mcp-scraper 0.10.0 → 0.12.0

package/README.md

@@ -88,7 +88,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.2.24`, SHA-256 `2aff0e961e3de920d1fc67230056988a4a9120735f26f234f0ada6242350a4f0`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, and API-key configuration field from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.12.0`, SHA-256 `2a0dfdc53e93d48588ef672c6daf0ec0e6194b3f938add02b106bf5e86c20ef3`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, and API-key configuration field from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 
@@ -171,7 +171,7 @@ env = { MCP_SCRAPER_API_KEY = "sk_live_your_key" }
 - `workflow_run` — run hosted workflows such as `agent-packet`, `local-competitive-audit`, `map-comparison`, `serp-comparison`, `paa-expansion-brief`, and `ai-overview-language`; returns run metadata, summary, and artifact IDs.
 - `workflow_status` — reopen a workflow run and list its current status and artifacts.
 - `workflow_artifact_read` — pull generated workflow artifacts such as `evidence.json`, CSVs, Markdown briefs, and reports back into MCP context.
-- `rank_tracker_blueprint` — generate a database schema, cron/heartbeat plan, ingestion workflow, metrics list, and implementation prompt for building rank trackers. It has modes for Maps rankings via `directory_workflow`/`maps_search`, organic rankings via `search_serp`, AI Overview citation tracking, and PAA source presence tracking. This planning tool does not spend credits.
+- `rank_tracker_workflow` — generate a database schema, cron/heartbeat plan, ingestion workflow, metrics list, and implementation prompt for building rank trackers. It has modes for Maps rankings via `directory_workflow`/`maps_search`, organic rankings via `search_serp`, AI Overview citation tracking, and PAA source presence tracking. This planning tool does not spend credits.
 - `credits_info`
 
 ### Browser-agent tools
@@ -207,7 +207,7 @@ The `mcp-scraper` server (and the MCPB bundle, which runs it) exposes both secti
 
 All MCP tools expose output schemas and return `structuredContent` with the IDs, URLs, CSV paths, transcripts, browser session handles, replay paths, artifacts, recipe fields, or blueprint fields needed by the next step. Browser Agent tools keep a JSON text block for older clients, but structured data is the primary contract. All tools carry MCP annotations; file-writing tools such as replay downloads and annotations state their filesystem side effects.
 
-The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The `mcp-scraper` stdio server exposes 45 tools (25 web-intelligence/workflow tools plus 20 browser tools). The hosted MCP endpoint at `https://mcpscraper.dev/mcp` exposes the web-intelligence/workflow tools plus `capture_serp_snapshot` and `capture_serp_page_snapshots` (27 total). Across all public surfaces there are 47 unique tool names.
+The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. Both the `mcp-scraper` stdio server and the hosted endpoint at `https://mcpscraper.dev/mcp` expose the same 153 tools: 68 scraper, browser, workflow, billing, and connected-service tools plus 85 durable-memory tools. Release verification compares the exact local and remote tool-name sets, not only the count.
 
 ## Resources
 
@@ -244,7 +244,7 @@ npm update -g mcp-scraper
 npm install mcp-scraper@latest
 ```
 
-Users who do not update can keep using the tools their installed package already advertises, but they will not see newly added stdio tools, schemas, or AI-facing descriptions. For example, a client running an older package cannot call `rank_tracker_blueprint`, `directory_workflow`, or browser tools through stdio even if the hosted API already supports adjacent endpoints.
+Users who do not update can keep using the tools their installed package already advertises, but they will not see newly added stdio tools, schemas, or AI-facing descriptions. For example, a client running an older package cannot call `rank_tracker_workflow`, `directory_workflow`, connected-service actions, or browser tools through stdio even if the hosted API already supports adjacent endpoints.
