mcp-scraper 0.3.24 → 0.3.25

package/dist/{server-2SRARAO5.js → server-RRCKVBHG.js}

@@ -21,26 +21,30 @@ import {
   renderLinkReport,
   sanitizeAttempts,
   sanitizeHarvestResult
-} from "./chunk-GZ4W72WF.js";
+} from "./chunk-FE2WC4JR.js";
 import {
   csvRecords,
   listWorkflowDefinitions,
   rowsToCsv,
   runWorkflow,
   runWorkflowStep,
+  slugify,
   workflowDefinition,
   workflowOutputBaseDir,
   workflowStepCount,
   workflowSupportsSteps
-} from "./chunk-H2R232HK.js";
-import "./chunk-H7R4PPMG.js";
+} from "./chunk-NNEIXK5L.js";
+import "./chunk-WPHAMNT7.js";
 import {
   BROWSER_OPEN_MIN_BALANCE_MC,
   CONCURRENCY_PRICE_ID,
   CREDIT_COST_CATALOG,
+  FREE_SIGNUP_MC,
   LedgerOperation,
   MC_COSTS,
   MC_PER_CREDIT,
+  MEMORY_PLANS,
+  MEMORY_PLAN_QUOTA,
   SUBSCRIPTION_TIERS,
   SUBSCRIPTION_TIER_BY_KEY,
   browserActiveCostMc,
@@ -50,15 +54,20 @@ import {
   harvestProblemResponse,
   insufficientBalanceResponse,
   serializeHarvestProblem
-} from "./chunk-JTWQGPKF.js";
+} from "./chunk-WYCER2HW.js";
 import {
   BrowserDriver,
   MapsSelectors,
   buildYouTubeChannelVideosUrl,
+  currentCostContext,
   deleteKernelProxyId,
   harvest,
-  resolveKernelProxyId
-} from "./chunk-IGOEAKC7.js";
+  migrateCostTelemetry,
+  recordKernelSession,
+  recordVendorUsage,
+  resolveKernelProxyId,
+  runWithCostContext
+} from "./chunk-G7PQ64LM.js";
 import {
   CaptchaError,
   RECAPTCHA_INSTRUCTIONS,
@@ -67,7 +76,8 @@ import {
   browserServiceProfileSaveChanges,
   browserServiceProxyId,
   sanitizeVendorName
-} from "./chunk-ZAP7MYVO.js";
+} from "./chunk-3PRO376E.js";
+import "./chunk-K443GQY5.js";
 import {
   DEFAULT_MAPS_PROXY_MODE,
   DEFAULT_PROXY_MODE,
@@ -77,7 +87,7 @@ import {
   RawMapsHoursRowSchema,
   RawMapsOverviewSchema,
   RawMapsReviewStatsSchema
-} from "./chunk-LFATOGDF.js";
+} from "./chunk-BP27CZ5Q.js";
 import {
   SiteAuditJobRowSchema,
   advanceWorkflowRunStep,
@@ -86,6 +96,7 @@ import {
   checkRateLimit,
   completeJob,
   completeWorkflowRunRecord,
+  consumeCode,
   consumePasswordResetToken,
   countActiveUsers,
   createJob,
@@ -101,13 +112,18 @@ import {
   expireOldLots,
   failJob,
   failWorkflowRunRecord,
+  getClient,
   getDb,
   getJob,
   getLedger,
+  getMemoryPlan,
+  getMemoryProvisioned,
+  getRefresh,
   getUserByApiKey,
   getUserByEmail,
   getUserById,
   getUserByStripeCustomerId,
+  getUserMemoryCreds,
   getUserStats,
   getWorkflowArtifact,
   getWorkflowRun,
@@ -127,19 +143,27 @@ import {
   markWorkflowRunRunning,
   markWorkflowScheduleRan,
   patchWorkflowSchedule,
+  putCode,
+  putRefresh,
   reconcileBalanceMc,
   recordStripeEvent,
   recordWorkflowWebhookDelivery,
+  registerClient,
   replaceWorkflowArtifacts,
+  resolveUserByMemorySubscription,
   revokeApiKey,
   rotateApiKey,
+  rotateRefresh,
   setConcurrencySubId,
   setExtraConcurrencySlots,
+  setMemoryPlan,
+  setMemoryProvisioned,
   setPassword,
   setStripeCustomerId,
   setSubscriptionTier,
+  setUserMemoryCreds,
   verifyPassword
-} from "./chunk-3KYRG7O7.js";
+} from "./chunk-TRNSXR46.js";
 
 // src/blog/registry.ts
 var posts = [
@@ -3511,7 +3535,9 @@ async function fetchWithKernel(url) {
   const apiKey = browserServiceApiKey();
   if (!apiKey) throw new Error("Browser backend API key not set");
   const client2 = new Kernel({ apiKey });
-  const kb = await client2.browsers.create({ stealth: true, timeout_seconds: 60 });
+  const openedAtMs = Date.now();
+  const useHeadless = currentCostContext()?.forceHeadful !== true;
+  const kb = await client2.browsers.create({ stealth: true, ...useHeadless ? { headless: true } : {}, timeout_seconds: 60 });
   const browser = await chromium.connectOverCDP(kb.cdp_ws_url);
   try {
     const context = browser.contexts()[0] ?? await browser.newContext({
@@ -3526,6 +3552,7 @@ async function fetchWithKernel(url) {
     });
     await client2.browsers.deleteByID(kb.session_id).catch(() => {
     });
+    void recordKernelSession({ kernelSessionId: kb.session_id, source: "kernel_fetch", stealth: typeof kb.stealth === "boolean" ? kb.stealth : null, headlessSent: useHeadless ? true : null, proxyUsed: typeof kb.proxy_id === "string" ? Boolean(kb.proxy_id) : null, fallback: true, openedAtMs, closedAtMs: Date.now() });
   }
 }
 
@@ -4127,6 +4154,7 @@ async function captureLocal(url, device, wantScreenshot, wantBranding) {
 }
 async function captureKernel(url, kernelApiKey, device, wantScreenshot, wantBranding) {
   const kernel = new Kernel2({ apiKey: kernelApiKey });
+  const openedAtMs = Date.now();
   const session = await kernel.browsers.create({ stealth: true, timeout_seconds: 240 });
   const browser = await chromium2.connectOverCDP(session.cdp_ws_url);
   const vp = device === "mobile" ? MOBILE_VIEWPORT : DESKTOP_VIEWPORT;
@@ -4146,6 +4174,7 @@ async function captureKernel(url, kernelApiKey, device, wantScreenshot, wantBran
     return result;
   } finally {
     await browser.close();
+    void recordKernelSession({ kernelSessionId: session.session_id, source: "screenshot", stealth: typeof session.stealth === "boolean" ? session.stealth : null, headlessSent: null, proxyUsed: typeof session.proxy_id === "string" ? Boolean(session.proxy_id) : null, openedAtMs, closedAtMs: Date.now() });
   }
 }
 async function captureScreenshot(url, kernelApiKey, device = "desktop") {
@@ -4800,14 +4829,19 @@ async function crawlWithRotation(urls, opts) {
       let kb = null;
       let browser = null;
       let inBrowser = 0;
+      let kbOpenedAtMs = 0;
       const retire = () => {
-        const b = browser, k = kb;
+        const b = browser, k = kb, openedAtMs = kbOpenedAtMs;
         browser = null;
         kb = null;
+        kbOpenedAtMs = 0;
         if (b) void b.close().catch(() => {
         });
-        if (k) void client2.browsers.deleteByID(k.session_id).catch(() => {
-        });
+        if (k) {
+          void client2.browsers.deleteByID(k.session_id).catch(() => {
+          });
+          void recordKernelSession({ kernelSessionId: k.session_id, source: "rotating_crawl", stealth: typeof k.stealth === "boolean" ? k.stealth : null, headlessSent: headless, proxyUsed: typeof k.proxy_id === "string" ? Boolean(k.proxy_id) : null, openedAtMs, closedAtMs: Date.now() });
+        }
       };
       try {
         while (true) {
@@ -4819,6 +4853,7 @@ async function crawlWithRotation(urls, opts) {
             if (!browser || inBrowser >= urlsPerBrowser) {
               retire();
               kb = await createBrowserWithRetry(client2, headless);
+              kbOpenedAtMs = Date.now();
               browser = await withTimeout(chromium3.connectOverCDP(kb.cdp_ws_url), 3e4);
               inBrowser = 0;
             }
@@ -5226,7 +5261,7 @@ async function extractSite(opts) {
 }
 
 // src/api/server.ts
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono15 } from "hono";
 import { serve as serveInngest } from "inngest/hono";
 
 // src/inngest/client.ts
@@ -5301,6 +5336,7 @@ var DeepInfraLlmClient = class {
     });
     if (!resp.ok) throw new Error(`DeepInfra error ${resp.status}: ${await resp.text()}`);
     const data = await resp.json();
+    void recordVendorUsage({ vendor: "deepinfra_qwen", model: this.model, units: data.usage?.completion_tokens ?? 0, unitType: "tokens" });
     return data.choices[0].message.content;
   }
   async completeJson(prompt) {
@@ -8924,6 +8960,8 @@ async function attemptKernelWhisper(videoId, kernelApiKey, kernelProxyId, falKey
       timestamp: c.timestamp,
       text: c.text.trim()
     }));
+    const audioSec = chunks.length ? chunks[chunks.length - 1]?.timestamp?.[1] ?? 0 : 0;
+    void recordVendorUsage({ vendor: "fal_wizper", model: "fal-ai/wizper", units: audioSec / 60, unitType: "audio_min" });
     const text = data.text ?? chunks.map((c) => c.text).join(" ");
     if (!text) return null;
     return { videoId, text, chunks, durationMs: Date.now() - start, method: "browser-whisper" };
@@ -9007,7 +9045,9 @@ var ExtractUrlBodySchema = z11.object({
   extractBranding: z11.boolean().optional(),
   downloadMedia: z11.boolean().optional(),
   mediaTypes: z11.array(z11.enum(["image", "video", "audio"])).optional(),
-  allowLocal: z11.boolean().optional()
+  allowLocal: z11.boolean().optional(),
+  depositToVault: z11.boolean().optional(),
+  vaultName: z11.string().trim().min(1).max(120).optional()
 });
 var MapUrlsBodySchema = z11.object({
   url: z11.string().min(1, "url is required"),
@@ -10351,6 +10391,8 @@ async function transcribeMediaUrl(mediaUrl, markdownTitle = "# Media Transcript"
   const text = data.text ?? "";
   const chunks = data.chunks ?? [];
   const durationMs = Date.now() - startMs;
+  const audioSec = chunks.length ? chunks[chunks.length - 1]?.timestamp?.[1] ?? 0 : 0;
+  void recordVendorUsage({ vendor: "fal_wizper", model: "fal-ai/wizper", units: audioSec / 60, unitType: "audio_min" });
   return {
     text,
     chunks,
@@ -10410,21 +10452,24 @@ function buildPageIntelUrl(body, country) {
   if (body.pageId?.trim()) return `https://www.facebook.com/ads/library/?active_status=all&ad_type=all&country=${country}&is_targeted_country=false&media_type=all&search_type=page&view_all_page_id=${body.pageId.trim()}`;
   return `https://www.facebook.com/ads/library/?active_status=all&ad_type=all&country=${country}&q=${encodeURIComponent(body.query.trim())}&search_type=keyword_unordered`;
 }
+function configuredKernelProxy() {
+  return (process.env.BROWSER_SERVICE_PROXY_ID ?? process.env.KERNEL_PROXY_ID)?.trim() || void 0;
+}
 function kernelLaunchOpts() {
-  return { headless: true, kernelApiKey: browserServiceApiKey(), kernelProxyId: browserServiceProxyId(), viewport: { width: 1280, height: 900 }, locale: "en-US" };
+  return { headless: true, kernelApiKey: browserServiceApiKey(), kernelProxyId: configuredKernelProxy(), viewport: { width: 1280, height: 900 }, locale: "en-US" };
 }
 async function kernelLaunchOptsResidential() {
-  let proxyId = browserServiceProxyId();
+  let proxyId = configuredKernelProxy();
   try {
     const resolution = await resolveKernelProxyId({
       kernelApiKey: browserServiceApiKey(),
       proxyMode: DEFAULT_PROXY_MODE,
-      configuredKernelProxyId: browserServiceProxyId(),
+      configuredKernelProxyId: configuredKernelProxy(),
       gl: "us"
     });
     if (resolution.kernelProxyId) proxyId = resolution.kernelProxyId;
   } catch {
-    proxyId = browserServiceProxyId();
+    proxyId = configuredKernelProxy();
   }
   return { headless: true, kernelApiKey: browserServiceApiKey(), kernelProxyId: proxyId, viewport: { width: 1280, height: 900 }, locale: "en-US" };
 }
@@ -11162,10 +11207,14 @@ function resolveProfileName(body) {
   const explicit = body.profile?.trim();
   return explicit || browserServiceProfileName();
 }
+function configuredKernelProxy2() {
+  return (process.env.BROWSER_SERVICE_PROXY_ID ?? process.env.KERNEL_PROXY_ID)?.trim() || void 0;
+}
 async function kernelLaunchOptsDirect(profileName, saveProfileChanges) {
   return {
     headless: true,
     kernelApiKey: browserServiceApiKey(),
+    kernelProxyId: configuredKernelProxy2(),
     ...profileName ? { kernelProfileName: profileName } : {},
     ...typeof saveProfileChanges === "boolean" ? { kernelProfileSaveChanges: saveProfileChanges } : {},
     viewport: { width: 1280, height: 900 },
@@ -11420,8 +11469,136 @@ instagramApp.post("/media-download", createApiKeyAuth(), async (c) => {
   }
 });
 
