mcp-scraper 0.27.0 → 0.28.0

package/README.md

@@ -227,7 +227,7 @@ The `mcp-scraper` server (and the MCPB bundle, which runs it) exposes both secti
 
 All MCP tools expose output schemas and return `structuredContent` with the IDs, URLs, CSV paths, transcripts, browser session handles, replay paths, artifacts, recipe fields, or blueprint fields needed by the next step. Browser Agent tools keep a JSON text block for older clients, but structured data is the primary contract. All tools carry MCP annotations; file-writing tools such as replay downloads and annotations state their filesystem side effects.
 
-The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. Both the `mcp-scraper` stdio server and the hosted endpoint at `https://mcpscraper.dev/mcp` expose the same 163 tools: 76 scraper, browser, workflow, billing, and connected-service tools plus 87 durable-memory tools. Release verification compares the exact local and remote tool-name sets, not only the count.
+The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. Both the `mcp-scraper` stdio server and the hosted endpoint at `https://mcpscraper.dev/mcp` expose the same 165 tools: 76 scraper, browser, workflow, billing, and connected-service tools plus 89 durable-memory tools. Release verification compares the exact local and remote tool-name sets, not only the count.
 
 For contract parity, stdio and MCPB memory calls invoke the matching public tool on the hosted MCP Scraper `/mcp` endpoint. The hosted aggregate runtime owns MCP Scraper-specific billing, scheduling, credential, and in-process cutover policy; its internal `/memory/mcp-call` bridge is a fallback to the standalone memory service, not the public stdio execution path. Direct `mcp-memory` OAuth and stdio clients continue to use `memory.mcpscraper.dev` and must be verified as a separate dependent release surface.
 

package/dist/bin/api-server.cjs

@@ -29723,7 +29723,7 @@ var PACKAGE_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    PACKAGE_VERSION = "0.27.0";
+    PACKAGE_VERSION = "0.28.0";
   }
 });
 
@@ -34370,7 +34370,7 @@ var init_browser_agent_mcp_server = __esm({
 });
 
 // src/mcp/memory-tool-schemas.ts
-var import_zod37, AcceptShareSchema, ApproveSenderSchema, DeclineShareSchema, GetChatLinkSchema, InboxSettingsSchema, InviteAccountSchema, issueKeyTool_scopeShape, IssueKeySchema, ListApprovedSendersSchema, ListKeysSchema, NoteInboxSchema, RemoveApprovedSenderSchema, RevokeChatLinkSchema, RevokeKeySchema, RevokeShareSchema, SetAgentIdentitySchema, SetScopeSchema, ShareNoteSchema, ShareVaultSchema, SwapVaultSchema, SwitchAccountSchema, UnlinkShareSchema, memoryCaptureTool_notePropsSchema, MemoryCaptureSchema, MemoryQuestionsSchema, PrepareMemoryWriteSchema, validateMemoryWriteTool_notePropsSchema, ValidateMemoryWriteSchema, CreateChannelSchema, GetMessageNoteSchema, ListChannelMembersSchema, ListChannelMessagesSchema, MyMentionsSchema, PollChannelSchema, PostMessageSchema, ReactMessageSchema, RemoveChannelMemberSchema, ReplyMessageSchema, factHistoryTool_entryShape, FactHistorySchema, recordFactTool_factShape, RecordFactSchema, NoteBacklinksSchema, GraphPathSchema, GraphUniverseSchema, LibraryIngestSchema, bulkDeleteNotesTool_FilterSchema, BulkDeleteNotesSchema, DeleteNoteSchema, ExportSchema, getTool_notePropsSchema, GetSchema, ListSchema, putTool_notePropsSchema, PutSchema, searchTool_primitiveValue, SearchSchema, SuggestSchema, UploadSchema, TemporalRecallSchema, CreateScheduledActionSchema, DeleteScheduledActionSchema, GetScheduleLinkSchema, GetScheduleStatusSchema, ListScheduledActionsSchema, PauseScheduledActionSchema, ProposeScheduledActionSchema, ResumeScheduledActionSchema, RevokeScheduleLinkSchema, SetScheduleDefaultsSchema, SetScheduleEntitlementSchema, CostUsageSchema, StorageUsageSchema, CreateTableSchema, deleteTableRowsTool_FilterSchema, DeleteTableRowsSchema, DescribeTableSchema, DropTableSchema, InsertTableRowsSchema, ListTablesSchema, queryTableTool_FilterSchema, QueryTableSchema, ListTagsSchema, ResolveTagsSchema, UpsertTagSchema, AddVaultSchema, CreateSecureVaultSchema, DeleteVaultSchema, GetVaultContractSchema, ListSharedWithMeSchema, ListVaultsSchema, ProvisionDefaultsSchema, RouteMemorySchema, VideoAnalyzeStartSchema, VideoAnalyzeStatusSchema, CreateWebhookSchema, ListWebhooksSchema, RevokeWebhookSchema, MEMORY_TOOL_SCHEMAS;
+var import_zod37, AcceptShareSchema, ApproveSenderSchema, DeclineShareSchema, GetChatLinkSchema, GetVaultAppLinkSchema, InboxSettingsSchema, InviteAccountSchema, issueKeyTool_scopeShape, IssueKeySchema, ListApprovedSendersSchema, ListKeysSchema, NoteInboxSchema, RemoveApprovedSenderSchema, RevokeChatLinkSchema, RevokeKeySchema, RevokeShareSchema, RevokeVaultAppLinkSchema, SetAgentIdentitySchema, SetScopeSchema, ShareNoteSchema, ShareVaultSchema, SwapVaultSchema, SwitchAccountSchema, UnlinkShareSchema, memoryCaptureTool_notePropsSchema, MemoryCaptureSchema, MemoryQuestionsSchema, PrepareMemoryWriteSchema, validateMemoryWriteTool_notePropsSchema, ValidateMemoryWriteSchema, CreateChannelSchema, GetMessageNoteSchema, ListChannelMembersSchema, ListChannelMessagesSchema, MyMentionsSchema, PollChannelSchema, PostMessageSchema, ReactMessageSchema, RemoveChannelMemberSchema, ReplyMessageSchema, factHistoryTool_entryShape, FactHistorySchema, recordFactTool_factShape, RecordFactSchema, NoteBacklinksSchema, GraphPathSchema, GraphUniverseSchema, LibraryIngestSchema, bulkDeleteNotesTool_FilterSchema, BulkDeleteNotesSchema, DeleteNoteSchema, ExportSchema, getTool_notePropsSchema, GetSchema, ListSchema, putTool_notePropsSchema, PutSchema, searchTool_primitiveValue, SearchSchema, SuggestSchema, UploadSchema, TemporalRecallSchema, CreateScheduledActionSchema, DeleteScheduledActionSchema, GetScheduleLinkSchema, GetScheduleStatusSchema, ListScheduledActionsSchema, PauseScheduledActionSchema, ProposeScheduledActionSchema, ResumeScheduledActionSchema, RevokeScheduleLinkSchema, SetScheduleDefaultsSchema, SetScheduleEntitlementSchema, CostUsageSchema, StorageUsageSchema, CreateTableSchema, deleteTableRowsTool_FilterSchema, DeleteTableRowsSchema, DescribeTableSchema, DropTableSchema, InsertTableRowsSchema, ListTablesSchema, queryTableTool_FilterSchema, QueryTableSchema, ListTagsSchema, ResolveTagsSchema, UpsertTagSchema, AddVaultSchema, CreateSecureVaultSchema, DeleteVaultSchema, GetVaultContractSchema, ListSharedWithMeSchema, ListVaultsSchema, ProvisionDefaultsSchema, RouteMemorySchema, VideoAnalyzeStartSchema, VideoAnalyzeStatusSchema, CreateWebhookSchema, ListWebhooksSchema, RevokeWebhookSchema, MEMORY_TOOL_SCHEMAS;
 var init_memory_tool_schemas = __esm({
   "src/mcp/memory-tool-schemas.ts"() {
     "use strict";
@@ -34455,6 +34455,25 @@ var init_memory_tool_schemas = __esm({
         openWorldHint: false
       }
     };
+    GetVaultAppLinkSchema = {
+      id: "get-vault-app-link",
+      upstreamName: "getVaultAppLinkTool",
+      description: "Get the durable, bookmarkable link to the mobile-first Vault App for People, Projects, and Tasks. The embedded secret is shown only once; revoke-vault-app-link then call this tool again to replace a link that was shared or leaked. This link is independent from Omni-Chat. Anyone holding it can use the Vault App as this identity.",