 
 ## Branded One-Click Installs
 

package/dist/bin/api-server.cjs

@@ -27452,7 +27452,7 @@ var PACKAGE_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    PACKAGE_VERSION = "0.10.0";
+    PACKAGE_VERSION = "0.12.0";
   }
 });
 
@@ -27625,7 +27625,7 @@ var init_output_schema_registry = __esm({
 });
 
 // src/mcp/mcp-tool-schemas.ts
-var import_zod33, HarvestPaaInputSchema, ExtractUrlInputSchema, DiffPageInputSchema, MapSiteUrlsInputSchema, ExtractSiteInputSchema, AuditSiteInputSchema, YoutubeHarvestInputSchema, YoutubeTranscribeInputSchema, FacebookPageIntelInputSchema, FacebookAdSearchInputSchema, RedditThreadInputSchema, VideoFrameAnalysisInputSchema, VideoFrameAnalysisStatusInputSchema, FacebookAdTranscribeInputSchema, FacebookVideoTranscribeInputSchema, GoogleAdsSearchInputSchema, GoogleAdsPageIntelInputSchema, GoogleAdsTranscribeInputSchema, InstagramProfileContentInputSchema, InstagramMediaDownloadInputSchema, MapsPlaceIntelInputSchema, TrustpilotReviewsInputSchema, G2ReviewsInputSchema, ReviewCardSchema, MapsSearchInputSchema, DirectoryWorkflowInputSchema, ArtifactPointerOutputSchema, RankTrackerModeSchema, RankTrackerBlueprintInputSchema, NullableString, MapsSearchAttemptOutput, MapsSearchOutputSchema, DirectoryMapsBusinessOutput, DirectoryWorkflowOutputSchema, RankTrackerToolPlanOutput, RankTrackerTableOutput, RankTrackerCronJobOutput, RankTrackerBlueprintOutputSchema, OrganicResultOutput, AiOverviewOutput, EntityIdsOutput, HarvestPaaOutputSchema, SearchSerpOutputSchema, ExtractUrlOutputSchema, DiffPageOutputSchema, ExtractSiteOutputSchema, AuditSiteOutputSchema, MapsPlaceIntelOutputSchema, TrustpilotReviewsOutputSchema, G2ReviewsOutputSchema, CreditsInfoOutputSchema, MapSiteUrlsOutputSchema, YoutubeHarvestOutputSchema, FacebookAdSearchOutputSchema, VideoFrameAnalysisOutputSchema, VideoFrameAnalysisStatusOutputSchema, RedditThreadOutputSchema, FacebookPageIntelOutputSchema, GoogleAdsSearchOutputSchema, GoogleAdsPageIntelOutputSchema, FacebookVideoTranscribeOutputSchema, TranscriptChunkOutput, InstagramBrowserOutput, InstagramPaginationOutput, InstagramProfileContentOutputSchema, InstagramMediaTrackOutput, InstagramDownloadOutput, InstagramMediaDownloadOutputSchema, YoutubeTranscribeOutputSchema, FacebookAdTranscribeOutputSchema, GoogleAdsTranscribeOutputSchema, CaptureSerpSnapshotOutputSchema, CaptureSerpPageSnapshotsOutputSchema, CreditsInfoInputSchema, WorkflowIdSchema2, WorkflowListInputSchema, WorkflowSuggestInputSchema, WorkflowRunInputSchema, WorkflowStepInputSchema, WorkflowStatusInputSchema, WorkflowArtifactReadInputSchema, WorkflowRecipeOutput, WorkflowDefinitionOutput, WorkflowArtifactOutput, WorkflowListOutputSchema, WorkflowSuggestOutputSchema, WorkflowRunOutputSchema, WorkflowStepOutputSchema, WorkflowStatusOutputSchema, WorkflowArtifactReadOutputSchema, SearchSerpInputSchema, CaptureSerpSnapshotInputSchema, ScreenshotInputSchema, CaptureSerpPageSnapshotsInputSchema, ReportArtifactReadInputSchema, ReportArtifactReadOutputSchema, ListServiceConnectionsInputSchema, ListServiceConnectionsOutputSchema, ReadServiceConnectionInputSchema, ReadServiceConnectionOutputSchema, SlackSendMessageInputSchema, SlackSendMessageOutputSchema, GmailSendMessageInputSchema, GmailSendMessageOutputSchema, GoogleCalendarCreateEventInputSchema, GoogleCalendarCreateEventOutputSchema, ZoomCreateMeetingInputSchema, ZoomCreateMeetingOutputSchema;
+var import_zod33, HarvestPaaInputSchema, ExtractUrlInputSchema, DiffPageInputSchema, MapSiteUrlsInputSchema, ExtractSiteInputSchema, AuditSiteInputSchema, YoutubeHarvestInputSchema, YoutubeTranscribeInputSchema, FacebookPageIntelInputSchema, FacebookAdSearchInputSchema, RedditThreadInputSchema, VideoFrameAnalysisInputSchema, VideoFrameAnalysisStatusInputSchema, FacebookAdTranscribeInputSchema, FacebookVideoTranscribeInputSchema, GoogleAdsSearchInputSchema, GoogleAdsPageIntelInputSchema, GoogleAdsTranscribeInputSchema, InstagramProfileContentInputSchema, InstagramMediaDownloadInputSchema, MapsPlaceIntelInputSchema, TrustpilotReviewsInputSchema, G2ReviewsInputSchema, ReviewCardSchema, MapsSearchInputSchema, DirectoryWorkflowInputSchema, ArtifactPointerOutputSchema, RankTrackerModeSchema, RankTrackerBlueprintInputSchema, NullableString, MapsSearchAttemptOutput, MapsSearchOutputSchema, DirectoryMapsBusinessOutput, DirectoryWorkflowOutputSchema, RankTrackerToolPlanOutput, RankTrackerTableOutput, RankTrackerCronJobOutput, RankTrackerBlueprintOutputSchema, OrganicResultOutput, AiOverviewOutput, EntityIdsOutput, HarvestPaaOutputSchema, SearchSerpOutputSchema, ExtractUrlOutputSchema, DiffPageOutputSchema, ExtractSiteOutputSchema, AuditSiteOutputSchema, MapsPlaceIntelOutputSchema, TrustpilotReviewsOutputSchema, G2ReviewsOutputSchema, CreditsInfoOutputSchema, MapSiteUrlsOutputSchema, YoutubeHarvestOutputSchema, FacebookAdSearchOutputSchema, VideoFrameAnalysisOutputSchema, VideoFrameAnalysisStatusOutputSchema, RedditThreadOutputSchema, FacebookPageIntelOutputSchema, GoogleAdsSearchOutputSchema, GoogleAdsPageIntelOutputSchema, FacebookVideoTranscribeOutputSchema, TranscriptChunkOutput, InstagramBrowserOutput, InstagramPaginationOutput, InstagramProfileContentOutputSchema, InstagramMediaTrackOutput, InstagramDownloadOutput, InstagramMediaDownloadOutputSchema, YoutubeTranscribeOutputSchema, FacebookAdTranscribeOutputSchema, GoogleAdsTranscribeOutputSchema, CaptureSerpSnapshotOutputSchema, CaptureSerpPageSnapshotsOutputSchema, CreditsInfoInputSchema, WorkflowIdSchema2, WorkflowListInputSchema, WorkflowSuggestInputSchema, WorkflowRunInputSchema, WorkflowStepInputSchema, WorkflowStatusInputSchema, WorkflowArtifactReadInputSchema, WorkflowRecipeOutput, WorkflowDefinitionOutput, WorkflowArtifactOutput, WorkflowListOutputSchema, WorkflowSuggestOutputSchema, WorkflowRunOutputSchema, WorkflowStepOutputSchema, WorkflowStatusOutputSchema, WorkflowArtifactReadOutputSchema, SearchSerpInputSchema, CaptureSerpSnapshotInputSchema, ScreenshotInputSchema, CaptureSerpPageSnapshotsInputSchema, ReportArtifactReadInputSchema, ReportArtifactReadOutputSchema, ListServiceConnectionsInputSchema, ListServiceConnectionsOutputSchema, ReadServiceConnectionInputSchema, ReadServiceConnectionOutputSchema, CallServiceConnectionActionInputSchema, CallServiceConnectionActionOutputSchema, SetScheduledActionConnectionsInputSchema, SetScheduledActionConnectionsOutputSchema, SlackSendMessageInputSchema, SlackSendMessageOutputSchema, GmailSendMessageInputSchema, GmailSendMessageOutputSchema, GoogleCalendarCreateEventInputSchema, GoogleCalendarCreateEventOutputSchema, ZoomCreateMeetingInputSchema, ZoomCreateMeetingOutputSchema;
 var init_mcp_tool_schemas = __esm({
   "src/mcp/mcp-tool-schemas.ts"() {
     "use strict";
@@ -28659,6 +28659,7 @@ var init_mcp_tool_schemas = __esm({
         status: import_zod33.z.string(),
         actionsEnabled: import_zod33.z.boolean(),
         readTools: import_zod33.z.array(import_zod33.z.string()).describe("Tool names this connection can be read with via read_service_connection."),
+        actionTools: import_zod33.z.array(import_zod33.z.string()).describe("Explicitly allowlisted write or mutation tool names callable through call_service_connection_action after actions are enabled for this connection."),
         vaultName: import_zod33.z.string().nullable().describe("Memory vault this connection's digest writes into, if it has run at least once. Search it with memory-search."),
         tableName: import_zod33.z.string().nullable().describe("Table this connection's digest writes structured rows into, if it has run at least once. Query it with table-query.")
       }))
@@ -28673,6 +28674,29 @@ var init_mcp_tool_schemas = __esm({
       result: import_zod33.z.unknown().optional(),
       error: NullableString
     };
+    CallServiceConnectionActionInputSchema = {
+      connectionId: import_zod33.z.string().min(1).describe("A connectionId from list_service_connections with actionsEnabled true."),
+      tool: import_zod33.z.string().min(1).describe("One exact tool name from that connection's actionTools. Arbitrary Nango action names are rejected server-side."),
+      args: import_zod33.z.record(import_zod33.z.string(), import_zod33.z.unknown()).describe("Arguments required by the selected action. The provider action validates its own typed input before execution.")