-// src/api/maps-routes.ts
+// src/api/reddit-routes.ts
 import { Hono as Hono6 } from "hono";
+import { z as z15 } from "zod";
+var RedditThreadBodySchema = z15.object({
+  url: z15.string().trim().min(1, "url is required"),
+  maxComments: z15.number().int().min(1).max(2e3).optional()
+});
+function invalidRequest3(message) {
+  return { error_code: "invalid_request", message };
+}
+function toOldReddit(url) {
+  try {
+    const u = new URL(url.trim());
+    if (!/(^|\.)reddit\.com$/.test(u.hostname.toLowerCase()) && u.hostname.toLowerCase() !== "redd.it") return null;
+    u.hostname = "old.reddit.com";
+    u.protocol = "https:";
+    return u.toString();
+  } catch {
+    return null;
+  }
+}
+async function residentialProxyId(attemptIndex) {
+  try {
+    const r = await resolveKernelProxyId({
+      kernelApiKey: browserServiceApiKey(),
+      proxyMode: "location",
+      location: "Austin, TX",
+      gl: "us",
+      attemptIndex,
+      fresh: true
+    });
+    return r.kernelProxyId;
+  } catch {
+    return void 0;
+  }
+}
+var PARSE_REDDIT = `(() => {
+  const txt = el => ((el && el.innerText) || '').trim();
+  const attr = (el, a) => ((el && el.getAttribute(a)) || '').trim();
+  const bodyText = (document.body && document.body.innerText) || '';
+  const blocked = /whoa there|blocked by network|you've been blocked|network (policy|security)|log in to your reddit account/i.test(bodyText);
+  const post = document.querySelector('#siteTable .thing.link') || document.querySelector('.thing.link');
+  const title = txt(document.querySelector('a.title')) || (document.title || '');
+  const author = attr(post, 'data-author');
+  const scoreEl = post && post.querySelector('.score.unvoted');
+  const score = scoreEl ? ((scoreEl.getAttribute('title') || scoreEl.textContent || '').trim()) : '';
+  const postBody = txt(post && post.querySelector('.usertext-body .md'));
+  const comments = [];
+  document.querySelectorAll('.commentarea .comment').forEach(c => {
+    const entry = c.querySelector(':scope > .entry');
+    if (!entry) return;
+    const a = attr(c, 'data-author');
+    const b = txt(entry.querySelector('.usertext-body .md'));
+    if (!b) return;
+    const s = ((entry.querySelector('.score.unvoted') || {}).textContent || '').trim();
+    let depth = 0, p = c.parentElement;
+    while (p) { if (p.classList && p.classList.contains('comment')) depth++; p = p.parentElement; }
+    comments.push({ author: a, score: s, depth: depth, body: b });
+  });
+  return { title: title, author: author, score: score, postBody: postBody, blocked: blocked, numComments: comments.length, comments: comments };
+})()`;
+var redditApp = new Hono6();
+redditApp.post("/thread", createApiKeyAuth(), async (c) => {
+  const raw = await c.req.json().catch(() => ({}));
+  const parsed = RedditThreadBodySchema.safeParse(raw);
+  if (!parsed.success) return c.json(invalidRequest3(parsed.error.issues[0]?.message ?? "Invalid request"), 400);
+  const body = parsed.data;
+  const oldUrl = toOldReddit(body.url);
+  if (!oldUrl) return c.json(invalidRequest3("url must be a reddit.com link"), 400);
+  const user = c.get("user");
+  const gate = await acquireConcurrencyGate(user, "reddit_thread", {
+    reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
+    metadata: { url: body.url }
+  });
+  if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
+  let debited = false;
+  let refunded = false;
+  try {
+    const { ok, balance_mc } = await debitMc(user.id, MC_COSTS.reddit_thread, LedgerOperation.REDDIT_THREAD, body.url);
+    if (!ok) return c.json(insufficientBalanceResponse(balance_mc, MC_COSTS.reddit_thread), 402);
+    debited = true;
+    let result = null;
+    for (let attempt = 0; attempt < 3 && !result; attempt++) {
+      const proxyId = await residentialProxyId(attempt);
+      const driver = new BrowserDriver();
+      try {
+        await driver.launch({
+          headless: true,
+          headlessMode: "headful",
+          kernelApiKey: browserServiceApiKey(),
+          kernelProxyId: proxyId,
+          viewport: { width: 1280, height: 900 },
+          locale: "en-US"
+        });
+        const page = driver.getPage();
+        await page.goto(oldUrl, { waitUntil: "domcontentloaded", timeout: 45e3 });
+        await page.waitForTimeout(2500);
+        const data = await page.evaluate(PARSE_REDDIT);
+        if (!data.blocked && (data.postBody || data.comments.length > 0)) {
+          result = { ...data, sourceUrl: body.url, oldRedditUrl: oldUrl, attempts: attempt + 1 };
+        }
+      } catch {
+      } finally {
+        await driver.close();
+      }
+    }
+    if (!result) {
+      await creditMc(user.id, MC_COSTS.reddit_thread, LedgerOperation.REDDIT_THREAD_REFUND, "reddit blocked/empty after retries");
+      refunded = true;
+      await logRequestEvent({ userId: user.id, source: "reddit_thread", status: "failed", query: body.url, error: "reddit blocked/empty after retries" });
+      return c.json({ error: "Reddit blocked the request after retries (refunded)" }, 503);
+    }
+    if (body.maxComments && Array.isArray(result.comments)) {
+      result.comments = result.comments.slice(0, body.maxComments);
+      result.numComments = result.comments.length;
+    }
+    await logRequestEvent({ userId: user.id, source: "reddit_thread", status: "done", query: body.url, resultCount: Number(result.numComments ?? 0), result });
+    return c.json(result);
+  } catch (err) {
+    if (debited && !refunded) await creditMc(user.id, MC_COSTS.reddit_thread, LedgerOperation.REDDIT_THREAD_REFUND, "failed call");
+    const msg = err instanceof Error ? err.message : String(err);
+    await logRequestEvent({ userId: user.id, source: "reddit_thread", status: "failed", query: body.url, error: msg });
+    return c.json({ error: msg }, 500);
+  } finally {
+    await releaseConcurrencyGate(gate.lockId);
+  }
+});
+
+// src/api/maps-routes.ts
+import { Hono as Hono7 } from "hono";
 
 // src/extractor/MapsNavigator.ts
 var MapsNavigator = class {
@@ -11596,7 +11773,7 @@ var MapsReviewCollector = class {
 };
 
 // src/extractor/MapsExtractor.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var MapsExtractor = class {
   constructor(driver) {
     this.driver = driver;
@@ -11782,7 +11959,7 @@ var MapsExtractor = class {
       });
       return rows;
     }, { hoursTable: MapsSelectors.hoursTable, hoursTableAlt: MapsSelectors.hoursTableAlt });
-    const result = z15.array(RawMapsHoursRowSchema).safeParse(raw);
+    const result = z16.array(RawMapsHoursRowSchema).safeParse(raw);
     if (!result.success) {
       console.warn("[MapsExtractor] hours parse failed", result.error.flatten());
       return [];
@@ -11846,7 +12023,7 @@ var MapsExtractor = class {
       });
       return results;
     });
-    const result = z15.array(RawMapsAboutAttributeSchema).safeParse(raw);
+    const result = z16.array(RawMapsAboutAttributeSchema).safeParse(raw);
     if (!result.success) {
       console.warn("[MapsExtractor] about parse failed", result.error.flatten());
       return [];
@@ -12107,7 +12284,7 @@ async function cleanupDisposableProxy(kernelApiKey, proxyId, eventName) {
 }
 async function runMapsSearchWithRotation(options) {
   const attempts = [];
-  const maxAttempts = mapsSearchMaxAttemptsForProxyMode(options.proxyMode);
+  const maxAttempts = mapsSearchMaxAttemptsForProxyMode(options.proxyMode) + 1;
   const started = Date.now();
   let lastError = null;
   for (let attemptIndex = 0; attemptIndex < maxAttempts; attemptIndex += 1) {
@@ -12129,12 +12306,15 @@ async function runMapsSearchWithRotation(options) {
         fresh: options.proxyMode === "location"
       });
       disposableProxyId = resolution.disposableProxyId;
-      const result = await extractor.extract({
+      const extractArgs = {
         ...options,
         proxyZip,
         kernelProxyId: options.proxyMode === "none" ? void 0 : resolution.kernelProxyId,
         kernelProxyResolution: resolution.resolution
-      });
+      };
+      const isHeadfulEscalation = attemptIndex === maxAttempts - 1;
+      const baseCtx = currentCostContext();
+      const result = isHeadfulEscalation && baseCtx ? await runWithCostContext({ ...baseCtx, forceHeadful: true }, () => extractor.extract(extractArgs)) : await extractor.extract(extractArgs);
       const attempt = attemptFromDebug({
         attemptIndex,
         maxAttempts,
@@ -12219,7 +12399,7 @@ function mapsErrorResponse(c, err, errorCode) {
     attempts: rotationError?.attempts ?? void 0
   }, retryable ? 503 : 500);
 }
-var mapsApp = new Hono6();
+var mapsApp = new Hono7();
 mapsApp.post("/search", createApiKeyAuth(), async (c) => {
   const user = c.get("user");
   const body = await c.req.json().catch(() => ({}));
@@ -12357,12 +12537,12 @@ mapsApp.post("/place", createApiKeyAuth(), async (c) => {
 });
 
 // src/api/directory-routes.ts
-import { Hono as Hono7 } from "hono";
+import { Hono as Hono8 } from "hono";
 
 // src/directory/directory-workflow.ts
 import { mkdir as mkdir2, writeFile } from "fs/promises";
 import { join as join6 } from "path";
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 
 // src/directory/location-db.ts
 import { access, readFile } from "fs/promises";
@@ -12523,24 +12703,24 @@ async function resolveDirectoryMarkets(options) {
 }
 
 // src/directory/directory-workflow.ts
-var DirectoryWorkflowOptionsSchema = z16.object({
-  query: z16.string().min(1),
-  state: z16.string().min(2).default("TN"),
-  minPopulation: z16.number().int().min(0).default(1e5),
-  populationYear: z16.union(POPULATION_YEARS.map((year) => z16.literal(year))).default(2025),
-  maxCities: z16.number().int().min(1).max(100).default(25),
-  maxResultsPerCity: z16.number().int().min(1).max(50).default(50),
-  concurrency: z16.number().int().min(1).max(5).default(5),
-  includeZipGroups: z16.boolean().default(true),
-  usZipsCsvPath: z16.string().optional(),
-  saveCsv: z16.boolean().default(true),
-  gl: z16.string().length(2).default("us"),
-  hl: z16.string().length(2).default("en"),
-  proxyMode: z16.enum(["location", "configured", "none"]).default(DEFAULT_MAPS_PROXY_MODE),
-  proxyZip: z16.string().regex(/^\d{5}$/).optional(),
-  debug: z16.boolean().default(false),
-  headless: z16.boolean().default(true),
-  kernelApiKey: z16.string().optional()
+var DirectoryWorkflowOptionsSchema = z17.object({
+  query: z17.string().min(1),
+  state: z17.string().min(2).default("TN"),
+  minPopulation: z17.number().int().min(0).default(1e5),
+  populationYear: z17.union(POPULATION_YEARS.map((year) => z17.literal(year))).default(2025),
+  maxCities: z17.number().int().min(1).max(100).default(25),
+  maxResultsPerCity: z17.number().int().min(1).max(50).default(50),
+  concurrency: z17.number().int().min(1).max(5).default(5),
+  includeZipGroups: z17.boolean().default(true),
+  usZipsCsvPath: z17.string().optional(),
+  saveCsv: z17.boolean().default(true),
+  gl: z17.string().length(2).default("us"),
+  hl: z17.string().length(2).default("en"),
+  proxyMode: z17.enum(["location", "configured", "none"]).default(DEFAULT_MAPS_PROXY_MODE),
+  proxyZip: z17.string().regex(/^\d{5}$/).optional(),
+  debug: z17.boolean().default(false),
+  headless: z17.boolean().default(true),
+  kernelApiKey: z17.string().optional()
 });
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
@@ -12761,7 +12941,7 @@ async function runDirectoryWorkflowFromPlan(options, plan) {
 }
 
 // src/api/directory-routes.ts
-var directoryApp = new Hono7();
+var directoryApp = new Hono8();
 directoryApp.post("/run", createApiKeyAuth(), async (c) => {
   const user = c.get("user");
   const body = await c.req.json().catch(() => ({}));
@@ -12834,35 +13014,35 @@ directoryApp.post("/run", createApiKeyAuth(), async (c) => {
 // src/api/workflow-routes.ts
 import { createHmac } from "crypto";
 import { readFile as readFile2 } from "fs/promises";
-import { Hono as Hono8 } from "hono";
-import { z as z17 } from "zod";
-var workflowApp = new Hono8();
-var WorkflowInputSchema = z17.record(z17.unknown()).default({});
-var WorkflowIdSchema = z17.string().min(1);
-var CadenceSchema = z17.enum(["daily", "weekly", "monthly"]);
-var ScheduleStatusSchema = z17.enum(["active", "paused"]);
-var RunBodySchema = z17.object({
+import { Hono as Hono9 } from "hono";
+import { z as z18 } from "zod";
+var workflowApp = new Hono9();
+var WorkflowInputSchema = z18.record(z18.unknown()).default({});
+var WorkflowIdSchema = z18.string().min(1);
+var CadenceSchema = z18.enum(["daily", "weekly", "monthly"]);
+var ScheduleStatusSchema = z18.enum(["active", "paused"]);
+var RunBodySchema = z18.object({
   workflowId: WorkflowIdSchema,
   input: WorkflowInputSchema,
-  webhookUrl: z17.string().url().optional()
+  webhookUrl: z18.string().url().optional()
 });
-var ScheduleCreateSchema = z17.object({
+var ScheduleCreateSchema = z18.object({
   workflowId: WorkflowIdSchema,
-  name: z17.string().min(1).max(120).optional(),
+  name: z18.string().min(1).max(120).optional(),
   input: WorkflowInputSchema,
   cadence: CadenceSchema.default("weekly"),
-  timezone: z17.string().min(1).max(64).default("UTC"),
-  webhookUrl: z17.string().url().optional(),
-  nextRunAt: z17.string().datetime().optional()
+  timezone: z18.string().min(1).max(64).default("UTC"),
+  webhookUrl: z18.string().url().optional(),
+  nextRunAt: z18.string().datetime().optional()
 });
-var SchedulePatchSchema = z17.object({
-  name: z17.string().min(1).max(120).optional(),
+var SchedulePatchSchema = z18.object({
+  name: z18.string().min(1).max(120).optional(),
   status: ScheduleStatusSchema.optional(),
   input: WorkflowInputSchema.optional(),
   cadence: CadenceSchema.optional(),
-  timezone: z17.string().min(1).max(64).optional(),
-  webhookUrl: z17.string().url().nullable().optional(),
-  nextRunAt: z17.string().datetime().nullable().optional()
+  timezone: z18.string().min(1).max(64).optional(),
+  webhookUrl: z18.string().url().nullable().optional(),
+  nextRunAt: z18.string().datetime().nullable().optional()
 });
 function hostedWorkflowOutputDir() {
   return workflowOutputBaseDir(process.env.MCP_SCRAPER_WORKFLOW_OUTPUT_DIR?.trim() || "/tmp/mcp-scraper-workflows");
@@ -13366,7 +13546,7 @@ workflowApp.post("/cron/dispatch", async (c) => {
 });
 
