server.connect(transport);
     return transport.handleRequest(c.req.raw);
@@ -11304,7 +11566,7 @@ app.post("/harvest/sync", auth, async (c) => {
   try {
     const result = await harvest({
       ...options,
-      kernelApiKey: process.env.KERNEL_API_KEY?.trim(),
+      kernelApiKey: browserServiceApiKey(),
       headless: true,
       format: "json",
       outputDir: "/tmp/paa-output-api",
@@ -11319,7 +11581,7 @@ app.post("/harvest/sync", auth, async (c) => {
       if (diff > 0) await creditMc(user.id, diff, LedgerOperation.PAA_REFUND, "overestimate refund");
       else if (diff < 0) await debitMc(user.id, -diff, LedgerOperation.PAA, options.query);
     }
-    return c.json({ job_id: jobId, status: "done", result, attempts });
+    return c.json({ job_id: jobId, status: "done", result: sanitizeHarvestResult(result), attempts: sanitizeAttempts(attempts) });
   } catch (err) {
     const problem = classifyHarvestProblem(err);
     const response = harvestProblemResponse(problem);
@@ -11327,18 +11589,19 @@ app.post("/harvest/sync", auth, async (c) => {
     if (problem.terminalStatus === "cancelled" || c.req.raw.signal.aborted) {
       await cancelJob(jobId, serializeHarvestProblem(problem));
       await creditMc(user.id, syncCost, LedgerOperation.REFUND, "cancelled call");
-      return c.json({ job_id: jobId, status: "cancelled", ...response, attempts }, problem.httpStatus);
+      return c.json({ job_id: jobId, status: "cancelled", ...response, attempts: sanitizeAttempts(attempts) }, problem.httpStatus);
     }
     await failJob(jobId, serializeHarvestProblem(problem));
     await creditMc(user.id, syncCost, LedgerOperation.REFUND, "failed call");
-    return c.json({ job_id: jobId, status: "failed", ...response, attempts }, problem.httpStatus);
+    return c.json({ job_id: jobId, status: "failed", ...response, attempts: sanitizeAttempts(attempts) }, problem.httpStatus);
   }
 });
 app.get("/jobs/:id", auth, async (c) => {
   const job = await getJob(c.req.param("id"), c.get("user").id);
   if (!job) return c.json({ error: "Job not found" }, 404);
   const attempts = await listHarvestAttempts(job.id, c.get("user").id);
-  return c.json({ ...job, attempts });
+  const safeResult = job.result && typeof job.result === "object" ? sanitizeHarvestResult(job.result) : job.result;
+  return c.json({ ...job, result: safeResult, attempts: sanitizeAttempts(attempts) });
 });
 app.get("/jobs", auth, async (c) => {
   return c.json(await listJobs(c.get("user").id));
@@ -11437,7 +11700,7 @@ app.post("/extract-url", auth, async (c) => {
   const { ok: euOk, balance_mc: euBal } = await debitMc(user.id, MC_COSTS.page_scrape, LedgerOperation.EXTRACT_URL, new URL(canonicalUrl).hostname);
   if (!euOk) return c.json(insufficientBalanceResponse(euBal, MC_COSTS.page_scrape), 402);
   try {
-    const kernelApiKey = process.env.KERNEL_API_KEY?.trim();
+    const kernelApiKey = browserServiceApiKey();
     const device = screenshotDevice === "mobile" ? "mobile" : "desktop";
     const [result, pageData] = await Promise.all([
       extractKpo({ url: canonicalUrl, kernelApiKey }),
@@ -11475,7 +11738,7 @@ app.post("/map-urls", auth, async (c) => {
       startUrl: parsed.href,
       maxUrls: Math.min(2e3, Math.max(1, body.maxUrls ?? 500)),
       concurrency: Math.min(20, Math.max(1, body.concurrency ?? 12)),
-      kernelApiKey: body.browserFallback ?? body.kernelFallback ? process.env.KERNEL_API_KEY : void 0
+      kernelApiKey: body.browserFallback ?? body.kernelFallback ? browserServiceApiKey() : void 0
     });
     await logRequestEvent({
       userId: user.id,
@@ -11515,7 +11778,7 @@ app.post("/extract-site", auth, async (c) => {
     const result = await extractSite({
       startUrl: parsed.href,
       maxPages: Math.min(200, Math.max(1, body.maxPages ?? 100)),
-      kernelApiKey: body.browserFallback ?? body.kernelFallback ? process.env.KERNEL_API_KEY : void 0
+      kernelApiKey: body.browserFallback ?? body.kernelFallback ? browserServiceApiKey() : void 0
     });
     const pageCount = result.pages?.length ?? 1;
     const actualSiteMc = pageCount * MC_COSTS.page_scrape;
@@ -11662,7 +11925,7 @@ app.get("/cron/tick", async (c) => {
   if (!process.env.CRON_SECRET || secret2 !== `Bearer ${process.env.CRON_SECRET}`) {
     return c.json({ error: "Unauthorized" }, 401);
   }
-  const { drainQueue } = await import("./worker-UT4ZQU2T.js");
+  const { drainQueue } = await import("./worker-AUCXFHEL.js");
   const budget = { maxJobs: 10, deadlineMs: Date.now() + 28e4 };
   const [results, sweepResult] = await Promise.all([
     drainQueue(budget),
@@ -11784,4 +12047,4 @@ app.get("/blog/:slug/", (c) => {
 export {
   app
 };
-//# sourceMappingURL=server-2Y27U4TO.js.map
+//# sourceMappingURL=server-QXVVTKJP.js.map