+    };
+    CallServiceConnectionActionOutputSchema = {
+      ok: import_zod33.z.boolean(),
+      result: import_zod33.z.unknown().optional(),
+      error: NullableString
+    };
+    SetScheduledActionConnectionsInputSchema = {
+      scheduleActionId: import_zod33.z.string().min(1).describe("A scheduled action id returned by create-scheduled-action or list-scheduled-actions."),
+      connections: import_zod33.z.array(import_zod33.z.object({
+        connectionId: import_zod33.z.string().min(1).describe("A tenant-scoped connectionId from list_service_connections."),
+        providerConfigKey: import_zod33.z.string().min(1).describe("The matching providerConfigKey returned with that connection."),
+        allowedTools: import_zod33.z.array(import_zod33.z.string().min(1)).min(1).max(100).describe("Exact readTools and, only when live actions are enabled, actionTools this schedule may use.")
+      }).strict()).max(20).describe("Exact connection and tool grants for this schedule. Pass an empty array to remove every external-service grant.")
+    };
+    SetScheduledActionConnectionsOutputSchema = {
+      ok: import_zod33.z.boolean(),
+      connections: import_zod33.z.array(import_zod33.z.unknown()).optional(),
+      error: NullableString
+    };
     SlackSendMessageInputSchema = {
       connectionId: import_zod33.z.string().min(1).describe("A Slack connectionId from list_service_connections, with actionsEnabled true."),
       channel: import_zod33.z.string().min(1).describe(`Slack channel ID to send to, e.g. "C1234567890". Get this from the connection's own read tools, not guessed.`),
@@ -29403,7 +29427,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => formatCreditsInfo(await executor.creditsInfo(input), input));
   server.registerTool("list_service_connections", {
     title: "List Connected Services",
-    description: "List the third-party service connections (Slack, Gmail, Google Calendar, Zoom, Xero) the account has authorized, with each connection's id, whether it is enabled for live actions, its live readTools, and its digest vault/table (if the digest has run). Get a connectionId from here before calling read_service_connection, slack_send_message, gmail_send_message, google_calendar_create_event, or zoom_create_meeting. For already-digested history, search vaultName with memory-search or query tableName with table-query instead of a live read.",
+    description: "List every third-party service connection this MCP Scraper account has authorized, including Google Analytics, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId plus exact readTools and actionTools. Get a connectionId and exact tool name here before calling read_service_connection or call_service_connection_action. For already-digested history, prefer the returned vaultName or tableName.",
     inputSchema: ListServiceConnectionsInputSchema,
     outputSchema: recordOutputSchema("list_service_connections", ListServiceConnectionsOutputSchema),
     annotations: { title: "List Connected Services", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
@@ -29438,11 +29462,25 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => executor.zoomCreateMeeting(input));
   server.registerTool("read_service_connection", {
     title: "Read Connected Service",
-    description: "Call one live, read-only tool on a connected service (Slack/Gmail/Google Calendar/Zoom/Xero) to get current data \u2014 e.g. get-conversation-history, list-messages, list-invoices. Requires a connectionId and a tool name from that connection's readTools in list_service_connections; an unlisted tool name is rejected. For history that's already been digested, prefer memory-search over the connection's vaultName or table-query over its tableName \u2014 faster and free.",
+    description: "Call one live, read-only tool on any connected service, including Google Analytics, YouTube, Facebook Pages, LinkedIn, X, Slack, Gmail, Calendar, Drive, Zoom, and Xero. Requires a connectionId and an exact name from that connection's readTools in list_service_connections; an unlisted tool is rejected server-side. For already-digested history, prefer memory-search over vaultName or table-query over tableName.",
     inputSchema: ReadServiceConnectionInputSchema,
     outputSchema: recordOutputSchema("read_service_connection", ReadServiceConnectionOutputSchema),
     annotations: { title: "Read Connected Service", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true }
   }, async (input) => executor.readServiceConnection(input));
+  server.registerTool("call_service_connection_action", {
+    title: "Run Connected Service Action",
+    description: "Run one explicitly allowlisted write or mutation on a tenant-owned OAuth connection. First call list_service_connections, use a connection with actionsEnabled true, choose one exact actionTools entry, and supply that action's arguments. The server rejects arbitrary action names, inactive or foreign connections, disabled actions, and tools outside the provider allowlist. This may publish, update, send, subscribe, or delete provider data depending on the chosen tool.",
+    inputSchema: CallServiceConnectionActionInputSchema,
+    outputSchema: recordOutputSchema("call_service_connection_action", CallServiceConnectionActionOutputSchema),
+    annotations: { title: "Run Connected Service Action", readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true }
