mcp-scraper 0.3.25 → 0.3.27

package/dist/bin/api-server.cjs

@@ -4805,10 +4805,10 @@ async function completeWorkflowRunRecord(id, status, manifest) {
     args: [status, JSON.stringify(manifest), id]
   });
 }
-async function failWorkflowRunRecord(id, errorMessage4, manifest) {
+async function failWorkflowRunRecord(id, errorMessage5, manifest) {
   await getDb().execute({
     sql: `UPDATE workflow_runs SET status = 'failed', error_message = ?, manifest_json = ?, completed_at = datetime('now') WHERE id = ?`,
-    args: [errorMessage4, manifest == null ? null : JSON.stringify(manifest), id]
+    args: [errorMessage5, manifest == null ? null : JSON.stringify(manifest), id]
   });
 }
 function workflowArtifactContentType(kind) {
@@ -10047,22 +10047,23 @@ var init_rates = __esm({
     "use strict";
     MC_COSTS = {
       serp: 100,
-      paa: 300,
+      paa: 200,
+      paa_base: 1e3,
       page_scrape: 100,
-      url_map: 2e3,
+      url_map: 500,
       yt_channel: 200,
       yt_transcription: 200,
       fb_ad: 200,
-      maps_search: 2e3,
-      maps_place: 2e3,
+      maps_search: 500,
+      maps_place: 3e3,
       maps_review: 100,
-      fb_search: 100,
+      fb_search: 600,
       fb_transcribe: 200,
-      instagram_profile: 200,
-      instagram_media: 200,
+      instagram_profile: 400,
+      instagram_media: 400,
       instagram_transcribe: 50,
       browser_minute: 12e3,
-      reddit_thread: 300
+      reddit_thread: 2e3
     };
     MC_PER_BROWSER_MS = MC_COSTS.browser_minute / 6e4;
     BROWSER_OPEN_MIN_BALANCE_MC = 1e3;
@@ -10081,8 +10082,8 @@ var init_rates = __esm({
         label: "PAA harvest",
         aliases: ["harvest_paa", "paa", "people also ask", "questions"],
         credits: mcToCredits(MC_COSTS.paa),
-        unit: "per extracted question",
-        notes: "Includes full SERP feature extraction. Billed on actual questions returned \u2014 no cap enforced."
+        unit: `per question (+${mcToCredits(MC_COSTS.paa_base)} credit base)`,
+        notes: `Full SERP feature extraction. Billed ${mcToCredits(MC_COSTS.paa_base)} credit base + ${mcToCredits(MC_COSTS.paa)} per question actually returned (unused estimate refunded).`
       },
       {
         key: "page_scrape",
@@ -10872,16 +10873,6 @@ var init_catalog_seed = __esm({
               isSpecial: true,
               tagline: "Generate a rank-tracker blueprint",
               params: [{ key: "domain", label: "Domain", type: "string", required: true }]
-            },
-            {
-              key: "deep_research_workflow",
-              label: "Deep Research",
-              kind: "simple",
-              endpoint: "/workflows/run",
-              mcpName: "workflow_run",
-              isSpecial: true,
-              tagline: "Multi-source, fact-checked research report",
-              params: [{ key: "question", label: "Question", type: "string", required: true }]
             }
           ]
         }
@@ -17315,9 +17306,18 @@ function parseData(raw) {
 function entityIdsSection(ids) {
   if (!ids) return "";
   const lines = [];
-  if (ids.kgIds?.length) lines.push(`- **Knowledge Graph MID:** ${ids.kgIds.join(", ")}`);
-  if (ids.cids?.length) lines.push(`- **CID:** ${ids.cids.join(", ")}`);
-  if (ids.gcids?.length) lines.push(`- **GCID:** ${ids.gcids.join(", ")}`);
+  if (ids.entities?.length) {
+    for (const e of ids.entities) {
+      const idParts = [e.kgId && `MID ${e.kgId}`, e.cid && `CID ${e.cid}`, e.gcid && `GCID ${e.gcid}`].filter(Boolean);
+      if (idParts.length) lines.push(`- **${e.name}** \u2014 ${idParts.join(", ")}`);
+    }
+  }
+  const linkedNames = new Set((ids.entities ?? []).map((e) => e.name));
+  if (!linkedNames.size) {
+    if (ids.kgIds?.length) lines.push(`- **Knowledge Graph MID:** ${ids.kgIds.join(", ")}`);
+    if (ids.cids?.length) lines.push(`- **CID:** ${ids.cids.join(", ")}`);
+    if (ids.gcids?.length) lines.push(`- **GCID:** ${ids.gcids.join(", ")}`);
+  }
   return lines.length ? `
 ## Entity IDs
 ${lines.join("\n")}` : "";
@@ -17439,7 +17439,7 @@ ${paaTable}${serpTable}${entityIdsSection(entityIds)}${aiSection}${statsLine}${d
         snippet: r.snippet ?? null
       })),
       aiOverview: aiOvw ? { detected: aiOvw.detected === true, text: aiOvw.text ?? null } : null,
-      entityIds: entityIds ? { kgIds: entityIds.kgIds ?? [], cids: entityIds.cids ?? [], gcids: entityIds.gcids ?? [] } : null,
+      entityIds: entityIds ? { entities: entityIds.entities ?? [], kgIds: entityIds.kgIds ?? [], cids: entityIds.cids ?? [], gcids: entityIds.gcids ?? [] } : null,
       durationMs: durationMs ?? null
     }
   };
@@ -17500,7 +17500,7 @@ ${serpTable}${localSection}${entityIdsSection(entityIds)}${aiSection}${debugSect
         websiteUrl: b.websiteUrl ?? null
       })),
       aiOverview: aiOvw ? { detected: aiOvw.detected === true, text: aiOvw.text ?? null } : null,
-      entityIds: entityIds ? { kgIds: entityIds.kgIds ?? [], cids: entityIds.cids ?? [], gcids: entityIds.gcids ?? [] } : null
+      entityIds: entityIds ? { entities: entityIds.entities ?? [], kgIds: entityIds.kgIds ?? [], cids: entityIds.cids ?? [], gcids: entityIds.gcids ?? [] } : null
     }
   };
 }
@@ -22926,7 +22926,7 @@ var init_PAAExtractor = __esm({
             return parts.join(" ").replace(/\s+/g, " ").trim();
           }
           return Array.from(document.querySelectorAll(selectors.item)).map((pair) => ({
-            question: pair.getAttribute(selectors.itemDataQ) || pair.getAttribute(selectors.itemDataInitQ) || "",
+            question: pair.getAttribute(selectors.itemDataQ) || pair.getAttribute(selectors.itemDataInitQ) || pair.querySelector(selectors.itemQuestionEl)?.innerText?.trim() || "",
             answer: cleanText(pair.querySelector(selectors.answerContainer)) || void 0,
             sourceTitle: pair.querySelector(selectors.sourceTitle)?.innerText?.trim() || void 0,
             sourceSite: pair.querySelector(selectors.sourceSite)?.innerText?.trim() || void 0,
@@ -24879,7 +24879,7 @@ var PACKAGE_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    PACKAGE_VERSION = "0.3.25";
+    PACKAGE_VERSION = "0.3.27";
   }
 });
 
@@ -24889,33 +24889,73 @@ var init_server_instructions = __esm({
   "src/mcp/server-instructions.ts"() {
     "use strict";
     SERVER_INSTRUCTIONS = `
-This server scrapes and analyzes web, social, search, maps, and site data. Pick a tool by NAME using
-this routing map, then load its schema before calling.