+      input: {},
+      output: {
+        ok: import_zod37.z.boolean().describe("True when the request succeeded."),
+        url: import_zod37.z.string().optional().describe("Vault App link. Present only when the secret is first minted; anyone holding it can use the Vault App as this identity."),
+        alreadyExists: import_zod37.z.boolean().optional().describe("True when an active Vault App link exists but its secret cannot be shown again."),
+        error: import_zod37.z.string().optional().describe("Human-readable error when the request cannot be completed.")
+      },
+      annotations: {
+        title: "Get Vault App Link",
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: false
+      }
+    };
     InboxSettingsSchema = {
       id: "access-inbox-settings",
       upstreamName: "inboxSettingsTool",
@@ -34703,6 +34722,24 @@ var init_memory_tool_schemas = __esm({
         openWorldHint: false
       }
     };
+    RevokeVaultAppLinkSchema = {
+      id: "revoke-vault-app-link",
+      upstreamName: "revokeVaultAppLinkTool",
+      description: "Immediately revoke the current Vault App link without touching the separate Omni-Chat link. Call get-vault-app-link afterward to mint a replacement.",
+      input: {},
+      output: {
+        ok: import_zod37.z.boolean().describe("True when the request succeeded."),
+        revoked: import_zod37.z.boolean().optional().describe("True when an active Vault App link was revoked."),
+        error: import_zod37.z.string().optional().describe("Human-readable error when the request cannot be completed.")
+      },
+      annotations: {
+        title: "Revoke Vault App Link",
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      }
+    };
     SetAgentIdentitySchema = {
       id: "set-agent-identity",
       upstreamName: "setAgentIdentityTool",
@@ -36678,6 +36715,7 @@ var init_memory_tool_schemas = __esm({
       ApproveSenderSchema,
       DeclineShareSchema,
       GetChatLinkSchema,
+      GetVaultAppLinkSchema,
       InboxSettingsSchema,
       InviteAccountSchema,
       IssueKeySchema,
@@ -36688,6 +36726,7 @@ var init_memory_tool_schemas = __esm({
       RevokeChatLinkSchema,
       RevokeKeySchema,
       RevokeShareSchema,
+      RevokeVaultAppLinkSchema,
       SetAgentIdentitySchema,
       SetScopeSchema,
       ShareNoteSchema,
@@ -37290,6 +37329,14 @@ function registerBillingCutovers() {
     const result = await import_revoke_chat_link.revokeChatLinkTool.execute({ ...input, apiKey }, {});
     return { content: [{ type: "text", text: JSON.stringify(result ?? {}) }], structuredContent: result ?? {}, isError: false };
   });
+  registerCutover("getVaultAppLinkTool", async (input, apiKey) => {
+    const result = await import_get_vault_app_link.getVaultAppLinkTool.execute({ ...input, apiKey }, {});
+    return { content: [{ type: "text", text: JSON.stringify(result ?? {}) }], structuredContent: result ?? {}, isError: false };
+  });
+  registerCutover("revokeVaultAppLinkTool", async (input, apiKey) => {
+    const result = await import_revoke_vault_app_link.revokeVaultAppLinkTool.execute({ ...input, apiKey }, {});
+    return { content: [{ type: "text", text: JSON.stringify(result ?? {}) }], structuredContent: result ?? {}, isError: false };
+  });
   registerCutover("provisionDefaultsTool", async (input, apiKey) => {
     const result = await import_provision_defaults2.provisionDefaultsTool.execute({ ...input, apiKey }, {});
     return { content: [{ type: "text", text: JSON.stringify(result ?? {}) }], structuredContent: result ?? {}, isError: false };