+  }, async (input) => executor.callServiceConnectionAction(input));
+  server.registerTool("set_scheduled_action_connections", {
+    title: "Set Scheduled Action Connections",
+    description: "Attach exact tenant-owned OAuth connections and exact allowed tools to an existing scheduled action. First create or identify the schedule, call list_service_connections, then grant only the required readTools and\u2014when that account has actionsEnabled true\u2014the required actionTools. The server verifies schedule ownership, connection ownership, provider policy, and the per-account action switch. Pass an empty connections array to remove all external-service access from the schedule.",
+    inputSchema: SetScheduledActionConnectionsInputSchema,
+    outputSchema: recordOutputSchema("set_scheduled_action_connections", SetScheduledActionConnectionsOutputSchema),
+    annotations: { title: "Set Scheduled Action Connections", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false }
+  }, async (input) => executor.setScheduledActionConnections(input));
 }
 var import_mcp, import_node_fs9, import_node_path12, import_node_crypto10;
 var init_paa_mcp_server = __esm({
@@ -29539,10 +29577,10 @@ var init_http_mcp_tool_executor = __esm({
         const configuredSerpIntelligenceTimeoutMs = Number(process.env.MCP_SCRAPER_SERP_INTELLIGENCE_HTTP_TIMEOUT_MS ?? this.timeoutMs);
         this.serpIntelligenceTimeoutMs = Number.isFinite(configuredSerpIntelligenceTimeoutMs) && configuredSerpIntelligenceTimeoutMs > 0 ? configuredSerpIntelligenceTimeoutMs : this.timeoutMs;
       }
-      async call(path6, body, timeoutMs = this.timeoutMs) {
+      async call(path6, body, timeoutMs = this.timeoutMs, method = "POST") {
         try {
           const res = await fetch(`${this.baseUrl}${path6}`, {
-            method: "POST",
+            method,
             headers: {
               "Content-Type": "application/json",
               "x-api-key": this.apiKey
@@ -29769,6 +29807,14 @@ var init_http_mcp_tool_executor = __esm({
       readServiceConnection(input) {
         return this.call("/schedule-connections/actions/read", input);
       }
+      callServiceConnectionAction(input) {
+        return this.call("/schedule-connections/actions/call", input);
+      }
+      setScheduledActionConnections(input) {
+        return this.call(`/schedule-actions/${encodeURIComponent(input.scheduleActionId)}/connections`, {
+          connections: input.connections
+        }, void 0, "PUT");
+      }
       captureSerpSnapshot(input) {
         return this.call("/serp-intelligence/capture", input, this.serpIntelligenceTimeoutMs);
       }
@@ -32823,11 +32869,12 @@ var init_memory_tool_schemas = __esm({
     CreateScheduledActionSchema = {
       id: "create-scheduled-action",
       upstreamName: "createScheduledActionTool",
-      description: "Create a scheduled action: on the given cadence, an agent reads the description, does what it asks, and writes the result into the target vault. Cadence 'once' runs a single time then completes permanently \u2014 use it for one-off tasks, not recurring ones. Requires an active scheduling subscription and write access to the target vault.",
+      description: "Create a scheduled action in agent mode (default) or connection_sync mode. Agent mode asks an agent to follow the description and write a result into the target vault. connection_sync deterministically runs the approved read-only tools on bound service connections and ingests their data; it requires at least one connection to be bound before execution. Cadence 'once' runs a single time then completes permanently. Requires an active scheduling subscription and write access to the target vault.",
       input: {
         description: import_zod35.z.string().min(1).describe("Free-text description of what this action should do each time it runs."),
         vault: import_zod35.z.string().min(1).describe("The vault this action writes its results into. You must already have write access to it."),
         cadence: import_zod35.z.enum(["once", "daily", "weekly", "monthly"]).describe('How often this action runs. "once" fires a single time and then completes.'),
+        executionMode: import_zod35.z.enum(["agent", "connection_sync"]).default("agent").describe(`How to execute each run. "agent" (default) lets an agent follow the description. "connection_sync" deterministically ingests data from the schedule's bound connections using only their approved read-only tools; bind at least one connection before it runs.`),
         timeOfDay: import_zod35.z.string().regex(/^([01]\d|2[0-3]):([0-5]\d)$/).optional().describe("24-hour HH:MM clock time to run at, in the given timezone. Optional \u2014 omit to run at any time during the period (matches prior default behavior)."),
         timezone: import_zod35.z.string().optional().describe('IANA timezone name, e.g. "America/Denver". Only meaningful together with timeOfDay. Defaults to UTC.'),
         deployDate: import_zod35.z.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional().describe('Calendar date (YYYY-MM-DD, in the given timezone) this action should first become eligible to run \u2014 its deployment/start date. For recurring cadences, the first occurrence lands on or after this date; every later occurrence still follows the normal cadence. For cadence "once", this (combined with timeOfDay if given) is exactly what day it fires. Omit to start immediately.')