-
-ROUTING
-- One web page -> extract_url. Whole site (crawl + SEO report) -> extract_site. Just the URL list -> map_site_urls.
-- Web search (organic SERP) -> search_serp. Full SERP + People-Also-Ask / AI-Overview detail -> harvest_paa.
-- Google Maps: find places -> maps_search; one place deep-dive + reviews -> maps_place_intel.
-- YouTube: find or list videos -> youtube_harvest; transcribe one video -> youtube_transcribe.
-- Facebook: find ads -> facebook_ad_search; transcribe an ad -> facebook_ad_transcribe; transcribe a
-  video -> facebook_video_transcribe; page profile/intel -> facebook_page_intel.
-- Instagram: profile inventory -> instagram_profile_content; one post or reel -> instagram_media_download.
-- Workflows (multi-step): local directory build -> directory_workflow; rank blueprint -> rank_tracker_workflow;
-  AI-answer citation fan-out (AEO) -> query_fanout_workflow; deep research -> deep_research_workflow.
-- Anything without a dedicated tool (e.g. Reddit, arbitrary logged-in sites) -> the browser_* agent
-  (browser_open, then navigate/read).
-- Logged-in sites (ChatGPT, Claude, Reddit, any account): save the login first -> browser_profile_connect
-  (returns an mcpscraper.dev sign-in link for the user; one profile holds MANY logins, call it again with
-  the same profile + a new domain to add accounts) -> poll browser_profile_list until AUTHENTICATED ->
-  browser_open with that profile. browser_profile_list also shows what a profile is connected to.
-
-NOTES
-- Bulk / full-site crawls: call extract_site with rotateProxies:true for blocked or rate-limited sites.
-  It discovers URLs and returns a saved folder/artifact plus a summary, not the full content inline.
-- Tools that open a browser session or transcribe media cost credits and take longer. Prefer the
-  cheapest tool that answers the question (plain search/extract before browser agents).
-- Large results are saved to disk or an artifact and returned as a summary plus a path; read the path
-  for full detail rather than expecting the whole payload inline.
+# MCP Scraper
+
+Scrapes and analyzes web, search, maps, social, and site data. **Pick a tool by NAME from the map
+below, then load its schema before calling.** Where a tool needs a value another tool produces, the
+seam is noted so you can chain them.
+
+## Search & research
+- Organic Google results, rankings, local pack -> **search_serp**.
+- Full SERP plus People-Also-Ask and AI-Overview detail -> **harvest_paa**.
+- \`search_serp\` returns \`organicResults[].url\` (often including reddit.com threads) \u2014 feed those into
+  \`extract_url\` or \`reddit_thread\`.
+
+## Pages & sites
+- One page -> **extract_url** (takes a url).
+- Whole site, crawl + SEO report -> **extract_site** (takes a url).
+- Just the URL list/inventory -> **map_site_urls** (takes a url).
+- \`map_site_urls\` returns urls you can feed straight into \`extract_url\`.
+
+## Google Maps
+- Find multiple places/competitors/prospects -> **maps_search** (returns \`results[]\` with name,
+  placeUrl, cid).
+- One business deep-dive + reviews -> **maps_place_intel** (takes businessName + location, NOT an id \u2014
+  call it directly with a name from a \`maps_search\` result or from the user).
+
+## YouTube
+- Find or list videos -> **youtube_harvest** (returns \`videos[].videoId\`).
+- Transcribe one video -> **youtube_transcribe** (takes a videoId from \`youtube_harvest\`, or a url).
+
+## Facebook
+- Find advertisers -> **facebook_ad_search** (returns \`advertisers[]\` with pageId, libraryId).
+- One advertiser's ads -> **facebook_page_intel** (takes pageId, libraryId, or query; returns
+  \`ads[].videoUrl\`).
+- Transcribe an ad video -> **facebook_ad_transcribe** (takes a videoUrl from \`facebook_page_intel\`).
+- Transcribe an organic reel/video/post -> **facebook_video_transcribe** (takes the Facebook url directly).
+
+## Instagram
+- Profile inventory -> **instagram_profile_content** (returns post/reel/tv urls).
+- One post or reel -> **instagram_media_download** (takes a url from \`instagram_profile_content\`, or a
+  url the user gives).
+
+## Reddit
+- A reddit.com thread/post URL -> **reddit_thread**. Returns the post plus its comment tree and handles
+  Reddit's bot wall itself (no login needed). Find threads first with \`search_serp\`.
+
+## Other sites & logins (browser agent)
+For an arbitrary site or a logged-in dashboard with no dedicated tool, use the browser_* agent. **First
+decide whether the site needs a login:**
+- **Needs a login** (ChatGPT, Claude, any account) -> save it first: **browser_profile_connect** returns
+  an mcpscraper.dev sign-in link for the user; one profile holds MANY logins (call it again with the same
+  profile + a new domain to add accounts). Poll **browser_profile_list** until AUTHENTICATED, then
+  **browser_open** with that profile.
+- **No login** -> **browser_open**, then navigate/read.
+
+## Workflows
+Multi-step orchestrations \u2014 prefer these over hand-chaining primitives when the whole job is one of these:
+- Build a local business directory for a niche across a state/region -> **directory_workflow**.
+- Stand up a rank-tracking blueprint (database + cron + ingestion plan) -> **rank_tracker_workflow**.
+- Find which sources an AI answer cites for a query (AEO) -> **query_fanout_workflow** (open a browser
+  session on chatgpt.com or claude.ai FIRST, then run it against that session).
+
+## Notes
+- Bulk / full-site crawls: call \`extract_site\` with \`rotateProxies:true\` for blocked or rate-limited
+  sites. It returns a saved folder/artifact plus a summary, not the full content inline.
+- Browser sessions and media transcription cost credits and take longer \u2014 prefer the cheapest tool that
+  answers the question (plain search/extract before browser agents).
+- Large results are saved to disk or an artifact and returned as a summary plus a path; read the path for
+  full detail rather than expecting the whole payload inline.