 // src/api/serp-intelligence-routes.ts
-import { Hono as Hono9 } from "hono";
+import { Hono as Hono10 } from "hono";
 
 // src/serp-intelligence/page-snapshot-extractor.ts
 import { createHash as createHash2 } from "crypto";
@@ -13678,7 +13858,7 @@ async function capturePageSnapshots(targets, options = {}) {
 }
 
 // src/serp-intelligence/schemas.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var SerpIntelligenceDeviceValues = ["desktop", "mobile"];
 var SerpIntelligenceProxyModeValues = ["location", "configured", "none"];
 var SerpIntelligenceAttemptOutcomeValues = [
@@ -13740,171 +13920,171 @@ function isPublicHttpUrl(value) {
     return false;
   }
 }
-var SerpIntelligencePublicHttpUrlSchema = z18.string().url().refine(isPublicHttpUrl, "url must be a public HTTP or HTTPS URL");
-var SerpIntelligenceCaptureBodySchema = z18.object({
-  query: z18.string().trim().min(1, "query is required"),
-  location: z18.string().trim().min(1).optional(),
-  gl: z18.string().trim().length(2).default("us"),
-  hl: z18.string().trim().length(2).default("en"),
-  device: z18.enum(SerpIntelligenceDeviceValues).default("desktop"),
-  proxyMode: z18.enum(SerpIntelligenceProxyModeValues).default(DEFAULT_PROXY_MODE),
-  proxyZip: z18.string().regex(/^\d{5}$/).optional(),
-  pages: z18.number().int().min(1).max(2).default(1),
-  debug: z18.boolean().default(false),
-  includePageSnapshots: z18.boolean().default(false),
-  pageSnapshotLimit: z18.number().int().min(0).max(10).default(0)
+var SerpIntelligencePublicHttpUrlSchema = z19.string().url().refine(isPublicHttpUrl, "url must be a public HTTP or HTTPS URL");
+var SerpIntelligenceCaptureBodySchema = z19.object({
+  query: z19.string().trim().min(1, "query is required"),
+  location: z19.string().trim().min(1).optional(),
+  gl: z19.string().trim().length(2).default("us"),
+  hl: z19.string().trim().length(2).default("en"),
+  device: z19.enum(SerpIntelligenceDeviceValues).default("desktop"),
+  proxyMode: z19.enum(SerpIntelligenceProxyModeValues).default(DEFAULT_PROXY_MODE),
+  proxyZip: z19.string().regex(/^\d{5}$/).optional(),
+  pages: z19.number().int().min(1).max(2).default(1),
+  debug: z19.boolean().default(false),
+  includePageSnapshots: z19.boolean().default(false),
+  pageSnapshotLimit: z19.number().int().min(0).max(10).default(0)
 }).strict();
-var SerpIntelligencePageSnapshotRequestSchema = z18.object({
+var SerpIntelligencePageSnapshotRequestSchema = z19.object({
   url: SerpIntelligencePublicHttpUrlSchema,
-  sourceKind: z18.enum(SerpPageSnapshotSourceKindValues).default("configured_target"),
-  sourcePosition: z18.number().int().min(1).optional()
+  sourceKind: z19.enum(SerpPageSnapshotSourceKindValues).default("configured_target"),
+  sourcePosition: z19.number().int().min(1).optional()
 }).strict();
-var SerpIntelligencePageSnapshotsBodySchema = z18.object({
-  urls: z18.array(SerpIntelligencePublicHttpUrlSchema).min(1).max(25),
-  targets: z18.array(SerpIntelligencePageSnapshotRequestSchema).min(1).max(25).optional(),
-  maxConcurrency: z18.number().int().min(1).max(5).default(2),
-  timeoutMs: z18.number().int().min(1e3).max(6e4).default(15e3),
-  debug: z18.boolean().default(false)
+var SerpIntelligencePageSnapshotsBodySchema = z19.object({
+  urls: z19.array(SerpIntelligencePublicHttpUrlSchema).min(1).max(25),
+  targets: z19.array(SerpIntelligencePageSnapshotRequestSchema).min(1).max(25).optional(),
+  maxConcurrency: z19.number().int().min(1).max(5).default(2),
+  timeoutMs: z19.number().int().min(1e3).max(6e4).default(15e3),
+  debug: z19.boolean().default(false)
 }).strict();
-var SerpIntelligenceAICitationSchema = z18.object({
-  text: z18.string(),
-  href: z18.string()
+var SerpIntelligenceAICitationSchema = z19.object({
+  text: z19.string(),
+  href: z19.string()
 }).strict();
-var SerpIntelligenceOrganicResultSchema = z18.object({
-  position: z18.number().int().min(1),
-  title: z18.string(),
-  url: z18.string(),
-  domain: z18.string(),
-  cite: z18.string().nullable(),
-  snippet: z18.string().nullable(),
-  isRedditStyle: z18.boolean(),
-  inlineRating: z18.object({
-    value: z18.string(),
-    count: z18.string()
+var SerpIntelligenceOrganicResultSchema = z19.object({
+  position: z19.number().int().min(1),
+  title: z19.string(),
+  url: z19.string(),
+  domain: z19.string(),
+  cite: z19.string().nullable(),
+  snippet: z19.string().nullable(),
+  isRedditStyle: z19.boolean(),
+  inlineRating: z19.object({
+    value: z19.string(),
+    count: z19.string()
   }).strict().nullable()
 }).strict();
-var SerpIntelligenceLocationEvidenceSchema = z18.object({
-  status: z18.enum(SerpIntelligenceLocalizationStatusValues),
-  expected: z18.object({
-    city: z18.string(),
-    regionCode: z18.string().nullable(),
-    canonicalLocation: z18.string()
+var SerpIntelligenceLocationEvidenceSchema = z19.object({
+  status: z19.enum(SerpIntelligenceLocalizationStatusValues),
+  expected: z19.object({
+    city: z19.string(),
+    regionCode: z19.string().nullable(),
+    canonicalLocation: z19.string()
   }).strict().nullable(),
-  candidates: z18.array(z18.object({
-    city: z18.string(),
-    regionCode: z18.string(),
-    count: z18.number().int().min(0),
-    examples: z18.array(z18.string())
+  candidates: z19.array(z19.object({
+    city: z19.string(),
+    regionCode: z19.string(),
+    count: z19.number().int().min(0),
+    examples: z19.array(z19.string())
   }).strict())
 }).strict();
-var SerpIntelligenceHarvestResultSchema = z18.object({
-  seed: z18.string(),
-  location: z18.string().nullable(),
-  extractedAt: z18.string(),
-  totalQuestions: z18.number().int().min(0),
-  surface: z18.enum(["web", "aim", "unknown"]),
-  aiOverview: z18.object({
-    detected: z18.boolean(),
-    text: z18.string().nullable(),
-    citations: z18.array(SerpIntelligenceAICitationSchema),
-    expanded: z18.boolean().optional(),
-    fullyExpanded: z18.boolean().optional(),
-    sections: z18.array(z18.string()).optional()
+var SerpIntelligenceHarvestResultSchema = z19.object({
+  seed: z19.string(),
+  location: z19.string().nullable(),
+  extractedAt: z19.string(),
+  totalQuestions: z19.number().int().min(0),
+  surface: z19.enum(["web", "aim", "unknown"]),
+  aiOverview: z19.object({
+    detected: z19.boolean(),
+    text: z19.string().nullable(),
+    citations: z19.array(SerpIntelligenceAICitationSchema),
+    expanded: z19.boolean().optional(),
+    fullyExpanded: z19.boolean().optional(),
+    sections: z19.array(z19.string()).optional()
   }).strict(),
-  aiMode: z18.object({
-    detected: z18.boolean(),
-    text: z18.string().nullable(),
-    citations: z18.array(SerpIntelligenceAICitationSchema)
+  aiMode: z19.object({
+    detected: z19.boolean(),
+    text: z19.string().nullable(),
+    citations: z19.array(SerpIntelligenceAICitationSchema)
   }).strict(),
-  tree: z18.array(z18.unknown()),
-  flat: z18.array(z18.unknown()),
-  videos: z18.array(z18.unknown()),
-  forums: z18.array(z18.unknown()),
-  organicResults: z18.array(SerpIntelligenceOrganicResultSchema),
-  localPack: z18.array(z18.unknown()),
-  entityIds: z18.object({
-    entities: z18.array(z18.object({
-      name: z18.string(),
-      kgId: z18.string().nullable(),
-      cid: z18.string().nullable(),
-      gcid: z18.string().nullable()
+  tree: z19.array(z19.unknown()),
+  flat: z19.array(z19.unknown()),
+  videos: z19.array(z19.unknown()),
+  forums: z19.array(z19.unknown()),
+  organicResults: z19.array(SerpIntelligenceOrganicResultSchema),
+  localPack: z19.array(z19.unknown()),
+  entityIds: z19.object({
+    entities: z19.array(z19.object({
+      name: z19.string(),
+      kgId: z19.string().nullable(),
+      cid: z19.string().nullable(),
+      gcid: z19.string().nullable()
     }).strict()),
-    kgIds: z18.array(z18.string()),
-    cids: z18.array(z18.string()),
-    gcids: z18.array(z18.string())
+    kgIds: z19.array(z19.string()),
+    cids: z19.array(z19.string()),
+    gcids: z19.array(z19.string())
   }).strict(),
-  stats: z18.object({
-    seed: z18.string(),
-    totalQuestions: z18.number().int().min(0),
-    maxDepthReached: z18.number().int().min(0),
-    durationMs: z18.number().min(0),
-    errorCount: z18.number().int().min(0)
+  stats: z19.object({
+    seed: z19.string(),
+    totalQuestions: z19.number().int().min(0),
+    maxDepthReached: z19.number().int().min(0),
+    durationMs: z19.number().min(0),
+    errorCount: z19.number().int().min(0)
   }).strict(),
-  diagnostics: z18.object({
-    completionStatus: z18.enum(["paa_found", "no_paa", "serp_only"]),
-    problem: z18.null(),
-    warnings: z18.array(z18.unknown()).optional(),
-    debug: z18.object({
+  diagnostics: z19.object({
+    completionStatus: z19.enum(["paa_found", "no_paa", "serp_only"]),
+    problem: z19.null(),
+    warnings: z19.array(z19.unknown()).optional(),
+    debug: z19.object({
       locationEvidence: SerpIntelligenceLocationEvidenceSchema.optional()
     }).passthrough().optional()
   }).passthrough(),
-  whatPeopleSaying: z18.array(z18.unknown())
+  whatPeopleSaying: z19.array(z19.unknown())
 }).strict();
-var SerpIntelligenceCaptureAttemptSchema = z18.object({
-  attemptNumber: z18.number().int().min(1),
-  outcome: z18.enum(SerpIntelligenceAttemptOutcomeValues),
-  startedAt: z18.string().optional(),
-  completedAt: z18.string().optional(),
-  durationMs: z18.number().min(0).optional(),
-  problemCode: z18.string().optional(),
-  message: z18.string().optional(),
-  kernelSessionId: z18.string().nullable().optional(),
-  cleanupSucceeded: z18.boolean().nullable().optional()
+var SerpIntelligenceCaptureAttemptSchema = z19.object({
+  attemptNumber: z19.number().int().min(1),
+  outcome: z19.enum(SerpIntelligenceAttemptOutcomeValues),
+  startedAt: z19.string().optional(),
+  completedAt: z19.string().optional(),
+  durationMs: z19.number().min(0).optional(),
+  problemCode: z19.string().optional(),
+  message: z19.string().optional(),
+  kernelSessionId: z19.string().nullable().optional(),
+  cleanupSucceeded: z19.boolean().nullable().optional()
 }).strict();
-var SerpPageSnapshotCaptureSchema = z18.object({
+var SerpPageSnapshotCaptureSchema = z19.object({
   url: SerpIntelligencePublicHttpUrlSchema,
   requestedUrl: SerpIntelligencePublicHttpUrlSchema,
   finalUrl: SerpIntelligencePublicHttpUrlSchema.nullable(),
-  sourceKind: z18.enum(SerpPageSnapshotSourceKindValues),
-  sourcePosition: z18.number().int().min(1).nullable(),
-  status: z18.enum(SerpPageFetchStatusValues),
-  fetchedVia: z18.enum(SerpPageFetchedViaValues).nullable(),
-  httpStatus: z18.number().int().min(100).max(599).nullable(),
-  contentType: z18.string().nullable(),
-  title: z18.string().nullable(),
+  sourceKind: z19.enum(SerpPageSnapshotSourceKindValues),
+  sourcePosition: z19.number().int().min(1).nullable(),
+  status: z19.enum(SerpPageFetchStatusValues),
+  fetchedVia: z19.enum(SerpPageFetchedViaValues).nullable(),
+  httpStatus: z19.number().int().min(100).max(599).nullable(),
+  contentType: z19.string().nullable(),
+  title: z19.string().nullable(),
   canonicalUrl: SerpIntelligencePublicHttpUrlSchema.nullable(),
-  metaDescription: z18.string().nullable(),
-  headings: z18.array(z18.object({
-    level: z18.number().int().min(1).max(6),
-    text: z18.string()
+  metaDescription: z19.string().nullable(),
+  headings: z19.array(z19.object({
+    level: z19.number().int().min(1).max(6),
+    text: z19.string()
   }).strict()).default([]),
-  artifact: z18.object({
-    htmlBlobUrl: z18.string().url().nullable(),
-    textBlobUrl: z18.string().url().nullable(),
-    markdownBlobUrl: z18.string().url().nullable(),
-    screenshotBlobUrl: z18.string().url().nullable(),
-    contentSha256: z18.string().nullable(),
-    capturedAt: z18.string().nullable()
+  artifact: z19.object({
+    htmlBlobUrl: z19.string().url().nullable(),
+    textBlobUrl: z19.string().url().nullable(),
+    markdownBlobUrl: z19.string().url().nullable(),
+    screenshotBlobUrl: z19.string().url().nullable(),
+    contentSha256: z19.string().nullable(),
+    capturedAt: z19.string().nullable()
   }).strict(),
-  error: z18.object({
-    code: z18.string(),
-    message: z18.string()
+  error: z19.object({
+    code: z19.string(),
+    message: z19.string()
   }).strict().nullable()
 }).strict();
-var SerpIntelligenceCaptureResponseSchema = z18.object({
+var SerpIntelligenceCaptureResponseSchema = z19.object({
   harvestResult: SerpIntelligenceHarvestResultSchema,
-  attempts: z18.array(SerpIntelligenceCaptureAttemptSchema),
+  attempts: z19.array(SerpIntelligenceCaptureAttemptSchema),
   locationEvidence: SerpIntelligenceLocationEvidenceSchema.nullable(),
-  pageSnapshotArtifacts: z18.array(SerpPageSnapshotCaptureSchema),
-  billing: z18.object({
-    creditsUsed: z18.number().min(0).optional(),
-    requestId: z18.string().optional(),
-    jobId: z18.string().optional()
+  pageSnapshotArtifacts: z19.array(SerpPageSnapshotCaptureSchema),
+  billing: z19.object({
+    creditsUsed: z19.number().min(0).optional(),
+    requestId: z19.string().optional(),
+    jobId: z19.string().optional()
   }).strict().optional()
 }).strict();
-var SerpIntelligencePageSnapshotsResponseSchema = z18.object({
-  pageSnapshotArtifacts: z18.array(SerpPageSnapshotCaptureSchema),
-  attempts: z18.array(SerpIntelligenceCaptureAttemptSchema).default([])
+var SerpIntelligencePageSnapshotsResponseSchema = z19.object({
+  pageSnapshotArtifacts: z19.array(SerpPageSnapshotCaptureSchema),
+  attempts: z19.array(SerpIntelligenceCaptureAttemptSchema).default([])
 }).strict();
 