@@ -37327,7 +37374,7 @@ function registerBillingCutovers() {
     return { content: [{ type: "text", text: JSON.stringify(result ?? {}) }], structuredContent: result ?? {}, isError: false };
   });
 }
-var import_issue_key, import_list_keys, import_revoke_key, import_set_scope, import_invite_account, import_get_chat_link, import_revoke_chat_link, import_provision_defaults2, import_create_secure_vault, import_create_scheduled_action, import_get_schedule_status, import_get_schedule_link, import_revoke_schedule_link, import_set_schedule_entitlement2, import_create_webhook, import_revoke_webhook, registered3;
+var import_issue_key, import_list_keys, import_revoke_key, import_set_scope, import_invite_account, import_get_chat_link, import_revoke_chat_link, import_get_vault_app_link, import_revoke_vault_app_link, import_provision_defaults2, import_create_secure_vault, import_create_scheduled_action, import_get_schedule_status, import_get_schedule_link, import_revoke_schedule_link, import_set_schedule_entitlement2, import_create_webhook, import_revoke_webhook, registered3;
 var init_billing = __esm({
   "src/mcp/memory-cutover/billing.ts"() {
     "use strict";
@@ -37339,6 +37386,8 @@ var init_billing = __esm({
     import_invite_account = require("mcpscraper-memory-tools/tools/access/invite-account");
     import_get_chat_link = require("mcpscraper-memory-tools/tools/access/get-chat-link");
     import_revoke_chat_link = require("mcpscraper-memory-tools/tools/access/revoke-chat-link");
+    import_get_vault_app_link = require("mcpscraper-memory-tools/tools/access/get-vault-app-link");
+    import_revoke_vault_app_link = require("mcpscraper-memory-tools/tools/access/revoke-vault-app-link");
     import_provision_defaults2 = require("mcpscraper-memory-tools/tools/vaults/provision-defaults");
     import_create_secure_vault = require("mcpscraper-memory-tools/tools/vaults/create-secure-vault");
     import_create_scheduled_action = require("mcpscraper-memory-tools/tools/schedule/create-scheduled-action");
@@ -41124,6 +41173,158 @@ var init_chat_routes = __esm({
   }
 });
 
+// src/api/vault-routes.ts
+function validToken(token) {
+  return !!token && token.startsWith("mk_") && token.length > 20 && token.length < 256;
+}
+function isVault(value) {
+  return typeof value === "string" && VAULTS.includes(value);
+}
+function stringValue(value, max = 1e4) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed && trimmed.length <= max ? trimmed : null;
+}
+function propsValue(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const entries = Object.entries(value);
+  if (entries.length > 80) return null;
+  return Object.fromEntries(entries.filter(([key]) => key.length <= 96));
+}
+function cors(c) {
+  const origin = c.req.header("origin");
+  const configured = (process.env.VAULT_APP_ALLOWED_ORIGINS ?? "https://vault.mcpscraper.dev").split(",").map((value) => value.trim()).filter(Boolean);
+  const local = !!origin && /^http:\/\/localhost(?::\d+)?$/.test(origin);
+  if (origin && (configured.includes(origin) || local)) c.header("Access-Control-Allow-Origin", origin);
+  c.header("Vary", "Origin");
+  c.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+  c.header("Access-Control-Allow-Headers", "content-type");
+}
+function workspaceRecord(vault, note) {
+  const props = note.props ?? {};
+  return {
+    id: `${vault}:${note.path}`,
+    vault,
+    path: note.path,
+    title: note.title,
+    content: note.content,
+    type: typeof props.type === "string" ? props.type : defaultType(vault),
+    status: typeof props.status === "string" ? props.status : defaultStatus(vault),