 `.trim();
   }
 });
@@ -25212,6 +25252,12 @@ var init_mcp_tool_schemas = __esm({
       text: NullableString
     }).nullable();
     EntityIdsOutput = import_zod29.z.object({
+      entities: import_zod29.z.array(import_zod29.z.object({
+        name: import_zod29.z.string(),
+        kgId: import_zod29.z.string().nullable(),
+        cid: import_zod29.z.string().nullable(),
+        gcid: import_zod29.z.string().nullable()
+      })).describe("Each entity actually named on the page, with whichever of its kgId/cid/gcid were found \u2014 the linked view. kgIds/cids/gcids below are the same IDs as flat deduplicated lists, without the name link, kept for backward compatibility."),
       kgIds: import_zod29.z.array(import_zod29.z.string()),
       cids: import_zod29.z.array(import_zod29.z.string()),
       gcids: import_zod29.z.array(import_zod29.z.string())
@@ -25983,7 +26029,7 @@ function buildPrompt(input, modes, tools, tables, jobs, metrics, expression, tar
     "- Every scheduled batch must insert or update rank_tracker_runs before calling MCP tools.",
     "- Use idempotency_key = project_id + keyword_id + location_id + mode + device + scheduled_date.",
     "- Mark runs as running, succeeded, failed, or skipped; persist error_message on failures.",
-    "- Run MCP calls sequentially by default because accounts have one concurrency slot unless the user bought more.",
+    "- Call credits_info first to read the account's real concurrency_limit (most paid accounts have 3, 10, or 20, not 1), then run up to that many MCP calls in parallel \u2014 never sequential-by-default and never more than the limit, or calls start failing with 429s.",
     "- Retry retryable upstream failures with backoff, but do not duplicate rows for the same idempotency key.",
     "",
     "Mode-specific ingestion rules:",
@@ -26615,93 +26661,1591 @@ var init_http_mcp_tool_executor = __esm({
   }
 });
 
-// src/mcp/mcp-oauth.ts
-function oauthIssuer() {
-  return (process.env.OAUTH_ISSUER ?? "https://mcpscraper.dev").replace(/\/$/, "");
+// src/services/fanout/export.ts
+function outputBaseDir3() {
+  return process.env.MCP_SCRAPER_OUTPUT_DIR?.trim() || (0, import_node_path12.join)((0, import_node_os7.homedir)(), "Downloads", "mcp-scraper");
 }
-function oauthResourceUrl() {
-  return (process.env.MCP_SCRAPER_RESOURCE_URL ?? "https://mcpscraper.dev/mcp").replace(/\/$/, "");
+function safe(value) {
+  return value.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80) || "capture";
 }
-function oauthResourceBaseUrl() {
-  return (process.env.OAUTH_RS_BASE_URL ?? "https://mcpscraper.dev").replace(/\/$/, "");
+function writeTable(path6, rows, delimiter) {
+  (0, import_node_fs9.writeFileSync)(path6, import_papaparse3.default.unparse(rows.length ? rows : [{}], { delimiter }));
 }
-function protectedResourceMetadata() {
-  return {
-    resource: oauthResourceUrl(),
-    authorization_servers: [oauthIssuer()],
-    scopes_supported: ["scraper.use"],
-    bearer_methods_supported: ["header"]
+function exportFanout(enriched) {
+  const stamp = safe(enriched.capturedAt.replace(/[:.]/g, "-"));
+  const outputDir = outputBaseDir3();
+  const relativeDir = (0, import_node_path12.join)("fanout", `${stamp}-${safe(enriched.platform)}`);
+  const dir = (0, import_node_path12.join)(outputDir, relativeDir);
+  (0, import_node_fs9.mkdirSync)(dir, { recursive: true });
+  const queryRows = enriched.queries.map((q, i) => ({ index: i + 1, query: q }));
+  const citationRows = enriched.aggregates.citationOrder.map((c) => {
+    const src = enriched.citedUrls.find((s) => s.url === c.url);
+    return { rank: c.rank, domain: c.domain, url: c.url, timesCited: c.timesCited, siteType: src?.siteType ?? "", title: src?.title ?? "" };
+  });
+  const sourceRows2 = enriched.browsedUrls.map((s) => ({ domain: s.domain, url: s.url, cited: s.cited, timesCited: s.timesCited, siteType: s.siteType, title: s.title, round: s.round ?? "" }));
+  const browsedOnlyRows = enriched.browsedOnly.map((s) => ({ domain: s.domain, url: s.url, cited: s.cited, timesCited: s.timesCited, siteType: s.siteType, title: s.title, round: s.round ?? "" }));
+  const snippetRows = enriched.snippets.map((s) => ({ domain: s.domain, url: s.url, title: s.title, text: s.text }));
+  const domainRows = enriched.aggregates.topSites.map((d) => ({ domain: d.domain, count: d.count, cited: d.cited, timesCited: d.timesCited, siteType: d.siteType }));
+  const relativePaths = {
+    relativeTo: "MCP_SCRAPER_OUTPUT_DIR or ~/Downloads/mcp-scraper",
+    dir: relativeDir,
+    json: (0, import_node_path12.join)(relativeDir, "fanout.json"),
+    queriesCsv: (0, import_node_path12.join)(relativeDir, "queries.csv"),
+    queriesTsv: (0, import_node_path12.join)(relativeDir, "queries.tsv"),
+    citationsCsv: (0, import_node_path12.join)(relativeDir, "citations.csv"),
+    sourcesCsv: (0, import_node_path12.join)(relativeDir, "sources.csv"),
+    browsedOnlyCsv: (0, import_node_path12.join)(relativeDir, "browsed-only.csv"),
+    snippetsCsv: (0, import_node_path12.join)(relativeDir, "snippets.csv"),
+    domainsCsv: (0, import_node_path12.join)(relativeDir, "domains.csv"),
+    report: (0, import_node_path12.join)(relativeDir, "report.html")
   };
+  (0, import_node_fs9.writeFileSync)((0, import_node_path12.join)(outputDir, relativePaths.json), JSON.stringify(enriched, null, 2));
+  writeTable((0, import_node_path12.join)(outputDir, relativePaths.queriesCsv), queryRows, ",");
+  writeTable((0, import_node_path12.join)(outputDir, relativePaths.queriesTsv), queryRows, "	");
+  writeTable((0, import_node_path12.join)(outputDir, relativePaths.citationsCsv), citationRows, ",");
+  writeTable((0, import_node_path12.join)(outputDir, relativePaths.sourcesCsv), sourceRows2, ",");
+  writeTable((0, import_node_path12.join)(outputDir, relativePaths.browsedOnlyCsv), browsedOnlyRows, ",");
+  writeTable((0, import_node_path12.join)(outputDir, relativePaths.snippetsCsv), snippetRows, ",");
+  writeTable((0, import_node_path12.join)(outputDir, relativePaths.domainsCsv), domainRows, ",");
+  (0, import_node_fs9.writeFileSync)((0, import_node_path12.join)(outputDir, relativePaths.report), renderReportHtml(enriched));