@@ -32836,6 +32883,7 @@ var init_memory_tool_schemas = __esm({
         ok: import_zod35.z.boolean().describe("True when the scheduled action was created."),
         id: import_zod35.z.string().optional().describe("The new scheduled action id."),
         nextRunAt: import_zod35.z.string().optional().describe("When it will first run."),
+        executionMode: import_zod35.z.enum(["agent", "connection_sync"]).optional().describe("The stored execution mode. Defaults to agent when omitted from the request."),
         error: import_zod35.z.string().optional().describe("Human-readable failure reason when ok is false."),
         code: import_zod35.z.string().optional().describe("Machine-readable denial code: not_enabled when no scheduling subscription is active.")
       },
@@ -32910,7 +32958,7 @@ var init_memory_tool_schemas = __esm({
     ListScheduledActionsSchema = {
       id: "list-scheduled-actions",
       upstreamName: "listScheduledActionsTool",
-      description: "List every scheduled action you own \u2014 active, paused, and completed one-time actions \u2014 with cadence, next run time, and last run status.",
+      description: "List every scheduled action you own \u2014 active, paused, and completed one-time actions \u2014 with execution mode, cadence, next run time, and last run status. connection_sync means deterministic read-only ingestion from bound service connections.",
       input: {},
       output: {
         ok: import_zod35.z.boolean(),
@@ -32919,6 +32967,7 @@ var init_memory_tool_schemas = __esm({
           description: import_zod35.z.string(),
           vault: import_zod35.z.string(),
           cadence: import_zod35.z.enum(["once", "daily", "weekly", "monthly"]),
+          executionMode: import_zod35.z.enum(["agent", "connection_sync"]),
           timeOfDay: import_zod35.z.string().nullable(),
           timezone: import_zod35.z.string(),
           status: import_zod35.z.enum(["active", "paused", "completed"]),
@@ -38838,6 +38887,43 @@ var init_memory_db = __esm({
 });
 
 // src/api/nango-control.ts
+function connectionSyncPolicyIssues(selections) {
+  const issues = [];
+  for (const selection of selections) {
+    const required = CONNECTION_SYNC_REQUIRED_TOOLS[selection.providerConfigKey];
+    if (!required) {
+      issues.push({ providerConfigKey: selection.providerConfigKey, code: "unsupported_provider" });
+      continue;
+    }
+    const allowed = new Set(selection.allowedTools);
+    const missingTools = required.filter((tool) => !allowed.has(tool));
+    if (missingTools.length > 0) {
+      issues.push({ providerConfigKey: selection.providerConfigKey, code: "missing_required_tools", missingTools });
+    }
+    const requiredSet = new Set(required);
+    const unexpectedTools = [...allowed].filter((tool) => !requiredSet.has(tool));
+    if (unexpectedTools.length > 0) {
+      issues.push({ providerConfigKey: selection.providerConfigKey, code: "unexpected_tools", unexpectedTools });
+    }
+  }
+  return issues;
+}
+function connectionSyncSelectionError(connections) {
+  if (connections.length === 0) {
+    return "Data sync requires at least one bound service connection with approved read-only tools.";
+  }
+  const issues = connectionSyncPolicyIssues(connections);
+  const unsupported = [...new Set(issues.filter((issue) => issue.code === "unsupported_provider").map((issue) => issue.providerConfigKey))];
+  if (unsupported.length > 0) {
+    return `Data sync currently supports only ${Object.keys(CONNECTION_SYNC_REQUIRED_TOOLS).join(", ")}. Unsupported providerConfigKey: ${unsupported.join(", ")}.`;
+  }
+  const missing = issues.filter((issue) => issue.code === "missing_required_tools").map((issue) => `${issue.providerConfigKey}: ${(issue.missingTools ?? []).join(", ")}`);
+  if (missing.length > 0) {
+    return `Data sync is missing required approved read tools (${missing.join("; ")}).`;
+  }
+  const unexpected = issues.filter((issue) => issue.code === "unexpected_tools").map((issue) => `${issue.providerConfigKey}: ${(issue.unexpectedTools ?? []).join(", ")}`);
+  return unexpected.length > 0 ? `Data sync permits only its exact read-only tool set; remove unexpected tools (${unexpected.join("; ")}).` : null;
+}
 function controlBaseUrl() {
   return (process.env.NANGO_CONTROL_URL?.trim() || DEFAULT_NANGO_CONTROL_URL).replace(/\/$/, "");
 }
@@ -38959,6 +39045,15 @@ async function getNangoCatalog() {
     const safeDefaultAllowedTools = cleanTools(
       row.safeDefaultAllowedTools ?? row.safe_default_allowed_tools ?? row.defaultAllowedTools ?? row.default_allowed_tools ?? row.allowedTools ?? row.allowed_tools
     ).filter((tool) => !disabledTools?.has(tool));