+    props,
+    revision: note.revision,
+    updatedAt: note.updatedAt,
+    capturedAt: note.capturedAt
+  };
+}
+function defaultType(vault) {
+  if (vault === "People") return "person";
+  if (vault === "Projects") return "project";
+  if (vault === "Tasks") return "task";
+  return "activity";
+}
+function defaultStatus(vault) {
+  if (vault === "People") return "active";
+  if (vault === "Projects") return "active";
+  if (vault === "Tasks") return "to_do";
+  return "triaged";
+}
+async function readVault(vault, token) {
+  const list = await memoryCall("listTool", { vault }, token);
+  if (!list.ok) throw new Error(list.error ?? `unable to read ${vault}`);
+  const noteRefs = (list.notes ?? []).slice(0, 200);
+  const notes = await Promise.all(
+    noteRefs.map(async ({ path: path6 }) => memoryCall("getTool", { vault, path: path6 }, token))
+  );
+  return notes.filter((result) => result.ok && !!result.note).map((result) => workspaceRecord(vault, result.note));
+}
+var import_hono22, VAULTS, vaultApp;
+var init_vault_routes = __esm({
+  "src/api/vault-routes.ts"() {
+    "use strict";
+    import_hono22 = require("hono");
+    init_memory();
+    VAULTS = ["People", "Projects", "Tasks", "Communications"];
+    vaultApp = new import_hono22.Hono();
+    vaultApp.use("/api/*", async (c, next) => {
+      cors(c);
+      if (c.req.method === "OPTIONS") return c.body(null, 204);
+      await next();
+    });
+    vaultApp.get("/api/workspace", async (c) => {
+      const token = c.req.query("token");
+      if (!validToken(token)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
+      try {
+        const requested = c.req.query("vault");
+        const vaults = isVault(requested) ? [requested] : VAULTS;
+        const results = await Promise.all(vaults.map((vault) => readVault(vault, token)));
+        const records = results.flat().sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+        return c.json({ ok: true, records, limited: results.some((result) => result.length >= 200) });
+      } catch (error) {
+        return c.json({ ok: false, error: error instanceof Error ? error.message : "unable to load vault workspace" }, 502);
+      }
+    });
+    vaultApp.post("/api/records", async (c) => {
+      const body = await c.req.json().catch(() => ({}));
+      const token = typeof body.token === "string" ? body.token : void 0;
+      if (!validToken(token)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
+      const vault = body.vault;
+      const path6 = stringValue(body.path, 320);
+      const title = stringValue(body.title, 320);
+      const content = typeof body.content === "string" && body.content.length <= 1e5 ? body.content : "";
+      const props = propsValue(body.props) ?? {};
+      if (!isVault(vault) || !path6 || !title) return c.json({ ok: false, error: "vault, path, and title are required" }, 400);
+      const baseRevision = typeof body.baseRevision === "number" && Number.isInteger(body.baseRevision) ? body.baseRevision : void 0;
+      const result = await memoryCall("putTool", { vault, path: path6, title, content: content || title, props, ...baseRevision === void 0 ? {} : { baseRevision } }, token);
+      return c.json(result, result.ok ? 200 : result.conflict ? 409 : 502);
+    });
+    vaultApp.post("/api/records/transition", async (c) => {
+      const body = await c.req.json().catch(() => ({}));
+      const token = typeof body.token === "string" ? body.token : void 0;
+      if (!validToken(token)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
+      const vault = typeof body.vault === "string" ? body.vault : "";