+  return relativePaths;
 }
-function wwwAuthenticateValue() {
-  return `Bearer resource_metadata="${oauthResourceBaseUrl()}/.well-known/oauth-protected-resource"`;
-}
-function isBearerJwt(token) {
-  return !token.startsWith("sk_") && token.split(".").length === 3;
+function esc(s) {
+  return String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
-function getJwks() {
-  if (jwksSingleton) return jwksSingleton;
-  jwksSingleton = (0, import_jose.createRemoteJWKSet)(new URL(`${oauthIssuer()}/.well-known/jwks.json`));
-  return jwksSingleton;
+function renderReportHtml(enriched) {
+  const data = JSON.stringify(enriched).replace(/</g, "\\u003c");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>AI Search Fan-Out \u2014 ${esc(enriched.platform)}</title>
+<style>
+:root{--bg:#0b0d12;--panel:#151922;--line:#252b38;--ink:#e8ecf3;--mut:#8b95a7;--acc:#5b9dff;--cite:#39d98a;--browse:#5a6677}
+*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink);font:14px/1.5 -apple-system,BlinkMacSystemFont,Segoe UI,Roboto,sans-serif}
+.wrap{max-width:980px;margin:0 auto;padding:28px 20px 80px}
+h1{font-size:20px;margin:0 0 2px}.sub{color:var(--mut);margin:0 0 20px;font-size:13px}
+.stat{font-size:30px;font-weight:700}.stat small{font-size:13px;font-weight:400;color:var(--mut)}
+.cards{display:grid;grid-template-columns:repeat(4,1fr);gap:10px;margin:18px 0}
+.card{background:var(--panel);border:1px solid var(--line);border-radius:10px;padding:12px 14px}
+.card b{font-size:22px;display:block}.card span{color:var(--mut);font-size:12px}
+.bars{margin:8px 0 22px}.bar{display:flex;align-items:center;gap:8px;margin:4px 0}
+.bar .lab{width:150px;color:var(--mut);font-size:12px;text-align:right}.bar .track{flex:1;background:#10141c;border-radius:5px;overflow:hidden}
+.bar .fill{background:var(--acc);height:16px}.bar .n{width:34px;font-size:12px;color:var(--mut)}
+.tabs{display:flex;gap:8px;margin:22px 0 12px}.tab{background:var(--panel);border:1px solid var(--line);color:var(--ink);padding:7px 14px;border-radius:8px;cursor:pointer}
+.tab.on{background:var(--acc);border-color:var(--acc);color:#04101f;font-weight:600}
+.chips{display:flex;flex-wrap:wrap;gap:6px;margin-bottom:12px}
+.chip{background:var(--panel);border:1px solid var(--line);color:var(--mut);padding:4px 10px;border-radius:20px;cursor:pointer;font-size:12px}
+.chip.on{border-color:var(--acc);color:var(--ink)}.chip b{color:var(--ink)}
+.row{background:var(--panel);border:1px solid var(--line);border-radius:8px;padding:10px 12px;margin:6px 0;display:flex;gap:10px;align-items:flex-start}
+.row .idx{color:var(--mut);min-width:22px}.row .main{flex:1}
+.tag{font-size:11px;padding:2px 7px;border-radius:6px;border:1px solid var(--line);color:var(--mut);margin-right:5px}
+.dom{font-weight:600}.url{color:var(--mut);font-size:12px;word-break:break-all}
+.pill{font-size:11px;padding:2px 7px;border-radius:6px}.pill.cite{background:rgba(57,217,138,.15);color:var(--cite)}.pill.brow{background:rgba(90,102,119,.2);color:#aeb8c8}
+.copy{background:none;border:1px solid var(--line);color:var(--mut);border-radius:6px;cursor:pointer;font-size:11px;padding:2px 8px}
+.hide{display:none}
+</style>
+</head>
+<body><div class="wrap">
+<h1>AI Search Fan-Out</h1>
+<p class="sub" id="sub"></p>
+<div class="stat" id="stat"></div>
+<div class="cards" id="cards"></div>
+<div id="charts"></div>
+<div class="tabs"><button class="tab on" data-tab="q">Queries</button><button class="tab" data-tab="u">URLs</button></div>
+<div class="chips" id="chips"></div>
+<div id="list"></div>
+</div>
+<script>
+const D=${data};
+const el=(t,c,h)=>{const e=document.createElement(t);if(c)e.className=c;if(h!=null)e.innerHTML=h;return e};
+document.getElementById('sub').textContent=D.platform+' \xB7 '+(D.meta.model||'model n/a')+' \xB7 '+D.meta.rounds+' search round(s) \xB7 prompt: '+(D.prompt||'');
+document.getElementById('stat').innerHTML='Total Fan-Out: '+D.counts.subQueries+' <small>sub-queries \xB7 '+D.counts.browsed+' URLs researched \xB7 '+D.counts.cited+' cited</small>';
+const cards=[['Sub-queries',D.counts.subQueries],['Researched',D.counts.browsed],['Cited',D.counts.cited],['Browsed-only',D.counts.browsedOnly]];
+const cc=document.getElementById('cards');cards.forEach(([k,v])=>{const c=el('div','card');c.appendChild(el('b',null,v));c.appendChild(el('span',null,k));cc.appendChild(c)});
+function barChart(title,obj){const max=Math.max(1,...Object.values(obj));const box=el('div','bars');box.appendChild(el('div',null,'<b>'+title+'</b>'));Object.entries(obj).forEach(([k,v])=>{const r=el('div','bar');r.appendChild(el('div','lab',k));const t=el('div','track');const f=el('div','fill');f.style.width=(v/max*100)+'%';t.appendChild(f);r.appendChild(t);r.appendChild(el('div','n',v));box.appendChild(r)});return box}
+const charts=document.getElementById('charts');
+charts.appendChild(barChart('URL Categories',D.aggregates.byCategory));
+let tab='q',filter=null;
+const chips=document.getElementById('chips'),list=document.getElementById('list');
+function render(){
+  chips.innerHTML='';list.innerHTML='';
+  if(tab==='q'){
+    D.queries.forEach((q,i)=>{const r=el('div','row');r.appendChild(el('div','idx',i+1));const m=el('div','main');m.appendChild(el('div',null,esc(q)));r.appendChild(m);const b=el('button','copy','copy');b.onclick=()=>navigator.clipboard.writeText(q);r.appendChild(b);list.appendChild(r)});
+  } else {
+    const counts={};D.browsedUrls.forEach(s=>{counts[s.siteType]=(counts[s.siteType]||0)+1});
+    Object.entries(counts).forEach(([k,v])=>{const c=el('button','chip'+(filter===k?' on':''),k+' <b>'+v+'</b>');c.onclick=()=>{filter=filter===k?null:k;render()};chips.appendChild(c)});
+    D.browsedUrls.forEach(s=>{if(filter&&s.siteType!==filter)return;const r=el('div','row');const m=el('div','main');m.appendChild(el('div',null,'<span class="dom">'+esc(s.domain)+'</span> <span class="pill '+(s.cited?'cite':'brow')+'">'+(s.cited?'cited '+s.timesCited+'\xD7':'browsed')+'</span> <span class="tag">'+s.siteType+'</span>'));m.appendChild(el('div','url',esc(s.url)));r.appendChild(m);list.appendChild(r)});