 // src/serp-intelligence/serp-capture-service.ts
@@ -14076,7 +14256,7 @@ var SERP_INTELLIGENCE_RATE_LIMIT = 60;
 var SERP_INTELLIGENCE_RATE_WINDOW_SECONDS = 60;
 var POST_CAPTURE_ROUTE_LABEL = "POST /capture";
 var POST_PAGE_SNAPSHOTS_ROUTE_LABEL = "POST /page-snapshots";
-var serpIntelligenceApp = new Hono9();
+var serpIntelligenceApp = new Hono10();
 serpIntelligenceApp.use("*", createApiKeyAuth());
 function structuredError(input) {
   return {
@@ -14245,41 +14425,95 @@ serpIntelligenceApp.post("/page-snapshots", async (c) => {
 });
 
 // src/mcp/mcp-routes.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono11 } from "hono";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+
+// src/mcp/mcp-oauth.ts
+import { createRemoteJWKSet, jwtVerify } from "jose";
+function oauthIssuer() {
+  return (process.env.OAUTH_ISSUER ?? "https://mcpscraper.dev").replace(/\/$/, "");
+}
+function oauthResourceUrl() {
+  return (process.env.MCP_SCRAPER_RESOURCE_URL ?? "https://mcpscraper.dev/mcp").replace(/\/$/, "");
+}
+function oauthResourceBaseUrl() {
+  return (process.env.OAUTH_RS_BASE_URL ?? "https://mcpscraper.dev").replace(/\/$/, "");
+}
+function protectedResourceMetadata() {
+  return {
+    resource: oauthResourceUrl(),
+    authorization_servers: [oauthIssuer()],
+    scopes_supported: ["scraper.use"],
+    bearer_methods_supported: ["header"]
+  };
+}
+function wwwAuthenticateValue() {
+  return `Bearer resource_metadata="${oauthResourceBaseUrl()}/.well-known/oauth-protected-resource"`;
+}
+function isBearerJwt(token) {
+  return !token.startsWith("sk_") && token.split(".").length === 3;
+}
+var jwksSingleton = null;
+function getJwks() {
+  if (jwksSingleton) return jwksSingleton;
+  jwksSingleton = createRemoteJWKSet(new URL(`${oauthIssuer()}/.well-known/jwks.json`));
+  return jwksSingleton;
+}
+async function verifyScraperOAuthJwt(token) {
+  const { payload } = await jwtVerify(token, getJwks(), {
+    issuer: oauthIssuer(),
+    audience: oauthResourceUrl()
+  });
+  return payload;
+}
+
+// src/mcp/mcp-routes.ts
 configureReportSaving(false);
-function mcpAuthError() {
+function mcpAuthError(message = "authentication required") {
   const body = JSON.stringify({
     jsonrpc: "2.0",
     id: null,
     error: {
       code: -32001,
-      message: "authentication required"
+      message
     }
   });
   return new Response(body, {
     status: 401,
     headers: {
       "Content-Type": "application/json",
-      "WWW-Authenticate": 'Bearer realm="mcp-scraper", error="invalid_token", error_description="Pass an MCP Scraper API key as x-api-key or Bearer token"'
+      "WWW-Authenticate": wwwAuthenticateValue()
     }
   });
 }
 async function requireMcpCallerKey(c) {
   const xApiKey = c.req.header("x-api-key")?.trim();
   const authHeader = c.req.header("Authorization")?.trim();
-  const bearerKey = authHeader?.startsWith("Bearer ") ? authHeader.slice(7).trim() : void 0;
-  const callerKey = xApiKey ?? bearerKey;
+  const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7).trim() : void 0;
+  if (!xApiKey && bearerToken && isBearerJwt(bearerToken)) {
+    let identity;
+    try {
+      const payload = await verifyScraperOAuthJwt(bearerToken);
+      identity = typeof payload.sub === "string" ? payload.sub : "";
+    } catch {
+      return mcpAuthError("Bearer token is invalid or expired");
+    }
+    if (!identity) return mcpAuthError("Bearer token has no subject");
+    const user2 = await getUserByEmail(identity);
+    if (!user2 || !user2.api_key || user2.key_active !== 1) return mcpAuthError("No active MCP Scraper account for this identity");
+    return user2.api_key;
+  }
+  const callerKey = xApiKey ?? bearerToken;
   if (!callerKey) return mcpAuthError();
   const user = await getUserByApiKey(callerKey);
   if (!user) return mcpAuthError();
   return callerKey;
 }
-var mcpApp = new Hono10();
+var mcpApp = new Hono11();
 function registerSerpIntelligenceCaptureTools(server, executor) {
   server.registerTool("capture_serp_snapshot", {
     title: "SERP Intelligence Snapshot",
-    description: "Capture a structured SERP Intelligence Google snapshot through POST /serp-intelligence/capture, the same product capture path used by Phoenix. Split query from location and infer gl/hl. Omit proxyMode for normal use; the service defaults to the configured browser-service proxy without city/ZIP targeting for the highest general success rate. Use proxyMode location only when the user explicitly needs city/ZIP-targeted residential proxy evidence. Use none only for direct-network debugging. Set debug true when investigating location evidence, proxy behavior, CAPTCHA, or capture reliability.",
+    description: "Capture a structured SERP Intelligence Google snapshot through POST /serp-intelligence/capture, the same product capture path used by Phoenix. Split query from location and infer gl/hl. Routing is automatic \u2014 leave proxyMode unset. Set debug true when investigating location evidence, proxy behavior, CAPTCHA, or capture reliability.",
     inputSchema: CaptureSerpSnapshotInputSchema,
     outputSchema: CaptureSerpSnapshotOutputSchema,
     annotations: liveWebToolAnnotations("SERP Intelligence Snapshot")
@@ -14313,7 +14547,7 @@ mcpApp.all("/", async (c) => {
 });
 
 // src/api/browser-agent-routes.ts
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono12 } from "hono";
 
 // src/api/browser-agent-db.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -15747,7 +15981,7 @@ async function loadOpenSession(id, userId) {
   return row;
 }
 function buildBrowserAgentRoutes() {
-  const app2 = new Hono11();
+  const app2 = new Hono12();
   app2.use("*", async (c, next) => {
     await migrateBrowserAgent();
     return next();
@@ -16453,9 +16687,149 @@ if (state.key) { refreshSessions(); if (state.current) selectSession(state.curre
 
 // src/api/stripe-routes.ts
 import Stripe from "stripe";
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono13 } from "hono";
+
+// src/api/memory.ts
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "crypto";
+
+// src/api/session.ts
+import { createHmac as createHmac2, timingSafeEqual } from "crypto";
+var isProduction = () => process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
+function getSessionSecret() {
+  const configured = process.env.SESSION_SECRET?.trim();
+  if (configured) return configured;
+  if (isProduction()) throw new Error("SESSION_SECRET is not set \u2014 add it to your Vercel env vars (see src/api/env.ts)");
+  return "dev-secret-change-me";
+}
+var secret = () => getSessionSecret();
+function safeEqualHex(a, b) {
+  if (a.length !== b.length) return false;
+  try {
+    return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+  } catch {
+    return false;
+  }
+}
+function signSession(userId) {
+  const payload = String(userId);
+  const sig = createHmac2("sha256", secret()).update(payload).digest("hex");
+  return `${payload}.${sig}`;
+}
+function verifySession(token) {
+  const dot = token.lastIndexOf(".");
+  if (dot === -1) return null;
+  const payload = token.slice(0, dot);
+  const sig = token.slice(dot + 1);
+  const expected = createHmac2("sha256", secret()).update(payload).digest("hex");
+  if (!safeEqualHex(sig, expected)) return null;
+  const id = parseInt(payload);
+  return isNaN(id) ? null : id;
+}
+
+// src/api/memory.ts
+var MEMORY_BASE_URL = () => (process.env.MCP_MEMORY_BASE_URL ?? "https://mcp-memory-omega.vercel.app").replace(/\/$/, "");
+var ADMIN_KEY = () => process.env.MCP_MEMORY_ADMIN_KEY?.trim() ?? "";
+function isMemoryOperator(email) {
+  if (!email) return false;
+  const ops = (process.env.MEMORY_OPERATOR_IDENTITIES ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+  return ops.includes(email.trim().toLowerCase());
+}
+function encKey() {
+  return scryptSync(getSessionSecret(), "mcp-memory-key-v1", 32);
+}
+function encryptMemoryKey(secret2) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", encKey(), iv);
+  const enc = Buffer.concat([cipher.update(secret2, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${iv.toString("base64")}:${tag.toString("base64")}:${enc.toString("base64")}`;
+}
+function decryptMemoryKey(stored) {
+  try {
+    const [ivB, tagB, dataB] = stored.split(":");
+    const decipher = createDecipheriv("aes-256-gcm", encKey(), Buffer.from(ivB, "base64"));
+    decipher.setAuthTag(Buffer.from(tagB, "base64"));
+    return Buffer.concat([decipher.update(Buffer.from(dataB, "base64")), decipher.final()]).toString("utf8");
+  } catch {
+    return null;
+  }
+}
+async function memoryCall(toolName, args, userMemoryKey) {
+  try {
+    const res = await fetch(`${MEMORY_BASE_URL()}/api/mcp/thorbitMemoryServer/tools/${toolName}/execute`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ data: { ...args, apiKey: userMemoryKey } })
+    });
+    const body = await res.json().catch(() => null);
+    if (!res.ok) return { ok: false, error: body?.error ?? `memory ${toolName} failed (${res.status})` };
+    if (body?.result) return body.result;
+    return { ok: false, error: body?.error ?? `memory ${toolName} returned no result` };
+  } catch (err) {
+    return { ok: false, error: err?.message ?? "memory call failed" };
+  }
+}
+function personalVault(user) {
+  return `mcp-${user.id}`;
+}
+function memoryIdentity(user) {
+  return user.email;
+}
+function resolveMemoryIdentity(user) {
+  return memoryIdentity(user);
+}
+function memoryPlanForReads(user) {
+  if (isMemoryOperator(user.email)) return "unlimited";
+  if (user.memory_plan === "pro" || user.memory_plan === "team") return user.memory_plan;
+  return "free";
+}
+async function provisionMemoryForUser(user) {
+  try {
+    const { key } = await getOrCreateUserMemoryKey(user);
+    if (key) await setMemoryProvisioned(user.id, true);
+  } catch {
+  }
+}
+async function getOrCreateUserMemoryKey(user) {
+  const creds = await getUserMemoryCreds(user.id);
+  if (creds.memory_key) {
+    const decrypted = decryptMemoryKey(creds.memory_key);
+    if (decrypted) return { key: decrypted };
+  }
+  const admin = ADMIN_KEY();
+  if (!admin) return { key: null, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
+  const identity = memoryIdentity(user);
+  const plan = isMemoryOperator(user.email) ? "unlimited" : (await getMemoryPlan(user.id)).plan;
+  const provisioned = await memoryCall(
+    "provisionDefaultsTool",
+    { granteeIdentity: identity, issueKey: true, plan },
+    admin
+  );
+  if (!provisioned.ok || !provisioned.secret) {
+    return { key: null, error: provisioned.error ?? "failed to provision default vaults" };
+  }
+  await setUserMemoryCreds(user.id, encryptMemoryKey(provisioned.secret), identity);
+  return { key: provisioned.secret };
+}
+async function syncMemoryKeyPlan(user, plan) {
+  const effectivePlan = isMemoryOperator(user.email) ? "unlimited" : plan;
+  const { key, error } = await getOrCreateUserMemoryKey(user);
+  if (!key) return { ok: false, error: error ?? "memory unavailable" };
+  const listed = await memoryCall(
+    "listKeysTool",
+    {},
+    key
+  );
+  if (!listed.ok || !listed.keys?.length) return { ok: false, error: listed.error ?? "no memory keys found" };
+  const target = listed.keys[0];
+  if (target.plan === effectivePlan) return { ok: true };
+  const res = await memoryCall("setScopeTool", { keyId: target.keyId, plan: effectivePlan }, key);
+  return { ok: res.ok, error: res.error };
+}
+
+// src/api/stripe-routes.ts
 var stripe = new Stripe(process.env.STRIPE_SECRET_KEY, { apiVersion: "2026-02-25.clover" });
-var stripeApp = new Hono12();
+var stripeApp = new Hono13();
 stripeApp.post("/webhooks", async (c) => {
   const sig = c.req.header("stripe-signature");
   const body = await c.req.text();
@@ -16469,6 +16843,8 @@ stripeApp.post("/webhooks", async (c) => {
   if (!isNew) return c.json({ received: true });
   if (event.type === "invoice.paid" || event.type === "invoice.payment_succeeded") {
     const invoice = event.data.object;
+    const memLineId = invoice.lines.data.map(linePriceId).find((id) => id && id in MEMORY_PLANS);
+    if (memLineId) return c.json({ received: true });
     const lineTierId = invoice.lines.data.map(linePriceId).find((id) => id && id in SUBSCRIPTION_TIERS);
     if (lineTierId) {
       const tier = SUBSCRIPTION_TIERS[lineTierId];
@@ -16482,6 +16858,16 @@ stripeApp.post("/webhooks", async (c) => {
   if (event.type === "customer.subscription.created" || event.type === "customer.subscription.updated") {
     const sub = event.data.object;
     const priceId = sub.items.data[0]?.price?.id;
+    if (priceId && priceId in MEMORY_PLANS) {
+      const mem = MEMORY_PLANS[priceId];
+      const user2 = await resolveUser(sub.customer, sub.customer_email);
+      if (user2) {
+        const live = sub.status === "active" || sub.status === "trialing";
+        await setMemoryPlan(user2.id, live ? mem.plan : "free", live ? sub.id : null);
+        await syncMemoryKeyPlan(user2, live ? mem.plan : "free");
+      }
+      return c.json({ received: true });
+    }
     const user = await getUserByStripeCustomerId(sub.customer);
     if (!user) return c.json({ received: true });
     if (priceId && priceId in SUBSCRIPTION_TIERS) {
@@ -16496,6 +16882,14 @@ stripeApp.post("/webhooks", async (c) => {
   if (event.type === "customer.subscription.deleted") {
     const sub = event.data.object;
     const priceId = sub.items.data[0]?.price?.id;
+    if (priceId && priceId in MEMORY_PLANS || await resolveUserByMemorySubscription(sub.id)) {
+      const user2 = await resolveUserByMemorySubscription(sub.id) ?? await getUserByStripeCustomerId(sub.customer);
+      if (user2) {
+        await setMemoryPlan(user2.id, "free", null);
+        await syncMemoryKeyPlan(user2, "free");
+      }
+      return c.json({ received: true });
+    }
     const user = await getUserByStripeCustomerId(sub.customer);
     if (!user) return c.json({ received: true });
     if (priceId && priceId in SUBSCRIPTION_TIERS) {
@@ -16520,6 +16914,417 @@ async function resolveUser(customerId, emailFallback) {
   return user;
 }
 