+      const path6 = typeof body.path === "string" ? body.path : "";
+      const status = stringValue(body.status, 80);
+      const baseRevision = typeof body.baseRevision === "number" && Number.isInteger(body.baseRevision) ? body.baseRevision : void 0;
+      if (!isVault(vault) || !path6 || !status) return c.json({ ok: false, error: "valid vault, path, and status are required" }, 400);
+      const current = await memoryCall("getTool", { vault, path: path6 }, token);
+      if (!current.ok || !current.note) return c.json(current, current.ok ? 404 : 502);
+      const result = await memoryCall("putTool", {
+        vault,
+        path: path6,
+        title: current.note.title,
+        content: current.note.content,
+        props: { ...current.note.props ?? {}, status },
+        baseRevision: baseRevision ?? current.note.revision
+      }, token);
+      return c.json(result, result.ok ? 200 : result.conflict ? 409 : 502);
+    });
+    vaultApp.post("/api/activity", async (c) => {
+      const body = await c.req.json().catch(() => ({}));
+      const token = typeof body.token === "string" ? body.token : void 0;
+      if (!validToken(token)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
+      const title = stringValue(body.title, 320);
+      const content = typeof body.content === "string" && body.content.length <= 2e4 ? body.content : "";
+      const props = propsValue(body.props) ?? {};
+      if (!title) return c.json({ ok: false, error: "title is required" }, 400);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const result = await memoryCall("putTool", {
+        vault: "Communications",
+        path: `Inbox/activity-${stamp}`,
+        title,
+        content: content || title,
+        props: { status: "triaged", type: "decision", occurred_at: (/* @__PURE__ */ new Date()).toISOString(), ...props }
+      }, token);
+      return c.json(result, result.ok ? 200 : 502);
+    });
+    vaultApp.get("/:token", (c) => {
+      const token = c.req.param("token");
+      if (!validToken(token)) return c.html('<!doctype html><html><body style="font-family:system-ui;padding:40px"><h2>This Vault App link is not valid.</h2><p>Ask the AI to run get-vault-app-link again, or revoke-vault-app-link and issue a replacement.</p></body></html>', 401);
+      const base = (process.env.VAULT_APP_BASE_URL ?? "https://vault.mcpscraper.dev").replace(/\/$/, "");
+      return c.redirect(`${base}/vault/${encodeURIComponent(token)}`, 302);
+    });
+  }
+});
+
 // src/api/schedule-routes.ts
 function tokenOk2(token) {
   return !!token && token.startsWith("mk_") && token.length > 10;
@@ -41394,13 +41595,13 @@ loadActions();
 </body>
 </html>`;
 }
-var import_hono22, scheduleApp;
+var import_hono23, scheduleApp;
 var init_schedule_routes = __esm({
   "src/api/schedule-routes.ts"() {
     "use strict";
-    import_hono22 = require("hono");
+    import_hono23 = require("hono");
     init_memory();
-    scheduleApp = new import_hono22.Hono();
+    scheduleApp = new import_hono23.Hono();
     scheduleApp.get("/api/status", async (c) => {
       const token = c.req.query("token");
       if (!tokenOk2(token)) return jsonError2("missing or malformed token", 401);
@@ -41635,17 +41836,17 @@ async function forwardReceivedEmail(resend, email, destination, label) {
   if (sent.error) throw new Error(`forward failed: ${sent.error.message}`);
   return sent.data.id;
 }
-var import_hono23, import_resend, SUPPORT_ADDRESS, DMARC_ADDRESS, FORWARD_FROM, resendInboundApp;
+var import_hono24, import_resend, SUPPORT_ADDRESS, DMARC_ADDRESS, FORWARD_FROM, resendInboundApp;