+  }
 }
-async function verifyScraperOAuthJwt(token) {
-  const { payload } = await (0, import_jose.jwtVerify)(token, getJwks(), {
-    issuer: oauthIssuer(),
-    audience: oauthResourceUrl()
-  });
-  return payload;
+function esc(s){return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;')}
+document.querySelectorAll('.tab').forEach(t=>t.onclick=()=>{document.querySelectorAll('.tab').forEach(x=>x.classList.remove('on'));t.classList.add('on');tab=t.dataset.tab;filter=null;render()});
+render();
+</script>
+</body></html>`;
 }
-var import_jose, jwksSingleton;
-var init_mcp_oauth = __esm({
-  "src/mcp/mcp-oauth.ts"() {
+var import_node_fs9, import_node_os7, import_node_path12, import_papaparse3;
+var init_export = __esm({
+  "src/services/fanout/export.ts"() {
     "use strict";
-    import_jose = require("jose");
-    jwksSingleton = null;
+    import_node_fs9 = require("fs");
+    import_node_os7 = require("os");
+    import_node_path12 = require("path");
+    import_papaparse3 = __toESM(require("papaparse"), 1);
   }
 });
 
-// src/mcp/mcp-routes.ts
-function mcpAuthError(message = "authentication required") {
-  const body = JSON.stringify({
-    jsonrpc: "2.0",
-    id: null,
-    error: {
-      code: -32001,
-      message
-    }
-  });
-  return new Response(body, {
-    status: 401,
-    headers: {
-      "Content-Type": "application/json",
-      "WWW-Authenticate": wwwAuthenticateValue()
-    }
-  });
+// src/mcp/browser-agent-tool-schemas.ts
+var import_zod30, NullableString2, BrowserRawObject, BrowserElementOutput, BrowserBaseOutput, BrowserReplayBaseOutput, BrowserOpenInputSchema, BrowserProfileConnectInputSchema, BrowserProfileListInputSchema, BrowserSessionInputSchema, BrowserLocateTargetSchema, BrowserLocateInputSchema, BrowserGotoInputSchema, BrowserClickInputSchema, BrowserTypeInputSchema, BrowserScrollInputSchema, BrowserPressInputSchema, BrowserReplayStopInputSchema, BrowserReplayDownloadInputSchema, BrowserReplayAnnotationSchema, BrowserReplayMarkInputSchema, BrowserReplayAnnotateInputSchema, BrowserListInputSchema, BrowserCaptureFanoutInputSchema, FanoutSourceOutput, BrowserCaptureFanoutOutputSchema, BrowserOpenOutputSchema, BrowserProfileLogin, BrowserProfileConnectOutputSchema, BrowserProfileListOutputSchema, BrowserScreenshotOutputSchema, BrowserReadOutputSchema, BrowserLocateOutputSchema, BrowserActionOutputSchema, BrowserReplayStartOutputSchema, BrowserReplayStopOutputSchema, BrowserListReplaysOutputSchema, BrowserReplayDownloadOutputSchema, BrowserReplayMarkOutputSchema, BrowserReplayAnnotateOutputSchema, BrowserCloseOutputSchema, BrowserListSessionsOutputSchema;
+var init_browser_agent_tool_schemas = __esm({
+  "src/mcp/browser-agent-tool-schemas.ts"() {
+    "use strict";
+    import_zod30 = require("zod");
+    NullableString2 = import_zod30.z.string().nullable();
+    BrowserRawObject = import_zod30.z.record(import_zod30.z.unknown());
+    BrowserElementOutput = import_zod30.z.record(import_zod30.z.unknown());
+    BrowserBaseOutput = {
+      ok: import_zod30.z.boolean().describe("Whether the browser-agent action succeeded."),
+      tool: import_zod30.z.string().describe("Browser Agent MCP tool that produced this response."),
+      session_id: NullableString2.describe("Browser session id when the response is scoped to a session.")
+    };
+    BrowserReplayBaseOutput = {
+      ...BrowserBaseOutput,
+      replay_id: NullableString2.describe("Replay id when the response is scoped to a replay.")
+    };
+    BrowserOpenInputSchema = {
+      label: import_zod30.z.string().optional().describe("Optional human label for this session, shown in the watch console."),
+      url: import_zod30.z.string().url().optional().describe("Optional URL to navigate to immediately after opening."),
+      profile: import_zod30.z.string().optional().describe("Optional saved hosted profile name to load a logged-in session for a site."),
+      save_profile_changes: import_zod30.z.boolean().optional().describe("Persist cookies and browser storage back to the named profile when the session is closed. Use this for profile setup or intentional auth refreshes; avoid parallel sessions writing to the same profile."),
+      timeout_seconds: import_zod30.z.number().int().min(60).max(259200).optional().describe("How long the direct no-proxy browser session may live before auto-termination. Defaults to 600. The browser idles into a zero-cost standby between actions, so a longer timeout is cheap.")
+    };
+    BrowserProfileConnectInputSchema = {
+      email: import_zod30.z.string().optional().describe("Account email for the login being saved. Used to derive a stable, reusable profile name AND recorded as a note of who is connected. Does NOT import existing cookies \u2014 the user signs in fresh via the returned watch_url."),
+      profile: import_zod30.z.string().optional().describe("Profile to add this login to. Omit to derive one from email. A single profile holds MANY site logins \u2014 pass the same profile name again with a different domain to stack another account (e.g. add claude.ai to a profile that already has chatgpt.com)."),
+      domain: import_zod30.z.string().optional().describe("Site to log into, e.g. chatgpt.com, claude.ai, reddit.com. Defaults to chatgpt.com. Each domain is a separate login inside the profile."),
+      login_url: import_zod30.z.string().url().optional().describe("Login page for the domain. Defaults to https://<domain>/ (https://chatgpt.com/ when domain is omitted)."),
+      url: import_zod30.z.string().url().optional().describe("Deprecated alias for login_url. Use login_url."),
+      note: import_zod30.z.string().optional().describe('Free-text note describing this login, e.g. "ChatGPT Plus, work account". Surfaced by browser_profile_list so you can see what the profile holds.'),
+      label: import_zod30.z.string().optional().describe("Optional human label for this sign-in setup session."),
+      timeout_seconds: import_zod30.z.number().int().min(60).max(259200).optional().describe("How long the sign-in setup session may live before auto-termination. Defaults to 600.")