+// src/api/oauth-routes.ts
+import { Hono as Hono14 } from "hono";
+import { getCookie, setCookie } from "hono/cookie";
+import { createHash as createHash3, randomBytes as randomBytes2, randomUUID as randomUUID3 } from "crypto";
+import { importPKCS8, exportJWK, SignJWT } from "jose";
+var ISSUER = "https://mcpscraper.dev";
+var RESOURCE = () => process.env.MCP_MEMORY_RESOURCE_URL ?? "https://mcp-memory-omega.vercel.app/mcp/thorbitMemoryServer/mcp";
+var SCRAPER_RESOURCE = () => (process.env.MCP_SCRAPER_RESOURCE_URL ?? "https://mcpscraper.dev/mcp").replace(/\/$/, "");
+var MEMORY_SCOPES = ["memory.read", "memory.write", "memory.admin"];
+var SCRAPER_SCOPES = ["scraper.use"];
+var SUPPORTED_SCOPES = [...MEMORY_SCOPES, ...SCRAPER_SCOPES];
+function isScraperResource(resource) {
+  if (!resource) return false;
+  return resource.replace(/\/$/, "") === SCRAPER_RESOURCE();
+}
+var ACCESS_TTL_SECONDS = 3600;
+var REFRESH_TTL_SECONDS = 60 * 60 * 24 * 30;
+var CODE_TTL_SECONDS = 60;
+var secureCookies = process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
+var sessionCookieOptions = {
+  httpOnly: true,
+  secure: secureCookies,
+  path: "/",
+  maxAge: 60 * 60 * 24 * 30,
+  sameSite: "Lax"
+};
+var cachedKeys = null;
+async function getKeys() {
+  if (cachedKeys) return cachedKeys;
+  const raw = process.env.OAUTH_SIGNING_KEY;
+  if (!raw?.trim()) throw new Error("OAUTH_SIGNING_KEY is not set");
+  const pem = raw.includes("BEGIN") ? raw : Buffer.from(raw, "base64").toString("utf8");
+  const privateKey = await importPKCS8(pem, "RS256", { extractable: true });
+  const full = await exportJWK(privateKey);
+  const publicJwk = { kty: full.kty, n: full.n, e: full.e };
+  const kid = createHash3("sha256").update(JSON.stringify({ e: publicJwk.e, kty: publicJwk.kty, n: publicJwk.n })).digest("base64url").slice(0, 16);
+  publicJwk.kid = kid;
+  publicJwk.alg = "RS256";
+  publicJwk.use = "sig";
+  cachedKeys = { privateKey, publicJwk, kid };
+  return cachedKeys;
+}
+function isAllowedRedirect(uri) {
+  let u;
+  try {
+    u = new URL(uri);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== "https:") return false;
+  const h = u.hostname.toLowerCase();
+  if (["claude.ai", "www.claude.ai", "claude.com", "www.claude.com"].includes(h)) return true;
+  if (h.endsWith(".claude.ai") || h.endsWith(".claude.com")) return true;
+  const extra = (process.env.OAUTH_EXTRA_REDIRECT_HOSTS ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+  return extra.includes(h);
+}
+function resolvePlan(user) {
+  if (isMemoryOperator(user.email)) return "unlimited";
+  if (user.memory_plan === "pro" || user.memory_plan === "team") return user.memory_plan;
+  return "free";
+}
+function negotiateScope(requested, user, resource) {
+  if (isScraperResource(resource)) return "scraper.use";
+  const operator = isMemoryOperator(user.email);
+  const wanted = (requested ?? "").split(/\s+/).map((s) => s.trim()).filter(Boolean);
+  const filtered = wanted.filter((s) => MEMORY_SCOPES.includes(s));
+  const base = filtered.length > 0 ? filtered : ["memory.read", "memory.write"];
+  const allowed = base.filter((s) => s === "memory.admin" ? operator : true);
+  const unique = [...new Set(allowed)];
+  if (operator && !unique.includes("memory.admin")) unique.push("memory.admin");
+  return unique.join(" ");
+}
+async function sessionUser(token) {
+  if (!token) return null;
+  const userId = verifySession(token);
+  if (!userId) return null;
+  const user = await getUserById(userId);
+  return user ?? null;
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function hiddenFields(p) {
+  const fields = [
+    ["response_type", p.response_type],
+    ["client_id", p.client_id],
+    ["redirect_uri", p.redirect_uri],
+    ["code_challenge", p.code_challenge],
+    ["code_challenge_method", p.code_challenge_method],
+    ["scope", p.scope],
+    ["state", p.state],
+    ["resource", p.resource]
+  ];
+  return fields.map(([k, v]) => `<input type="hidden" name="${k}" value="${escapeHtml(v)}" />`).join("");
+}
+function scopeLabel(scope) {
+  const map = {
+    "memory.read": "Read your vaults, notes and search",
+    "memory.write": "Create and edit notes in your vaults",
+    "memory.admin": "Full administrative access",
+    "scraper.use": "Run web scraping, search, maps and social tools (billed to your account)"
+  };
+  return scope.split(/\s+/).filter(Boolean).map((s) => map[s] ?? s).map((l) => `<li>${escapeHtml(l)}</li>`).join("");
+}
+function resourceLabel(resource) {
+  return isScraperResource(resource) ? "MCP Scraper" : "mcp-memory";
+}
+function pageShell(inner) {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width,initial-scale=1" /><title>Authorize Claude \xB7 mcp-memory</title><style>
+  :root{color-scheme:dark}
+  *{box-sizing:border-box}
+  body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0b0d10;color:#e8eaed;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;padding:24px}
+  .card{width:100%;max-width:420px;background:#14171c;border:1px solid #232830;border-radius:16px;padding:32px}
+  h1{font-size:20px;margin:0 0 4px}
+  p.sub{color:#9aa3ad;font-size:14px;margin:0 0 24px}
+  label{display:block;font-size:13px;color:#9aa3ad;margin:14px 0 6px}
+  input[type=email],input[type=password]{width:100%;padding:11px 13px;background:#0b0d10;border:1px solid #2b313a;border-radius:9px;color:#e8eaed;font-size:14px}
+  input:focus{outline:none;border-color:#5b8cff}
+  button{width:100%;margin-top:20px;padding:12px;border:0;border-radius:9px;font-size:14px;font-weight:600;cursor:pointer}
+  .primary{background:#5b8cff;color:#fff}
+  .ghost{background:transparent;color:#9aa3ad;border:1px solid #2b313a;margin-top:10px}
+  ul{margin:14px 0;padding-left:18px;color:#cbd2da;font-size:13px;line-height:1.7}
+  .err{background:#3a1b1f;border:1px solid #6b2b30;color:#ffb4b4;padding:10px 12px;border-radius:9px;font-size:13px;margin-bottom:16px}
+  .who{font-size:13px;color:#9aa3ad;margin-bottom:8px}
+  </style></head><body><div class="card">${inner}</div></body></html>`;
+}
+function renderLogin(p, error) {
+  return pageShell(`
+  <h1>Sign in to ${escapeHtml(resourceLabel(p.resource))}</h1>
+  <p class="sub">Authorize Claude to connect to your ${escapeHtml(resourceLabel(p.resource))} on mcpscraper.dev.</p>
+  ${error ? `<div class="err">${escapeHtml(error)}</div>` : ""}
+  <form method="post" action="/oauth/authorize">
+    ${hiddenFields(p)}
+    <input type="hidden" name="action" value="login" />
+    <label for="email">Email</label>
+    <input id="email" name="email" type="email" autocomplete="username" required />
+    <label for="password">Password</label>
+    <input id="password" name="password" type="password" autocomplete="current-password" required />
+    <button class="primary" type="submit">Sign in</button>
+  </form>`);
+}
+function renderConsent(p, email, error) {
+  return pageShell(`
+  <h1>Connect Claude to ${escapeHtml(resourceLabel(p.resource))}</h1>
+  <p class="sub">Allow Claude to access your ${escapeHtml(resourceLabel(p.resource))}?</p>
+  ${error ? `<div class="err">${escapeHtml(error)}</div>` : ""}
+  <div class="who">Signed in as <strong>${escapeHtml(email)}</strong></div>
+  <ul>${scopeLabel(p.scope)}</ul>
+  <form method="post" action="/oauth/authorize">
+    ${hiddenFields(p)}
+    <input type="hidden" name="action" value="approve" />
+    <button class="primary" type="submit">Allow</button>
+  </form>
+  <form method="post" action="/oauth/authorize">
+    ${hiddenFields(p)}
+    <input type="hidden" name="action" value="deny" />
+    <button class="ghost" type="submit">Deny</button>
+  </form>`);
+}
+function redirectWithError(redirectUri, state, error) {
+  const u = new URL(redirectUri);
+  u.searchParams.set("error", error);
+  if (state) u.searchParams.set("state", state);
+  return new Response(null, { status: 302, headers: { Location: u.toString() } });
+}
+var oauthApp = new Hono14();
+oauthApp.use("*", async (c, next) => {
+  c.header("Access-Control-Allow-Origin", "*");
+  c.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+  c.header("Access-Control-Allow-Headers", "Content-Type, Authorization, mcp-protocol-version");
+  if (c.req.method === "OPTIONS") return c.body(null, 204);
+  return next();
+});
+function authServerMetadata() {
+  return {
+    issuer: ISSUER,
+    authorization_endpoint: `${ISSUER}/oauth/authorize`,
+    token_endpoint: `${ISSUER}/oauth/token`,
+    registration_endpoint: `${ISSUER}/oauth/register`,
+    jwks_uri: `${ISSUER}/.well-known/jwks.json`,
+    scopes_supported: [...SUPPORTED_SCOPES],
+    response_types_supported: ["code"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
+    code_challenge_methods_supported: ["S256"],
+    token_endpoint_auth_methods_supported: ["none"]
+  };
+}
+function openidConfiguration() {
+  return {
+    ...authServerMetadata(),
+    subject_types_supported: ["public"],
+    id_token_signing_alg_values_supported: ["RS256"]
+  };
+}
+oauthApp.get("/.well-known/oauth-authorization-server", (c) => {
+  console.log("[oauth-dcr] GET /.well-known/oauth-authorization-server ua=%s", c.req.header("user-agent") ?? "");
+  return c.json(authServerMetadata());
+});
+oauthApp.get("/.well-known/oauth-authorization-server/*", (c) => {
+  console.log("[oauth-dcr] GET %s (path-aware AS) ua=%s", c.req.path, c.req.header("user-agent") ?? "");
+  return c.json(authServerMetadata());
+});
+oauthApp.get("/.well-known/openid-configuration", (c) => {
+  console.log("[oauth-dcr] GET /.well-known/openid-configuration ua=%s", c.req.header("user-agent") ?? "");
+  return c.json(openidConfiguration());
+});
+oauthApp.get("/.well-known/openid-configuration/*", (c) => {
+  console.log("[oauth-dcr] GET %s (path-aware OIDC) ua=%s", c.req.path, c.req.header("user-agent") ?? "");
+  return c.json(openidConfiguration());
+});
+oauthApp.get("/.well-known/jwks.json", async (c) => {
+  const { publicJwk } = await getKeys();
+  c.header("Cache-Control", "public, max-age=3600");
+  return c.json({ keys: [publicJwk] });
+});
+oauthApp.get("/.well-known/oauth-protected-resource", (c) => {
+  return c.json(protectedResourceMetadata());
+});
+oauthApp.get("/.well-known/oauth-protected-resource/*", (c) => {
+  return c.json(protectedResourceMetadata());
+});
+oauthApp.post("/oauth/register", async (c) => {
+  const rawBody = await c.req.text();
+  console.log("[oauth-dcr] POST /oauth/register ua=%s ct=%s body=%s", c.req.header("user-agent") ?? "", c.req.header("content-type") ?? "", rawBody.slice(0, 2e3));
+  let body;
+  try {
+    body = rawBody ? JSON.parse(rawBody) : null;
+  } catch {
+    body = null;
+  }
+  if (!body) {
+    console.log("[oauth-dcr] register REJECT reason=body_not_json");
+    return c.json({ error: "invalid_client_metadata", error_description: "Body must be JSON" }, 400);
+  }
+  console.log("[oauth-dcr] register body keys=%s redirect_uris=%s", Object.keys(body).join(","), JSON.stringify(body.redirect_uris));
+  const redirectUris = Array.isArray(body.redirect_uris) ? body.redirect_uris.filter((u) => typeof u === "string") : [];
+  if (redirectUris.length === 0) {
+    console.log("[oauth-dcr] register REJECT reason=no_redirect_uris");
+    return c.json({ error: "invalid_redirect_uri", error_description: "redirect_uris is required" }, 400);
+  }
+  for (const uri of redirectUris) {
+    if (!isAllowedRedirect(uri)) {
+      console.log("[oauth-dcr] register REJECT reason=redirect_uri_not_allowed uri=%s", uri);
+      return c.json({ error: "invalid_redirect_uri", error_description: `redirect_uri not allowed: ${uri}` }, 400);
+    }
+  }
+  const clientName = typeof body.client_name === "string" ? body.client_name : null;
+  const clientId = `client_${randomBytes2(16).toString("hex")}`;
+  await registerClient(clientId, redirectUris, clientName);
+  console.log("[oauth-dcr] register OK client_id=%s redirect_uris=%s", clientId, JSON.stringify(redirectUris));
+  return c.json({
+    client_id: clientId,
+    redirect_uris: redirectUris,
+    client_name: clientName ?? void 0,
+    token_endpoint_auth_method: "none",
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"],
+    client_id_issued_at: Math.floor(Date.now() / 1e3)
+  }, 201);
+});
+function parseAuthParams(get) {
+  return {
+    response_type: get("response_type") ?? "",
+    client_id: get("client_id") ?? "",
+    redirect_uri: get("redirect_uri") ?? "",
+    code_challenge: get("code_challenge") ?? "",
+    code_challenge_method: get("code_challenge_method") ?? "",
+    scope: get("scope") ?? "",
+    state: get("state") ?? "",
+    resource: get("resource") ?? ""
+  };
+}
+async function validateAuthRequest(p) {
+  if (p.response_type !== "code") return { ok: false, status: 400, message: "response_type must be code" };
+  if (!p.client_id) return { ok: false, status: 400, message: "client_id is required" };
+  const client2 = await getClient(p.client_id);
+  if (!client2) return { ok: false, status: 400, message: "unknown client_id" };
+  if (!p.redirect_uri || !client2.redirect_uris.includes(p.redirect_uri)) return { ok: false, status: 400, message: "redirect_uri does not match the registered set" };
+  if (!isAllowedRedirect(p.redirect_uri)) return { ok: false, status: 400, message: "redirect_uri host not allowed" };
+  if (!p.code_challenge || p.code_challenge_method !== "S256") return { ok: false, status: 400, message: "PKCE S256 code_challenge is required" };
+  return { ok: true };
+}
+oauthApp.get("/oauth/authorize", async (c) => {
+  const p = parseAuthParams((k) => c.req.query(k));
+  console.log("[oauth-dcr] GET /oauth/authorize client_id=%s redirect_uri=%s scope=%s resource=%s", p.client_id, p.redirect_uri, p.scope, p.resource);
+  const valid = await validateAuthRequest(p);
+  if (!valid.ok) {
+    console.log("[oauth-dcr] authorize REJECT reason=%s", valid.message);
+    return c.text(valid.message, valid.status);
+  }
+  const user = await sessionUser(getCookie(c, "session"));
+  if (!user) return c.html(renderLogin(p));
+  const negotiated = { ...p, scope: negotiateScope(p.scope, user, p.resource) };
+  return c.html(renderConsent(negotiated, user.email));
+});
+oauthApp.post("/oauth/authorize", async (c) => {
+  const form = await c.req.parseBody();
+  const get = (k) => {
+    const v = form[k];
+    return typeof v === "string" ? v : void 0;
+  };
+  const p = parseAuthParams(get);
+  const action = get("action") ?? "";
+  const valid = await validateAuthRequest(p);
+  if (!valid.ok) return c.text(valid.message, valid.status);
+  if (action === "login") {
+    const email = (get("email") ?? "").trim().toLowerCase();
+    const password = get("password") ?? "";
+    const user2 = email ? await getUserByEmail(email) : void 0;
+    const okPw = !!(user2 && user2.password_hash && verifyPassword(password, user2.password_hash));
+    console.log("[oauth-dcr] LOGIN email=%s found=%s hasHash=%s pwLen=%d ok=%s", email, !!user2, !!(user2 && user2.password_hash), password.length, okPw);
+    if (!okPw) {
+      return c.html(renderLogin(p, "Invalid email or password."));
+    }
+    setCookie(c, "session", signSession(user2.id), sessionCookieOptions);
+    return c.html(renderConsent({ ...p, scope: negotiateScope(p.scope, user2, p.resource) }, user2.email));
+  }
+  const user = await sessionUser(getCookie(c, "session"));
+  if (!user) return c.html(renderLogin(p, "Your session expired. Please sign in again."));
+  if (action === "deny") return redirectWithError(p.redirect_uri, p.state, "access_denied");
+  if (action !== "approve") return c.text("unsupported action", 400);
+  const scope = negotiateScope(p.scope, user, p.resource);
+  const code = `code_${randomBytes2(32).toString("base64url")}`;
+  const expiresAt = new Date(Date.now() + CODE_TTL_SECONDS * 1e3).toISOString();
+  await putCode({
+    code,
+    client_id: p.client_id,
+    redirect_uri: p.redirect_uri,
+    code_challenge: p.code_challenge,
+    identity: user.email,
+    scope,
+    resource: p.resource || RESOURCE(),
+    expires_at: expiresAt
+  });
+  const u = new URL(p.redirect_uri);
+  u.searchParams.set("code", code);
+  if (p.state) u.searchParams.set("state", p.state);
+  return new Response(null, { status: 302, headers: { Location: u.toString() } });
+});
+function pkceMatches(verifier, challenge) {
+  if (!verifier) return false;
+  const computed = createHash3("sha256").update(verifier).digest("base64url");
+  return computed === challenge;
+}
+async function mintAccessToken(identity, scope, plan, audience) {
+  const { privateKey, kid } = await getKeys();
+  return new SignJWT({ scope, plan }).setProtectedHeader({ alg: "RS256", kid }).setIssuer(ISSUER).setSubject(identity).setAudience(audience).setIssuedAt().setJti(randomUUID3()).setExpirationTime(`${ACCESS_TTL_SECONDS}s`).sign(privateKey);
+}
+function tokenErrorResponse(c, error, description, status) {
+  return c.json({ error, error_description: description }, status);
+}
+oauthApp.post("/oauth/token", async (c) => {
+  const form = await c.req.parseBody();
+  const get = (k) => {
+    const v = form[k];
+    return typeof v === "string" ? v : void 0;
+  };
+  const grantType = get("grant_type");
+  if (grantType === "authorization_code") {
+    const code = get("code") ?? "";
+    const clientId = get("client_id") ?? "";
+    const redirectUri = get("redirect_uri") ?? "";
+    const verifier = get("code_verifier") ?? "";
+    const record = await consumeCode(code);
+    if (!record) return tokenErrorResponse(c, "invalid_grant", "Authorization code is invalid or already used", 400);
+    if (new Date(record.expires_at).getTime() < Date.now()) return tokenErrorResponse(c, "invalid_grant", "Authorization code has expired", 400);
+    if (record.client_id !== clientId) return tokenErrorResponse(c, "invalid_grant", "client_id mismatch", 400);
+    if (record.redirect_uri !== redirectUri) return tokenErrorResponse(c, "invalid_grant", "redirect_uri mismatch", 400);
+    if (!pkceMatches(verifier, record.code_challenge)) return tokenErrorResponse(c, "invalid_grant", "PKCE verification failed", 400);
+    const user = await getUserByEmail(record.identity);
+    const plan = user ? resolvePlan(user) : "free";
+    const audience = record.resource ?? RESOURCE();
+    const accessToken = await mintAccessToken(record.identity, record.scope, plan, audience);
+    const refreshToken = `rt_${randomBytes2(40).toString("base64url")}`;
+    await putRefresh({
+      refresh_token: refreshToken,
+      client_id: clientId,
+      identity: record.identity,
+      scope: record.scope,
+      resource: audience,
+      expires_at: new Date(Date.now() + REFRESH_TTL_SECONDS * 1e3).toISOString(),
+      revoked: 0
+    });
+    return c.json({ access_token: accessToken, token_type: "Bearer", expires_in: ACCESS_TTL_SECONDS, refresh_token: refreshToken, scope: record.scope });
+  }
+  if (grantType === "refresh_token") {
+    const refreshToken = get("refresh_token") ?? "";
+    const clientId = get("client_id") ?? "";
+    const record = await getRefresh(refreshToken);
+    if (!record || record.revoked) return tokenErrorResponse(c, "invalid_grant", "Refresh token is invalid or revoked", 400);
+    if (new Date(record.expires_at).getTime() < Date.now()) return tokenErrorResponse(c, "invalid_grant", "Refresh token has expired", 400);
+    if (clientId && record.client_id !== clientId) return tokenErrorResponse(c, "invalid_grant", "client_id mismatch", 400);
+    const user = await getUserByEmail(record.identity);
+    const plan = user ? resolvePlan(user) : "free";
+    const audience = record.resource ?? RESOURCE();
+    const accessToken = await mintAccessToken(record.identity, record.scope, plan, audience);
+    const nextRefresh = `rt_${randomBytes2(40).toString("base64url")}`;
+    await rotateRefresh(refreshToken, {
+      refresh_token: nextRefresh,
+      client_id: record.client_id,
+      identity: record.identity,
+      scope: record.scope,
+      resource: audience,
+      expires_at: new Date(Date.now() + REFRESH_TTL_SECONDS * 1e3).toISOString(),
+      revoked: 0
+    });
+    return c.json({ access_token: accessToken, token_type: "Bearer", expires_in: ACCESS_TTL_SECONDS, refresh_token: nextRefresh, scope: record.scope });
+  }
+  return tokenErrorResponse(c, "unsupported_grant_type", "grant_type must be authorization_code or refresh_token", 400);
+});
+
 // src/api/site-audit-worker.ts
 var MAX_CONCURRENT_SITE_AUDIT = 1;
 async function drainSiteAuditQueue(budget) {
@@ -16555,12 +17360,115 @@ function startSiteAuditWorker() {
 