 var init_resend_inbound_routes = __esm({
   "src/api/resend-inbound-routes.ts"() {
     "use strict";
-    import_hono23 = require("hono");
+    import_hono24 = require("hono");
     import_resend = require("resend");
     init_memory();
     SUPPORT_ADDRESS = "support@mcpscraper.dev";
     DMARC_ADDRESS = "dmarc@mcpscraper.dev";
     FORWARD_FROM = "MCP Scraper Support <support@updates.mcpscraper.dev>";
-    resendInboundApp = new import_hono23.Hono();
+    resendInboundApp = new import_hono24.Hono();
     resendInboundApp.post("/webhooks", async (c) => {
       const apiKey = process.env.RESEND_API_KEY?.trim();
       const webhookSecret = process.env.RESEND_WEBHOOK_SECRET?.trim();
@@ -45701,7 +45902,7 @@ async function checkHarvestLimits(user, reuseLockId) {
   }
   return null;
 }
-var import_resend2, import_hono24, import_hono25, import_factory6, import_cookie2, import_stripe3, secureCookies2, isProduction2, sessionCookieOptions2, requireAllowedOrigin, auth2, adminAuth, sessionAuth, requireIntegrationsTier, requirePaidSchedulingTier, app, STRIPE_API_VERSION2, SYNC_HARVEST_TIMEOUT_OVERRIDE_MS;
+var import_resend2, import_hono25, import_hono26, import_factory6, import_cookie2, import_stripe3, secureCookies2, isProduction2, sessionCookieOptions2, requireAllowedOrigin, auth2, adminAuth, sessionAuth, requireIntegrationsTier, requirePaidSchedulingTier, app, STRIPE_API_VERSION2, SYNC_HARVEST_TIMEOUT_OVERRIDE_MS;
 var init_server = __esm({
   "src/api/server.ts"() {
     "use strict";
@@ -45719,8 +45920,8 @@ var init_server = __esm({
     init_media_extractor();
     init_site_mapper();
     init_site_extractor();
-    import_hono24 = require("hono");
-    import_hono25 = require("inngest/hono");
+    import_hono25 = require("hono");
+    import_hono26 = require("inngest/hono");
     init_client();
     init_site_audit();
     init_site_extract();
@@ -45751,6 +45952,7 @@ var init_server = __esm({
     init_stripe_routes();
     init_oauth_routes();
     init_chat_routes();
+    init_vault_routes();
     init_schedule_routes();
     init_resend_inbound_routes();
     init_site_audit_worker();
@@ -45841,7 +46043,7 @@ var init_server = __esm({
       if (!hasPaidSchedulingAccess(user)) return c.json(paidPlanRequiredPayload(), 403);
       return next();
     });
-    app = new import_hono24.Hono();
+    app = new import_hono25.Hono();
     STRIPE_API_VERSION2 = "2026-02-25.clover";
     app.use("*", async (c, next) => {
       await next();
@@ -47869,7 +48071,7 @@ var init_server = __esm({
       const bundle = stored.find((a) => a.key.endsWith("bundle.zip"));
       return c.json({ ok: true, jobId, artifacts: stored.length, settlement, bundleUrl: bundle?.url ?? null, bundleBytes: bundle?.bytes ?? null });
     });
-    app.on(["GET", "POST", "PUT"], "/api/inngest", (0, import_hono25.serve)({ client: inngest, functions: [siteAuditFn, siteExtractFn] }));
+    app.on(["GET", "POST", "PUT"], "/api/inngest", (0, import_hono26.serve)({ client: inngest, functions: [siteAuditFn, siteExtractFn] }));
     app.route("/api/internal/site-architecture-auditor", siteAuditApp);
     app.route("/api/internal/memory", internalMemoryApp);
     app.route("/api/internal/billing", internalBillingApp);
@@ -47889,6 +48091,7 @@ var init_server = __esm({
     app.route("/mcp", mcpApp);
     app.route("/agent", buildBrowserAgentRoutes());
     app.route("/chat", chatApp);
+    app.route("/vault", vaultApp);
     app.route("/schedule", scheduleApp);
     app.route("/resend", resendInboundApp);
     app.get("/console", (c) => c.html(renderConsoleHtml()));