+    };
+    BrowserProfileListInputSchema = {
+      profile: import_zod30.z.string().optional().describe("Profile whose saved logins to list. Omit to derive from email."),
+      email: import_zod30.z.string().optional().describe("Account email used to derive the profile name when profile is not given."),
+      domain: import_zod30.z.string().optional().describe("Restrict to one site login, e.g. chatgpt.com. Use this to poll a single login until its status reads AUTHENTICATED."),
+      connection_id: import_zod30.z.string().optional().describe("A specific login connection id returned by browser_profile_connect, to poll just that one.")
+    };
+    BrowserSessionInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. Use only a returned session_id; do not construct one yourself.")
+    };
+    BrowserLocateTargetSchema = import_zod30.z.object({
+      name: import_zod30.z.string().optional().describe("Optional label for this target, echoed in the result."),
+      selector: import_zod30.z.string().optional().describe('CSS selector for the exact DOM element to locate, for example h1, input[name="q"], or [data-testid="result"].'),
+      text: import_zod30.z.string().optional().describe("Visible text to locate when a selector is not known. The tool returns the text range bounds when possible."),
+      match: import_zod30.z.enum(["contains", "exact"]).default("contains").describe("How to match text targets. Defaults to contains."),
+      index: import_zod30.z.number().int().min(0).default(0).describe("Zero-based match index when multiple elements match.")
+    }).refine((value) => Boolean(value.selector || value.text), {
+      message: "target requires selector or text"
+    });
+    BrowserLocateInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. Use only a returned session_id; do not construct one yourself."),
+      targets: import_zod30.z.array(BrowserLocateTargetSchema).min(1).max(20).describe("DOM targets to locate in the current viewport. Use selectors for exact elements, or text for visible text ranges.")
+    };
+    BrowserGotoInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. Use only a returned session_id; do not construct one yourself."),
+      url: import_zod30.z.string().url().describe("URL to navigate the browser to.")
+    };
+    BrowserClickInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. Use only a returned session_id; do not construct one yourself."),
+      x: import_zod30.z.number().describe("X coordinate to click, in screenshot pixels. Use only coordinates from the latest browser_screenshot, browser_read, or browser_locate result; do not guess."),
+      y: import_zod30.z.number().describe("Y coordinate to click, in screenshot pixels. Use only coordinates from the latest browser_screenshot, browser_read, or browser_locate result; do not guess."),
+      button: import_zod30.z.enum(["left", "right", "middle"]).default("left").describe("Mouse button."),
+      num_clicks: import_zod30.z.number().int().min(1).max(3).optional().describe("Number of clicks, e.g. 2 for double-click.")
+    };
+    BrowserTypeInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. Use only a returned session_id; do not construct one yourself."),
+      text: import_zod30.z.string().describe("Text to type at the current focus. Click a field first to focus it."),
+      delay: import_zod30.z.number().int().min(0).max(500).optional().describe("Optional per-keystroke delay in ms for human-like typing.")
+    };
+    BrowserScrollInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. Use only a returned session_id; do not construct one yourself."),
+      delta_y: import_zod30.z.number().default(5).describe("Vertical scroll in wheel units. Positive scrolls down, negative up."),
+      delta_x: import_zod30.z.number().default(0).describe("Horizontal scroll in wheel units."),
+      x: import_zod30.z.number().optional().describe("X position to scroll at. Defaults to screen center."),
+      y: import_zod30.z.number().optional().describe("Y position to scroll at. Defaults to screen center.")
+    };
+    BrowserPressInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. Use only a returned session_id; do not construct one yourself."),
+      keys: import_zod30.z.array(import_zod30.z.string()).min(1).describe('Keys or combinations to press, e.g. ["Return"], ["Ctrl+a"], ["Ctrl+Shift+Tab"].')
+    };
+    BrowserReplayStopInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. Use only a returned session_id; do not construct one yourself."),
+      replay_id: import_zod30.z.string().describe("The replay id returned by browser_replay_start or browser_list_replays. Use only a returned replay_id; do not construct one yourself.")
+    };
+    BrowserReplayDownloadInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. Use only a returned session_id; do not construct one yourself."),
+      replay_id: import_zod30.z.string().describe("The replay id returned by browser_replay_start or browser_list_replays. Use only a returned replay_id; do not construct one yourself."),
+      filename: import_zod30.z.string().optional().describe("Optional local MP4 filename. Defaults to a timestamped replay filename.")
+    };
+    BrowserReplayAnnotationSchema = import_zod30.z.object({
+      type: import_zod30.z.enum(["box", "circle", "underline", "arrow", "label"]).default("box").describe("Annotation style to draw over the replay."),
+      start_seconds: import_zod30.z.number().min(0).default(0).describe("When the annotation should appear in the replay."),
+      end_seconds: import_zod30.z.number().min(0).optional().describe("When the annotation should disappear. Defaults to two seconds after start_seconds."),
+      left: import_zod30.z.number().optional().describe("Target left edge in browser screenshot pixels. Use element.left from browser_screenshot/browser_read."),
+      top: import_zod30.z.number().optional().describe("Target top edge in browser screenshot pixels. Use element.top from browser_screenshot/browser_read."),
+      width: import_zod30.z.number().positive().optional().describe("Target width in browser screenshot pixels. Use element.width from browser_screenshot/browser_read."),
+      height: import_zod30.z.number().positive().optional().describe("Target height in browser screenshot pixels. Use element.height from browser_screenshot/browser_read."),
+      x: import_zod30.z.number().optional().describe("Point target x coordinate in browser screenshot pixels when no box is available."),
+      y: import_zod30.z.number().optional().describe("Point target y coordinate in browser screenshot pixels when no box is available."),
+      from_x: import_zod30.z.number().optional().describe("Arrow start x coordinate in browser screenshot pixels. Defaults near the target."),
+      from_y: import_zod30.z.number().optional().describe("Arrow start y coordinate in browser screenshot pixels. Defaults near the target."),
+      to_x: import_zod30.z.number().optional().describe("Arrow target x coordinate in browser screenshot pixels. Defaults to the target box center."),
+      to_y: import_zod30.z.number().optional().describe("Arrow target y coordinate in browser screenshot pixels. Defaults to the target box center."),
+      label: import_zod30.z.string().max(120).optional().describe("Optional text callout to render near the annotation."),
+      color: import_zod30.z.string().regex(/^#?[0-9a-fA-F]{6}$/).optional().describe("Annotation color as hex, for example #ff3b30."),
+      thickness: import_zod30.z.number().min(1).max(24).optional().describe("Stroke thickness in pixels. Defaults to 5.")