+    const platformSetupStatus = firstString(row, [
+      "platformSetupStatus",
+      "platform_setup_status",
+      "setupStatus",
+      "setup_status"
+    ], 100);
+    const appReviewStatus = row.appReviewLimited === true || row.app_review_limited === true ? "limited" : firstString(row, ["appReviewStatus", "app_review_status", "reviewStatus", "review_status"], 100);
+    const appReviewNote = firstString(row, ["appReviewNote", "app_review_note", "reviewNote", "review_note"], 500);
+    const connectionSyncRequiredTools = [...CONNECTION_SYNC_REQUIRED_TOOLS[providerConfigKey] ?? []];
     result.push({
       providerConfigKey,
       provider,
@@ -38968,7 +39063,12 @@ async function getNangoCatalog() {
       docsUrl,
       authMode,
       categories,
-      safeDefaultAllowedTools
+      safeDefaultAllowedTools,
+      connectionSyncSupported: connectionSyncRequiredTools.length > 0,
+      connectionSyncRequiredTools,
+      platformSetupStatus,
+      appReviewStatus,
+      appReviewNote
     });
   }
   return result;
@@ -38996,6 +39096,7 @@ async function getNangoConnections(identity) {
       reconnectRequired,
       actionsEnabled: row.actionsEnabled === true || row.actions_enabled === true,
       readTools: cleanTools(row.readTools ?? row.read_tools),
+      actionTools: cleanTools(row.actionTools ?? row.action_tools ?? row.writeTools ?? row.write_tools),
       vaultName: firstString(row, ["vaultName", "vault_name"], 100),
       tableName: firstString(row, ["tableName", "table_name"], 100),
       createdAt: firstString(row, ["createdAt", "created_at"], 100),
@@ -39112,10 +39213,10 @@ async function setScheduleConnectionActionsEnabled(identity, connectionId, enabl
   if (!isRecord(data) || !isRecord(data.connection)) return enabled;
   return data.connection.actionsEnabled === true;
 }
-async function callScheduleConnectionAction(identity, connectionId, input) {
+async function callScheduleConnectionAction(identity, connectionId, input, tool) {
   const body = await controlRequest("/api/internal/nango/connections/actions/call", {
     method: "POST",
-    body: JSON.stringify({ identity, connectionId, input })
+    body: JSON.stringify({ identity, connectionId, ...tool ? { tool } : {}, input })
   });
   const data = unwrapData(body);
   return isRecord(data) ? data.result ?? data : data;
@@ -39128,7 +39229,7 @@ async function callScheduleConnectionRead(identity, connectionId, tool, args) {
   const data = unwrapData(body);
   return isRecord(data) ? data.result ?? data : data;
 }
-var DEFAULT_NANGO_CONTROL_URL, DISABLED_NANGO_TOOLS, NangoControlError, ScheduleConnectionValidationError;
+var DEFAULT_NANGO_CONTROL_URL, DISABLED_NANGO_TOOLS, CONNECTION_SYNC_REQUIRED_TOOLS, NangoControlError, ScheduleConnectionValidationError;
 var init_nango_control = __esm({
   "src/api/nango-control.ts"() {
     "use strict";
@@ -39137,6 +39238,17 @@ var init_nango_control = __esm({
       "google-mail": /* @__PURE__ */ new Set(["list-filters"]),
       slack: /* @__PURE__ */ new Set(["search-files", "search-messages"])
     };
+    CONNECTION_SYNC_REQUIRED_TOOLS = {
+      "google-mail": ["list-messages", "get-message"],
+      "google-calendar": ["list-events", "get-event"],
+      zoom: [
+        "list-meetings",
+        "get-meeting",
+        "list-recordings",
+        "get-recording",
+        "get-meeting-transcript"
+      ]
+    };
     NangoControlError = class extends Error {
       status;
       constructor(message, status = 502) {
@@ -40166,6 +40278,26 @@ var init_server = __esm({
         return scheduleConnectionError(c, err, "Unable to read from this connection.");
       }
     });
+    app.post("/schedule-connections/actions/call", auth2, async (c) => {
+      const user = c.get("user");
+      const body = await c.req.json().catch(() => ({}));
+      const connectionId = providerConfigKeyFrom(body.connectionId);
+      const tool = providerConfigKeyFrom(body.tool);
+      if (!connectionId || !tool || !body.args || typeof body.args !== "object" || Array.isArray(body.args)) {
+        return c.json({ ok: false, error: "connectionId, tool, and an args object are required." }, 400);
+      }
+      try {
+        const result = await callScheduleConnectionAction(
+          user.email,
+          connectionId,
+          body.args,
+          tool
+        );
+        return c.json({ ok: true, result });
+      } catch (err) {
+        return scheduleConnectionError(c, err, "Unable to run this connection action.");
+      }
+    });
     app.post("/schedule-link", auth2, async (c) => {
       try {
         const user = c.get("user");