 // src/api/server.ts
 import { createMiddleware as createMiddleware3 } from "hono/factory";
-import { getCookie, setCookie, deleteCookie } from "hono/cookie";
+import { getCookie as getCookie2, setCookie as setCookie2, deleteCookie } from "hono/cookie";
 import Stripe2 from "stripe";
 
+// src/api/scrape-vault-sink.ts
+var MAX_DEPOSIT_CHARS = 5e6;
+var SCRAPE_FALLBACK_PREFIX = "scrape-fallback/";
+var SCRAPE_BLOB_TTL_MS = 24 * 60 * 60 * 1e3;
+async function depositScrapeToVault(user, opts) {
+  try {
+    const content = (opts.content ?? "").trim();
+    if (!content) return { deposited: false, error: "empty content" };
+    const clipped = content.length > MAX_DEPOSIT_CHARS ? content.slice(0, MAX_DEPOSIT_CHARS) : content;
+    const { key, error } = await getOrCreateUserMemoryKey(user);
+    if (!key) return { deposited: false, error: error ?? "memory unavailable" };
+    const vault = opts.vault?.trim() || personalVault(user);
+    const title = (opts.title?.trim() || opts.source).slice(0, 200);
+    const res = await memoryCall(
+      "libraryIngestTool",
+      { title, content: clipped, source: opts.source, vault },
+      key
+    );
+    if (!res.ok) return { deposited: false, vault, error: res.error ?? "ingest failed" };
+    return { deposited: true, vault, noteId: res.noteId, path: res.path, chunks: res.chunks };
+  } catch (err) {
+    return { deposited: false, error: err?.message ?? "deposit failed" };
+  }
+}
+async function uploadFallbackBlob(opts) {
+  try {
+    const content = (opts.content ?? "").trim();
+    if (!content) return null;
+    const slug = (slugify(opts.title || opts.source) || "scrape").slice(0, 60);
+    const key = `${SCRAPE_FALLBACK_PREFIX}${slug}.md`;
+    const doc = `# ${opts.title}
+Source: ${opts.source}
+
+${content}`;
+    const stored = await getBlobStore().put(key, doc, "text/markdown");
+    return { fileUrl: stored.url, fileExpiresAt: new Date(Date.now() + SCRAPE_BLOB_TTL_MS).toISOString() };
+  } catch {
+    return null;
+  }
+}
+async function persistScrapeBody(user, opts) {
+  const deposit = await depositScrapeToVault(user, opts);
+  if (deposit.deposited) return deposit;
+  const fallback = await uploadFallbackBlob(opts);
+  if (!fallback) return deposit;
+  return { ...deposit, ...fallback };
+}
+
+// src/api/scrape-blob-cleanup.ts
+import { readdir, stat, unlink } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { join as join7 } from "path";
+async function cleanupVercel(token, cutoff) {
+  const { list, del } = await import("@vercel/blob");
+  let cursor;
+  let deleted = 0;
+  do {
+    const res = await list({ prefix: SCRAPE_FALLBACK_PREFIX, cursor, token });
+    const expired = res.blobs.filter((b) => new Date(b.uploadedAt).getTime() < cutoff);
+    if (expired.length) {
+      await del(expired.map((b) => b.url), { token });
+      deleted += expired.length;
+    }
+    cursor = res.hasMore ? res.cursor : void 0;
+  } while (cursor);
+  return { deleted, store: "vercel-blob" };
+}
+async function cleanupLocal(cutoff) {
+  const baseDir = process.env.MCP_SCRAPER_OUTPUT_DIR?.trim() || join7(homedir4(), "Downloads", "mcp-scraper");
+  const dir = join7(baseDir, "blobs", SCRAPE_FALLBACK_PREFIX.replace(/\/$/, ""));
+  let deleted = 0;
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch {
+    return { deleted: 0, store: "local" };
+  }
+  for (const name of entries) {
+    const path5 = join7(dir, name);
+    try {
+      const s = await stat(path5);
+      if (s.isFile() && s.mtimeMs < cutoff) {
+        await unlink(path5);
+        deleted++;
+      }
+    } catch {
+    }
+  }
+  return { deleted, store: "local" };
+}
+async function cleanupExpiredScrapeBlobs(maxAgeMs = SCRAPE_BLOB_TTL_MS) {
+  const cutoff = Date.now() - maxAgeMs;
+  try {
+    const token = process.env.BLOB_READ_WRITE_TOKEN;
+    return token ? await cleanupVercel(token, cutoff) : await cleanupLocal(cutoff);
+  } catch {
+    return { deleted: 0, store: "none" };
+  }
+}
+
 // src/api/credit-operations.ts
-async function grantSignupCredit(_userId) {
-  return;
+async function grantSignupCredit(userId) {
+  if (!FREE_SIGNUP_MC || FREE_SIGNUP_MC <= 0) return;
+  const already = await ledgerExistsForOperation(userId, LedgerOperation.SIGNUP_GRANT);
+  if (already) return;
+  await creditMc(userId, FREE_SIGNUP_MC, LedgerOperation.SIGNUP_GRANT, "Welcome credits");
 }
 async function applyMonthlyFreeRefresh(user) {
   return user;
@@ -16598,46 +17506,168 @@ async function getFreeCreditBreakdown(userId) {
   };
 }
 