+    });
+    BrowserReplayMarkInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. Use only a returned session_id; do not construct one yourself. A replay must already be recording."),
+      target: BrowserLocateTargetSchema.describe("The exact DOM element or text range to mark in the current viewport."),
+      type: import_zod30.z.enum(["box", "circle", "underline", "arrow"]).default("box").describe("Annotation style to generate. Labels are included on the returned annotation when label is provided."),
+      label: import_zod30.z.string().max(120).optional().describe("Optional callout text to render near the target."),
+      color: import_zod30.z.string().regex(/^#?[0-9a-fA-F]{6}$/).optional().describe("Annotation color as hex, for example #ff3b30."),
+      thickness: import_zod30.z.number().min(1).max(24).optional().describe("Stroke thickness in pixels. Defaults to 5."),
+      padding: import_zod30.z.number().min(0).max(80).default(8).describe("Pixels to expand the DOM bounds so the highlight does not touch the text edge."),
+      start_offset_seconds: import_zod30.z.number().min(-5).max(10).default(-0.25).describe("Offset from the current replay time. Negative values make the callout appear just before the mark action is captured."),
+      duration_seconds: import_zod30.z.number().min(0.5).max(30).default(4).describe("How long the generated annotation should remain visible.")
+    };
+    BrowserReplayAnnotateInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. Use only a returned session_id; do not construct one yourself."),
+      replay_id: import_zod30.z.string().describe("The replay id returned by browser_replay_start or browser_list_replays. Use only a returned replay_id; do not construct one yourself."),
+      annotations: import_zod30.z.array(BrowserReplayAnnotationSchema).min(1).max(50).describe("Timed overlay annotations to render on the replay. Prefer annotations returned by browser_replay_mark; otherwise use exact DOM bounds from browser_locate/browser_screenshot/browser_read."),
+      filename: import_zod30.z.string().optional().describe("Optional output MP4 filename. Defaults to a timestamped annotated replay filename."),
+      source_width: import_zod30.z.number().positive().optional().describe("Width of the screenshot coordinate space used for annotations. Defaults to the replay video width."),
+      source_height: import_zod30.z.number().positive().optional().describe("Height of the coordinate space used for annotations. When this is a page viewport height smaller than the replay video height, the annotator infers the browser chrome top offset."),
+      source_left_offset: import_zod30.z.number().min(0).optional().describe("Optional explicit X offset from annotation coordinates to replay video coordinates. Usually omitted."),
+      source_top_offset: import_zod30.z.number().min(0).optional().describe("Optional explicit Y offset from annotation coordinates to replay video coordinates. Usually omitted because browser chrome offset is inferred when source_height is a page viewport height.")
+    };
+    BrowserListInputSchema = {
+      include_closed: import_zod30.z.boolean().default(false).describe("Include closed sessions in the list.")
+    };
+    BrowserCaptureFanoutInputSchema = {
+      session_id: import_zod30.z.string().describe("The session id returned by browser_open or browser_list_sessions. The session must be on chatgpt.com or claude.ai and logged in through a saved hosted profile. Use only a returned session_id; do not construct one yourself."),
+      prompt: import_zod30.z.string().optional().describe("Optional prompt to type into the chat composer and submit before capturing. Omit to passively capture the fan-out of a prompt the user just ran in the visible browser. The prompt must trigger web search for there to be a fan-out."),
+      wait_ms: import_zod30.z.number().int().min(0).max(18e4).optional().describe("How long to wait for the answer stream to finish before parsing. Defaults to 90000 when a prompt is sent, 8000 for passive capture. Capture ends as soon as the answer stream finishes."),
+      first_party_domain: import_zod30.z.string().optional().describe("The brand/site being researched, for example example.com. Sources on this domain are tagged First-party/vendor. Set this when the prompt is about a specific business."),
+      reset: import_zod30.z.boolean().default(false).describe("Clear any previously buffered stream for this page before capturing. Use when re-running to avoid mixing turns."),
+      export: import_zod30.z.boolean().default(false).describe("When true, write JSON, CSV, TSV exports (queries, citations, all sources, browsed-only sources, snippets, domains) and a self-contained HTML report to MCP_SCRAPER_OUTPUT_DIR/fanout, returning paths relative to MCP_SCRAPER_OUTPUT_DIR.")
+    };
+    FanoutSourceOutput = import_zod30.z.object({
+      url: import_zod30.z.string(),
+      domain: import_zod30.z.string(),
+      title: import_zod30.z.string(),
+      cited: import_zod30.z.boolean(),
+      timesCited: import_zod30.z.number().int().min(0),
+      snippet: import_zod30.z.string(),
+      round: import_zod30.z.number().int().nullable(),
+      siteType: import_zod30.z.string().describe("URL category: First-party/vendor, News/media, Reddit, Social/video, Encyclopedia, Review site, Docs, or Blog.")