@@ -40188,9 +40320,10 @@ var init_server = __esm({
       try {
         const actions = await Promise.all(r.actions.map(async (action) => {
           const id = typeof action.id === "string" ? action.id : "";
-          if (!id) return { ...action, connections: [] };
+          const executionMode = action.executionMode === "connection_sync" ? "connection_sync" : "agent";
+          if (!id) return { ...action, executionMode, connections: [] };
           const bindings = await getScheduleConnectionBindings(user.email, id);
-          return { ...action, connections: bindingsForSchedule(bindings, id) };
+          return { ...action, executionMode, connections: bindingsForSchedule(bindings, id) };
         }));
         return c.json({
           ...r,
@@ -40200,7 +40333,7 @@ var init_server = __esm({
         console.warn("[schedule-actions] connection bindings unavailable:", err instanceof Error ? err.message : String(err));
         return c.json({
           ...r,
-          actions: r.actions.map((action) => ({ ...action, connections: [] })),
+          actions: r.actions.map((action) => ({ ...action, executionMode: action.executionMode === "connection_sync" ? "connection_sync" : "agent", connections: [] })),
           connectionBindingsUnavailable: true
         });
       }
@@ -40210,6 +40343,10 @@ var init_server = __esm({
       const { key, error } = await getOrCreateUserMemoryKey(user);
       if (!key) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
       const body = await c.req.json().catch(() => ({}));
+      const executionMode = body.executionMode ?? "agent";
+      if (executionMode !== "agent" && executionMode !== "connection_sync") {
+        return c.json({ ok: false, error: 'executionMode must be "agent" or "connection_sync".' }, 400);
+      }
       const hasConnections = Object.prototype.hasOwnProperty.call(body, "connections");
       let connections;
       try {
@@ -40217,18 +40354,23 @@ var init_server = __esm({
       } catch (err) {
         return scheduleConnectionError(c, err, "Invalid service connections.");
       }
-      const actionBody = { ...body };
+      if (executionMode === "connection_sync") {
+        const policyError = connectionSyncSelectionError(connections);
+        if (policyError) return c.json({ ok: false, error: policyError }, 400);
+      }
+      const actionBody = { ...body, executionMode };
       delete actionBody.connections;
       const r = await memoryCall("createScheduledActionTool", actionBody, key);
-      if (!r.ok || !hasConnections) return c.json(r);
-      if (connections.length === 0) return c.json({ ...r, connections: [] });
+      const createResponse = { ...r, executionMode };
+      if (!r.ok || !hasConnections) return c.json(createResponse);
+      if (connections.length === 0) return c.json({ ...createResponse, connections: [] });
       if (!r.id) {
         console.error("[schedule-actions] create returned no id while service connections were requested");
         return c.json({ ok: false, error: "The scheduled action was created without a usable id; service connections were not attached." }, 502);
       }
       try {
         const bound = await putScheduleConnectionBindings(user.email, r.id, connections);
-        return c.json({ ...r, connections: bound });
+        return c.json({ ...createResponse, connections: bound });
       } catch (err) {
         const rollback = await memoryCall("deleteScheduledActionTool", { id: r.id }, key).catch(() => ({ ok: false }));
         if (!rollback.ok) console.error("[schedule-actions] failed to compensate action after connection binding failure", r.id);
@@ -40266,6 +40408,16 @@ var init_server = __esm({
       }
       try {
         const scheduleActionId = c.req.param("id");
+        const { key, error } = await getOrCreateUserMemoryKey(user);
+        if (!key) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
+        const schedules = await memoryCall("listScheduledActionsTool", {}, key);
+        if (!schedules.ok || !Array.isArray(schedules.actions)) return c.json(schedules, 502);
+        const schedule = schedules.actions.find((action) => action.id === scheduleActionId);
+        if (!schedule) return c.json({ ok: false, error: "scheduled action not found" }, 404);
+        if (schedule.executionMode === "connection_sync") {
+          const policyError = connectionSyncSelectionError(connections);
+          if (policyError) return c.json({ ok: false, error: policyError }, 400);
+        }
         const bindings = await putScheduleConnectionBindings(user.email, scheduleActionId, connections);
         return c.json({ ok: true, connections: bindings });
       } catch (err) {