-// src/api/session.ts
-import { createHmac as createHmac2, timingSafeEqual } from "crypto";
-var isProduction = () => process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
-function getSessionSecret() {
-  const configured = process.env.SESSION_SECRET?.trim();
-  if (configured) return configured;
-  if (isProduction()) throw new Error("SESSION_SECRET is not set \u2014 add it to your Vercel env vars (see src/api/env.ts)");
-  return "dev-secret-change-me";
+// src/api/memory-db.ts
+import { neon } from "@neondatabase/serverless";
+var _sql = null;
+function sql() {
+  if (_sql) return _sql;
+  const url = process.env.MEMORY_DATABASE_URL?.trim();
+  if (!url) throw new Error("MEMORY_DATABASE_URL is not set (paa-crawler needs mcp-memory Neon URL for reads)");
+  _sql = neon(url);
+  return _sql;
+}
+function physicalVault(owner, vault) {
+  return `${owner} ${vault}`;
+}
+function isUnlimited(plan) {
+  return plan === "unlimited";
+}
+function quotaBytesForPlan(plan) {
+  return MEMORY_PLAN_QUOTA[plan] ?? MEMORY_PLAN_QUOTA.free;
+}
+function toGb(bytes) {
+  return Math.round(bytes / 1e9 * 100) / 100;
+}
+async function entitledVaultRows(identity) {
+  const rows = await sql().query(
+    `SELECT vault, owner_identity FROM mem_vault_registry WHERE grantee = $1 ORDER BY created_at ASC`,
+    [identity]
+  );
+  const seen = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    if (seen.has(r.vault)) continue;
+    seen.set(r.vault, { vault: r.vault, owner: r.owner_identity, physical: physicalVault(r.owner_identity, r.vault) });
+  }
+  return [...seen.values()];
+}
+async function storageByPhysical(physicals) {
+  if (physicals.length === 0) return /* @__PURE__ */ new Map();
+  const rows = await sql().query(
+    `SELECT vault, COUNT(*)::int AS notes, COALESCE(SUM(octet_length(content)), 0)::bigint AS bytes
+     FROM mem_notes WHERE vault = ANY($1) GROUP BY vault`,
+    [physicals]
+  );
+  const m = /* @__PURE__ */ new Map();
+  for (const r of rows) m.set(r.vault, { notes: Number(r.notes), bytes: Number(r.bytes) });
+  return m;
+}
+async function dbListVaults(identity) {
+  const ents = await entitledVaultRows(identity);
+  const storage = await storageByPhysical(ents.map((e) => e.physical));
+  return ents.map((e) => {
+    const st = storage.get(e.physical);
+    const isOwner = e.owner === identity;
+    return {
+      vault: e.vault,
+      role: isOwner ? "owner" : "shared",
+      ...isOwner ? {} : { sharedBy: e.owner },
+      notes: st?.notes ?? 0,
+      bytes: st?.bytes ?? 0
+    };
+  });
 }
-var secret = () => getSessionSecret();
-function safeEqualHex(a, b) {
-  if (a.length !== b.length) return false;
-  try {
-    return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
-  } catch {
-    return false;
-  }
+async function dbStorage(identity, plan) {
+  const ents = await entitledVaultRows(identity);
+  const storage = await storageByPhysical(ents.map((e) => e.physical));
+  let totalBytes = 0;
+  const perVault = ents.map((e) => {
+    const st = storage.get(e.physical);
+    const bytes = st?.bytes ?? 0;
+    totalBytes += bytes;
+    return { vault: e.vault, bytes, gb: toGb(bytes), notes: st?.notes ?? 0 };
+  });
+  const unlimited = isUnlimited(plan);
+  const quotaBytes = unlimited ? null : quotaBytesForPlan(plan);
+  return {
+    ok: true,
+    totalBytes,
+    totalGb: toGb(totalBytes),
+    quotaBytes,
+    quotaGb: quotaBytes == null ? null : toGb(quotaBytes),
+    unlimited,
+    perVault
+  };
 }
-function signSession(userId) {
-  const payload = String(userId);
-  const sig = createHmac2("sha256", secret()).update(payload).digest("hex");
-  return `${payload}.${sig}`;
+async function resolvePhysical(identity, vault) {
+  const rows = await sql().query(
+    `SELECT owner_identity FROM mem_vault_registry WHERE grantee = $1 AND vault = $2 LIMIT 1`,
+    [identity, vault]
+  );
+  if (!rows[0]) return null;
+  return physicalVault(rows[0].owner_identity, vault);
+}
+async function dbNotes(identity, vault) {
+  const physical = await resolvePhysical(identity, vault);
+  if (!physical) return [];
+  const rows = await sql().query(
+    `SELECT path, title, kind, source, updated_at, octet_length(content) AS bytes, props
+     FROM mem_notes WHERE vault = $1 ORDER BY updated_at DESC`,
+    [physical]
+  );
+  return rows.map((r) => ({
+    path: r.path,
+    title: r.title,
+    kind: r.kind,
+    source: r.source,
+    updatedAt: r.updated_at,
+    bytes: Number(r.bytes),
+    props: r.props && typeof r.props === "object" ? r.props : {}
+  }));
 }
-function verifySession(token) {
-  const dot = token.lastIndexOf(".");
-  if (dot === -1) return null;
-  const payload = token.slice(0, dot);
-  const sig = token.slice(dot + 1);
-  const expected = createHmac2("sha256", secret()).update(payload).digest("hex");
-  if (!safeEqualHex(sig, expected)) return null;
-  const id = parseInt(payload);
-  return isNaN(id) ? null : id;
+async function dbNote(identity, vault, path5) {
+  const physical = await resolvePhysical(identity, vault);
+  if (!physical) return null;
+  const rows = await sql().query(
+    `SELECT path, title, content, kind, source, updated_at, captured_at
+     FROM mem_notes WHERE vault = $1 AND path = $2 LIMIT 1`,
+    [physical, path5]
+  );
+  const r = rows[0];
+  if (!r) return null;
+  return {
+    path: r.path,
+    title: r.title,
+    content: r.content,
+    kind: r.kind,
+    source: r.source,
+    updatedAt: r.updated_at,
+    capturedAt: r.captured_at
+  };
+}
+var FREE_COST_CAP_USD = 1;
+async function dbUsage(identity, plan) {
+  const now = /* @__PURE__ */ new Date();
+  const period = `${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
+  const rows = await sql().query(
+    `SELECT source, COALESCE(SUM(cost_usd), 0)::float8 AS total
+     FROM mem_usage_ledger WHERE identity = $1 AND period = $2 GROUP BY source`,
+    [identity, period]
+  );
+  const bySource = {};
+  let costUsd = 0;
+  for (const r of rows) {
+    const v = Number(r.total);
+    bySource[r.source] = v;
+    costUsd += v;
+  }
+  return {
+    ok: true,
+    period,
+    plan,
+    costUsd,
+    bySource,
+    freeCapUsd: FREE_COST_CAP_USD,
+    freeCapReached: plan === "free" && costUsd >= FREE_COST_CAP_USD,
+    unlimited: isUnlimited(plan)
+  };
 }
 
 // src/api/server.ts
-var secureCookies = process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
-var isProduction2 = secureCookies;
-var sessionCookieOptions = {
+var secureCookies2 = process.env.NODE_ENV === "production" || process.env.VERCEL === "1";
+var isProduction2 = secureCookies2;
+var sessionCookieOptions2 = {
   httpOnly: true,
-  secure: secureCookies,
+  secure: secureCookies2,
   path: "/",
   maxAge: 60 * 60 * 24 * 30,
   sameSite: "Strict"
@@ -16698,7 +17728,7 @@ var adminAuth = createMiddleware3(async (c, next) => {
   return next();
 });
 var sessionAuth = createMiddleware3(async (c, next) => {
-  const token = getCookie(c, "session");
+  const token = getCookie2(c, "session");
   if (!token) return c.json({ error: "Not authenticated" }, 401);
   const userId = verifySession(token);
   if (!userId) return c.json({ error: "Session expired" }, 401);
@@ -16709,7 +17739,7 @@ var sessionAuth = createMiddleware3(async (c, next) => {
   c.set("sessionUser", { ...refreshed, balance_mc: balanceMc });
   return next();
 });
-var app = new Hono13();
+var app = new Hono15();
 var STRIPE_API_VERSION = "2026-02-25.clover";
 function requireStripeSecret() {
   const secret2 = process.env.STRIPE_SECRET_KEY?.trim();
@@ -16737,6 +17767,33 @@ app.use("*", async (c, next) => {
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "same-origin");
 });
+function opForCostPath(p) {
+  if (p === "/harvest" || p === "/harvest/sync") return "harvest";
+  if (p === "/extract-url") return "page_scrape";
+  if (p === "/extract-site") return "extract_site";
+  if (p === "/map-urls") return "url_map";
+  if (p === "/youtube/harvest") return "yt_channel";
+  if (p === "/youtube/transcribe") return "yt_transcription";
+  if (p === "/maps/search") return "maps_search";
+  if (p === "/maps/place") return "maps_place";
+  if (p.startsWith("/facebook/")) {
+    if (p.endsWith("transcribe")) return "fb_transcribe";
+    if (p.endsWith("/search")) return "fb_search";
+    return "fb_ad";
+  }
+  if (p.startsWith("/instagram/")) return "instagram";
+  if (p.startsWith("/api/internal/site-architecture-auditor")) return "audit_site";
+  if (p.startsWith("/agent/")) return "browser_session";
+  return null;
+}
+app.use("*", (c, next) => {
+  const op = opForCostPath(new URL(c.req.url).pathname);
+  if (!op) return next();
+  const probeRunId = c.req.header("x-cost-probe-id") ?? null;
+  const forceHeadless = c.req.header("x-kernel-headless") === "true";
+  return runWithCostContext({ op, probeRunId, forceHeadless }, () => next());
+});
+void migrateCostTelemetry();
 app.post("/auth/register", requireAllowedOrigin, async (c) => {
   const { email, password } = await c.req.json();
   const normalizedEmail = email?.trim().toLowerCase();
@@ -16768,8 +17825,16 @@ app.post("/auth/register", requireAllowedOrigin, async (c) => {
     }
     const newKey = await rotateApiKey(user.id);
     await grantSignupCredit(user.id);
+    void (async () => {
+      try {
+        const full = await getUserById(user.id);
+        if (full) await provisionMemoryForUser(full);
+      } catch (err) {
+        console.warn("[auth/register] memory provision failed (will retry on first write):", err instanceof Error ? err.message : String(err));
+      }
+    })();
     const token = signSession(user.id);
-    setCookie(c, "session", token, sessionCookieOptions);
+    setCookie2(c, "session", token, sessionCookieOptions2);
     return c.json({ email: user.email, api_key: newKey }, 201);
   } catch (err) {
     const msg = err instanceof Error ? err.message : "";
@@ -16788,11 +17853,11 @@ app.post("/auth/login", requireAllowedOrigin, async (c) => {
     return c.json({ error: "Invalid email or password" }, 401);
   }
   const token = signSession(user.id);
-  setCookie(c, "session", token, sessionCookieOptions);
+  setCookie2(c, "session", token, sessionCookieOptions2);
   return c.json({ email: user.email, api_key: user.key_active ? user.api_key : null });
 });
 app.post("/auth/logout", requireAllowedOrigin, (c) => {
-  deleteCookie(c, "session", { path: "/", secure: secureCookies, sameSite: "Strict" });
+  deleteCookie(c, "session", { path: "/", secure: secureCookies2, sameSite: "Strict" });
   return c.json({ ok: true });
 });
 app.post("/auth/forgot-password", requireAllowedOrigin, async (c) => {
@@ -16846,16 +17911,16 @@ app.get("/catalog", (c) => {
   return c.json(CATALOG);
 });
 app.get("/me", async (c) => {
-  const token = getCookie(c, "session");
+  const token = getCookie2(c, "session");
   if (!token) return c.json({ authenticated: false });
   const userId = verifySession(token);
   if (!userId) {
-    deleteCookie(c, "session", { path: "/", secure: secureCookies, sameSite: "Strict" });
+    deleteCookie(c, "session", { path: "/", secure: secureCookies2, sameSite: "Strict" });
     return c.json({ authenticated: false });
   }
   const foundUser = await getUserById(userId);
   if (!foundUser) {
-    deleteCookie(c, "session", { path: "/", secure: secureCookies, sameSite: "Strict" });
+    deleteCookie(c, "session", { path: "/", secure: secureCookies2, sameSite: "Strict" });
     return c.json({ authenticated: false });
   }
   const refreshed = await applyMonthlyFreeRefresh(foundUser);
@@ -16874,6 +17939,8 @@ app.get("/me", async (c) => {
     has_concurrency_sub: !!user.concurrency_stripe_sub_id,
     subscription_tier: user.subscription_tier,
     subscription_concurrency: user.subscription_concurrency,
+    memory_plan: user.memory_plan ?? "free",
+    has_memory_sub: !!user.memory_subscription_id,
     ...stats
   });
 });
@@ -16887,6 +17954,227 @@ app.delete("/api-key", requireAllowedOrigin, sessionAuth, async (c) => {
   await revokeApiKey(user.id);
   return c.json({ ok: true });
 });
+function maybeProvisionInBackground(user, vaultCount) {
+  if (vaultCount > 0 || user.memory_provisioned === 1) return;
+  void (async () => {
+    try {
+      if (await getMemoryProvisioned(user.id)) return;
+      await provisionMemoryForUser(user);
+    } catch (err) {
+      console.warn("[memory] background provision failed:", err instanceof Error ? err.message : String(err));
+    }
+  })();
+}
+app.get("/memory/overview", auth2, async (c) => {
+  const user = c.get("user");
+  const identity = resolveMemoryIdentity(user);
+  const plan = memoryPlanForReads(user);
+  const requestedVault = c.req.query("vault")?.trim() || null;
+  try {
+    const [vaults, storage, usage] = await Promise.all([
+      dbListVaults(identity),
+      dbStorage(identity, plan),
+      dbUsage(identity, plan)
+    ]);
+    maybeProvisionInBackground(user, vaults.length);
+    const activeVault = requestedVault && vaults.some((v) => v.vault === requestedVault) ? requestedVault : vaults[0]?.vault ?? null;
+    const notes = activeVault ? await dbNotes(identity, activeVault) : [];
+    const billing = {
+      ok: true,
+      memory_plan: user.memory_plan ?? "free",
+      has_memory_sub: !!user.memory_subscription_id,
+      free_quota_gb: MEMORY_PLAN_QUOTA.free / 1e9,
+      plans: Object.values(MEMORY_PLANS).map((p) => ({ plan: p.plan, label: p.label, price_id: p.price_id, interval: p.interval, monthly_usd: p.monthly_usd, quota_gb: p.quota_bytes / 1e9 }))
+    };
+    return c.json({ ok: true, vaults, storage, activeVault, notes, usage, billing });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "memory overview failed";
+    console.error("[memory/overview]", message);
+    return c.json({ ok: false, error: message }, 502);
+  }
+});
+app.get("/memory/vaults", auth2, async (c) => {
+  const user = c.get("user");
+  try {
+    const vaults = await dbListVaults(resolveMemoryIdentity(user));
+    maybeProvisionInBackground(user, vaults.length);
+    return c.json({ ok: true, vaults });
+  } catch (err) {
+    return c.json({ ok: false, error: err instanceof Error ? err.message : "could not load vaults" }, 502);
+  }
+});
+app.get("/memory/connect", auth2, async (c) => {
+  const { key, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  if (!key) return c.json({ error: error ?? "memory unavailable" }, 502);
+  const command = `MCP_MEMORY_KEY=${key} npx -y -p @vilovieta/mcp-memory@latest mcp-memory`;
+  const config = {
+    mcpServers: {
+      "mcp-memory": {
+        command: "npx",
+        args: ["-y", "-p", "@vilovieta/mcp-memory@latest", "mcp-memory"],
+        env: { MCP_MEMORY_KEY: key }
+      }
+    }
+  };
+  return c.json({ ok: true, command, config });
+});
+app.post("/memory/vault", auth2, async (c) => {
+  const { key, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  if (!key) return c.json({ error: error ?? "memory unavailable" }, 502);
+  const body = await c.req.json().catch(() => ({}));
+  const vault = body.vault?.trim();
+  if (!vault) return c.json({ error: "vault name required" }, 400);
+  const result = await memoryCall("addVaultTool", { vault }, key);
+  return c.json(result, result.ok ? 200 : 502);
+});
+app.get("/memory/notes", auth2, async (c) => {
+  const user = c.get("user");
+  const identity = resolveMemoryIdentity(user);
+  try {
+    let vault = c.req.query("vault")?.trim() || null;
+    if (!vault) {
+      const vaults = await dbListVaults(identity);
+      vault = vaults[0]?.vault ?? null;
+    }
+    if (!vault) return c.json({ ok: true, notes: [], vault: null });
+    const notes = await dbNotes(identity, vault);
+    return c.json({ ok: true, vault, notes });
+  } catch (err) {
+    return c.json({ ok: false, error: err instanceof Error ? err.message : "could not load notes" }, 502);
+  }
+});
+app.get("/memory/note", auth2, async (c) => {
+  const user = c.get("user");
+  const vault = c.req.query("vault")?.trim();
+  const path5 = c.req.query("path");
+  if (!path5) return c.json({ error: "path required" }, 400);
+  if (!vault) return c.json({ ok: false, error: "vault required" }, 400);
+  try {
+    const note = await dbNote(resolveMemoryIdentity(user), vault, path5);
+    if (!note) return c.json({ ok: false, error: "note not found" }, 404);
+    return c.json({ ok: true, note });
+  } catch (err) {
+    return c.json({ ok: false, error: err instanceof Error ? err.message : "could not load note" }, 502);
+  }
+});
+app.put("/memory/note", auth2, async (c) => {
+  const { key, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  if (!key) return c.json({ error: error ?? "memory unavailable" }, 502);
+  const body = await c.req.json().catch(() => ({}));
+  if (!body.path) return c.json({ error: "path required" }, 400);
+  const result = await memoryCall("putTool", { vault: body.vault, path: body.path, title: body.title, content: body.content }, key);
+  return c.json(result, result.ok ? 200 : 502);
+});
+app.delete("/memory/note", auth2, async (c) => {
+  const { key, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  if (!key) return c.json({ error: error ?? "memory unavailable" }, 502);
+  const vault = c.req.query("vault");
+  const path5 = c.req.query("path");
+  if (!path5) return c.json({ error: "path required" }, 400);
+  const result = await memoryCall("deleteNoteTool", { vault, path: path5 }, key);
+  return c.json(result, result.ok ? 200 : 502);
+});
+app.get("/memory/note/download", auth2, async (c) => {
+  const user = c.get("user");
+  const vault = c.req.query("vault")?.trim();
+  const path5 = c.req.query("path");
+  if (!path5) return c.json({ error: "path required" }, 400);
+  if (!vault) return c.json({ error: "vault required" }, 400);
+  const note = await dbNote(resolveMemoryIdentity(user), vault, path5);
+  if (!note) return c.json({ error: "note not found" }, 404);
+  const filename = (path5.split("/").pop() || "note").replace(/"/g, "");
+  return new Response(note.content ?? "", {
+    status: 200,
+    headers: {
+      "Content-Type": "text/markdown; charset=utf-8",
+      "Content-Disposition": `attachment; filename="${filename.endsWith(".md") ? filename : filename + ".md"}"`
+    }
+  });
+});
+app.get("/memory/storage", auth2, async (c) => {
+  const user = c.get("user");
+  try {
+    const result = await dbStorage(resolveMemoryIdentity(user), memoryPlanForReads(user));
+    return c.json(result);
+  } catch (err) {
+    return c.json({ ok: false, error: err instanceof Error ? err.message : "could not load storage" }, 502);
+  }
+});
+app.get("/memory/billing", auth2, async (c) => {
+  const user = c.get("user");
+  const plans = Object.values(MEMORY_PLANS).map((p) => ({ plan: p.plan, label: p.label, price_id: p.price_id, interval: p.interval, monthly_usd: p.monthly_usd, quota_gb: p.quota_bytes / 1e9 }));
+  return c.json({
+    ok: true,
+    memory_plan: user.memory_plan ?? "free",
+    has_memory_sub: !!user.memory_subscription_id,
+    free_quota_gb: MEMORY_PLAN_QUOTA.free / 1e9,
+    plans
+  });
+});
+app.post("/memory/checkout", auth2, async (c) => {
+  try {
+    const user = c.get("user");
+    const body = await c.req.json().catch(() => ({}));
+    const priceId = body.priceId?.trim();
+    if (!priceId || !MEMORY_PLANS[priceId]) return c.json({ error: "Invalid priceId \u2014 must be a memory plan price." }, 400);
+    const secret2 = process.env.STRIPE_SECRET_KEY?.trim();
+    if (!secret2) return c.json({ error: "Stripe is not configured." }, 503);
+    const stripeClient = new Stripe2(secret2, { apiVersion: STRIPE_API_VERSION });
+    let customerId = user.stripe_customer_id;
+    if (!customerId) {
+      const customer = await stripeClient.customers.create({ email: user.email });
+      customerId = customer.id;
+      await setStripeCustomerId(user.id, customerId);
+    }
+    const session = await stripeClient.checkout.sessions.create({
+      mode: "subscription",
+      customer: customerId,
+      line_items: [{ price: priceId, quantity: 1 }],
+      client_reference_id: String(user.id),
+      metadata: { product: "mcp-memory", userId: String(user.id) },
+      subscription_data: { metadata: { product: "mcp-memory", userId: String(user.id) } },
+      automatic_tax: { enabled: true },
+      billing_address_collection: "required",
+      customer_update: { address: "auto", name: "auto" },
+      tax_id_collection: { enabled: true },
+      success_url: `${appOrigin()}/memory?billing=success`,
+      cancel_url: `${appOrigin()}/memory?billing=cancel`
+    });
+    if (!session.url) return c.json({ error: "Stripe did not return a checkout URL." }, 502);
+    return c.json({ url: session.url });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Unable to start memory checkout.";
+    console.error("[memory/checkout]", message);
+    return c.json({ error: message }, 500);
+  }
+});
+app.post("/memory/portal", auth2, async (c) => {
+  try {
+    const user = c.get("user");
+    if (!user.stripe_customer_id) return c.json({ error: "No billing account yet \u2014 subscribe first." }, 409);
+    const secret2 = process.env.STRIPE_SECRET_KEY?.trim();
+    if (!secret2) return c.json({ error: "Stripe is not configured." }, 503);
+    const stripeClient = new Stripe2(secret2, { apiVersion: STRIPE_API_VERSION });
+    const session = await stripeClient.billingPortal.sessions.create({
+      customer: user.stripe_customer_id,
+      return_url: `${appOrigin()}/memory`
+    });
+    return c.json({ url: session.url });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Unable to open billing portal.";
+    console.error("[memory/portal]", message);
+    return c.json({ error: message }, 500);
+  }
+});
+app.get("/memory/usage", auth2, async (c) => {
+  const user = c.get("user");
+  try {
+    const result = await dbUsage(resolveMemoryIdentity(user), memoryPlanForReads(user));
+    return c.json(result);
+  } catch (err) {
+    return c.json({ ok: false, error: err instanceof Error ? err.message : "could not load usage" }, 502);
+  }
+});
 var SYNC_HARVEST_TIMEOUT_OVERRIDE_MS = (() => {
   const raw = process.env.SYNC_HARVEST_TIMEOUT_MS;
   const parsed = raw === void 0 ? NaN : Number(raw);
@@ -17013,6 +18301,7 @@ app.post("/harvest/sync", auth2, async (c) => {
       format: "json",
       outputDir: "/tmp/paa-output-api",
       signal: syncSignal,
+      softDeadlineMs: Date.now() + Math.floor(syncTimeoutMs * 0.8),
       onAttemptEvent: recordAttempt
     });
     await completeJob(jobId, result);
@@ -17165,8 +18454,14 @@ app.post("/extract-url", auth2, async (c) => {
       screenshotMeta = { base64: screenshotBuf.toString("base64"), sizeBytes: screenshotBuf.length, device };
     }
     const mediaMeta = downloadMedia ? await harvestPageMedia(result.bodyHtml, canonicalUrl, { types: mediaTypes ?? ["image", "video", "audio"], outputDir: null }) : null;
+    const memory = bodyResult.data.depositToVault ? await persistScrapeBody(user, {
+      title: result.title ?? canonicalUrl,
+      content: result.bodyMarkdown ?? "",
+      source: canonicalUrl,
+      vault: bodyResult.data.vaultName
+    }) : void 0;
     await logRequestEvent({ userId: user.id, source: "extract_url", status: "done", query: canonicalUrl, resultCount: result.headings.length, result });
-    return c.json({ ...result, screenshot: screenshotMeta, branding: brandingData, media: mediaMeta });
+    return c.json({ ...result, screenshot: screenshotMeta, branding: brandingData, media: mediaMeta, memory });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (debited) await creditMc(user.id, MC_COSTS.page_scrape, LedgerOperation.EXTRACT_URL, "failed call");
@@ -17584,16 +18879,17 @@ app.get("/cron/tick", async (c) => {
   if (!process.env.CRON_SECRET || secret2 !== `Bearer ${process.env.CRON_SECRET}`) {
     return c.json({ error: "Unauthorized" }, 401);
   }
-  const { drainQueue } = await import("./worker-UM5UM6O5.js");
+  const { drainQueue } = await import("./worker-UC6D2756.js");
   const budget = { maxJobs: 10, deadlineMs: Date.now() + 28e4 };
   const workflowDispatchResult = await dispatchDueWorkflowSchedules(`${new URL(c.req.url).protocol}//${new URL(c.req.url).host}`);
-  const [results, sweepResult, reapResult, expiredResult] = await Promise.all([
+  const [results, sweepResult, reapResult, expiredResult, blobCleanup] = await Promise.all([
     drainQueue(budget),
     runMonthlyRefreshSweep(),
     reapIdleBrowserSessions(120).catch(() => ({ reaped: 0 })),
-    expireOldLots().catch(() => ({ expired_lots: 0, expired_mc: 0 }))
+    expireOldLots().catch(() => ({ expired_lots: 0, expired_mc: 0 })),
+    cleanupExpiredScrapeBlobs().catch(() => ({ deleted: 0, store: "none" }))
   ]);
-  return c.json({ drained: results.length, results, sweepResult, reaped: reapResult, expired: expiredResult, workflowDispatch: workflowDispatchResult });
+  return c.json({ drained: results.length, results, sweepResult, reaped: reapResult, expired: expiredResult, blobCleanup, workflowDispatch: workflowDispatchResult });
 });
 app.on(["GET", "POST", "PUT"], "/api/inngest", serveInngest({ client: inngest, functions: [siteAuditFn, siteExtractFn] }));
 app.route("/api/internal/site-architecture-auditor", siteAuditApp);
@@ -17601,6 +18897,7 @@ app.route("/youtube", youtubeApp);
 app.route("/screenshot", screenshotApp);
 app.route("/facebook", facebookAdApp);
 app.route("/instagram", instagramApp);
+app.route("/reddit", redditApp);
 app.route("/maps", mapsApp);
 app.route("/directory", directoryApp);
 app.route("/workflows", workflowApp);
@@ -17623,6 +18920,7 @@ app.get("/console/auth/:id/go", async (c) => {
 });
 app.get("/console/:id", (c) => c.html(renderConsoleHtml(c.req.param("id"))));
 app.route("/stripe", stripeApp);
+app.route("/", oauthApp);
 if (!process.env.INNGEST_EVENT_KEY) {
   startSiteAuditWorker();
 }
@@ -17729,4 +19027,4 @@ app.get("/blog/:slug/", (c) => {
 export {
   app
 };
-//# sourceMappingURL=server-2SRARAO5.js.map
+//# sourceMappingURL=server-RRCKVBHG.js.map