+    });
+    BrowserCaptureFanoutOutputSchema = {
+      ...BrowserBaseOutput,
+      tool: import_zod30.z.literal("query_fanout_workflow"),
+      platform: import_zod30.z.enum(["ChatGPT", "Claude"]).describe("Which AI-search surface the fan-out was captured from."),
+      captured_at: import_zod30.z.string(),
+      prompt: import_zod30.z.string().describe("The user prompt that triggered the captured fan-out, when recoverable."),
+      meta: import_zod30.z.object({
+        model: import_zod30.z.string(),
+        finishType: import_zod30.z.string(),
+        title: import_zod30.z.string(),
+        rounds: import_zod30.z.number().int().min(0)
+      }),
+      queries: import_zod30.z.array(import_zod30.z.string()).describe("Every web-search sub-query the model issued, in capture order. Classify these by funnel stage and type yourself from the text."),
+      browsed_urls: import_zod30.z.array(FanoutSourceOutput).describe("Every researched URL (cited and browsed-only), cited first."),
+      cited_urls: import_zod30.z.array(FanoutSourceOutput).describe("The subset of researched URLs actually cited in the final answer."),
+      browsed_only: import_zod30.z.array(FanoutSourceOutput).describe("Researched URLs the model pulled but did not cite."),
+      snippets: import_zod30.z.array(import_zod30.z.object({ url: import_zod30.z.string(), domain: import_zod30.z.string(), title: import_zod30.z.string(), text: import_zod30.z.string() })),
+      counts: import_zod30.z.object({
+        subQueries: import_zod30.z.number().int().min(0),
+        browsed: import_zod30.z.number().int().min(0),
+        cited: import_zod30.z.number().int().min(0),
+        browsedOnly: import_zod30.z.number().int().min(0)
+      }),
+      aggregates: import_zod30.z.object({
+        topSites: import_zod30.z.array(import_zod30.z.object({ domain: import_zod30.z.string(), count: import_zod30.z.number().int(), cited: import_zod30.z.boolean(), timesCited: import_zod30.z.number().int(), siteType: import_zod30.z.string() })),
+        citationOrder: import_zod30.z.array(import_zod30.z.object({ rank: import_zod30.z.number().int(), domain: import_zod30.z.string(), url: import_zod30.z.string(), timesCited: import_zod30.z.number().int() })),
+        byCategory: import_zod30.z.record(import_zod30.z.number().int())
+      }).describe("Objective aggregates: top sourced sites by frequency, citation order, and URL-category counts."),
+      first_party_domain: import_zod30.z.string().nullable(),
+      exports: import_zod30.z.object({
+        relativeTo: import_zod30.z.string(),
+        dir: import_zod30.z.string(),
+        json: import_zod30.z.string(),
+        queriesCsv: import_zod30.z.string(),
+        queriesTsv: import_zod30.z.string(),
+        citationsCsv: import_zod30.z.string(),
+        sourcesCsv: import_zod30.z.string(),
+        browsedOnlyCsv: import_zod30.z.string(),
+        snippetsCsv: import_zod30.z.string(),
+        domainsCsv: import_zod30.z.string(),
+        report: import_zod30.z.string()
+      }).nullable().describe("Relative export paths when export=true, otherwise null. Paths are relative to MCP_SCRAPER_OUTPUT_DIR, or ~/Downloads/mcp-scraper when that env var is not set."),
+      debug: import_zod30.z.object({
+        interceptorReady: import_zod30.z.boolean(),
+        rawBytes: import_zod30.z.number().int().min(0),
+        unmappedKeys: import_zod30.z.array(import_zod30.z.string()),
+        note: import_zod30.z.string()
+      }).optional()
+    };
+    BrowserOpenOutputSchema = {
+      ok: import_zod30.z.boolean(),
+      tool: import_zod30.z.literal("browser_open"),
+      session_id: import_zod30.z.string().describe("Session id returned by browser_open. Use only this exact value in later browser_* calls; do not construct one yourself."),
+      watch_url: import_zod30.z.string().describe("Human watch/takeover URL for this browser session on mcpscraper.dev."),
+      live_view_url: NullableString2.describe("Deprecated; always null. Open watch_url to view the live session."),
+      url: NullableString2.describe("Initial URL requested by the caller, when provided."),
+      hint: import_zod30.z.string(),
+      raw: BrowserRawObject.optional()
+    };
+    BrowserProfileLogin = import_zod30.z.object({
+      connection_id: NullableString2.describe("Auth connection id for this login."),
+      domain: import_zod30.z.string().describe("Site this login is for, e.g. chatgpt.com."),
+      status: import_zod30.z.string().describe("Auth status, e.g. NEEDS_AUTH or AUTHENTICATED."),
+      account_email: NullableString2.describe("Account email recorded for this login, when known."),
+      note: NullableString2.describe("Free-text note describing this login."),
+      watch_url: NullableString2.describe("mcpscraper.dev sign-in link when this login still needs the user to authenticate."),
+      last_connected_at: NullableString2.describe("When this login was last saved or refreshed.")
+    });
+    BrowserProfileConnectOutputSchema = {
+      ok: import_zod30.z.boolean(),
+      tool: import_zod30.z.literal("browser_profile_connect"),
+      session_id: NullableString2,
+      auth_connection_id: import_zod30.z.string(),
+      watch_url: import_zod30.z.string().describe("mcpscraper.dev sign-in link to give the user so they can complete this login."),
+      live_view_url: NullableString2.describe("Deprecated; always null. Open watch_url to view the sign-in."),
+      profile: import_zod30.z.string().describe("Profile this login was added to. Reuse it to stack more logins or to open a session."),
+      domain: import_zod30.z.string(),
+      setup_url: import_zod30.z.string(),
+      account_email: NullableString2,
+      note: NullableString2,
+      status: import_zod30.z.string(),
+      flow_status: NullableString2,
+      flow_step: NullableString2,
+      flow_expires_at: NullableString2,
+      post_login_url: NullableString2,
+      connected_logins: import_zod30.z.array(BrowserProfileLogin).describe("Every login currently saved in this profile, so you can see what else is connected."),
+      next_steps: import_zod30.z.array(import_zod30.z.string()),
+      raw: BrowserRawObject.optional()
+    };
+    BrowserProfileListOutputSchema = {
+      ok: import_zod30.z.boolean(),
+      tool: import_zod30.z.literal("browser_profile_list"),
+      session_id: import_zod30.z.null(),
+      profile: import_zod30.z.string().describe("Profile these logins belong to."),
+      connections: import_zod30.z.array(BrowserProfileLogin).describe("All site logins saved in this profile, each with its current auth status and note."),
+      count: import_zod30.z.number().int().min(0)
+    };
+    BrowserScreenshotOutputSchema = {
+      ...BrowserBaseOutput,
+      tool: import_zod30.z.literal("browser_screenshot"),
+      url: NullableString2,
+      title: NullableString2,
+      text: import_zod30.z.string(),
+      elements: import_zod30.z.array(BrowserElementOutput),
+      screenshot: import_zod30.z.object({
+        mime_type: import_zod30.z.string(),
+        inline: import_zod30.z.boolean()
+      }).nullable()
+    };
+    BrowserReadOutputSchema = {
+      ...BrowserBaseOutput,
+      tool: import_zod30.z.literal("browser_read"),
+      url: NullableString2,
+      title: NullableString2,
+      text: import_zod30.z.string(),
+      elements: import_zod30.z.array(BrowserElementOutput),
+      raw: BrowserRawObject.optional()
+    };
+    BrowserLocateOutputSchema = {
+      ...BrowserBaseOutput,
+      tool: import_zod30.z.literal("browser_locate"),
+      url: NullableString2,
+      title: NullableString2,
+      viewport: BrowserRawObject.nullable(),
+      replay: BrowserRawObject.nullable(),
+      targets: import_zod30.z.array(BrowserRawObject),
+      raw: BrowserRawObject.optional()
+    };
+    BrowserActionOutputSchema = {
+      ...BrowserBaseOutput,
+      result: BrowserRawObject.describe("Provider action result. Check ok and follow with browser_screenshot/browser_read when page state matters."),
+      nextRecommendedTool: import_zod30.z.string().nullable()
+    };
+    BrowserReplayStartOutputSchema = {
+      ...BrowserReplayBaseOutput,
+      tool: import_zod30.z.literal("browser_replay_start"),
+      view_url: NullableString2,
+      download_url: NullableString2,
+      raw: BrowserRawObject.optional()
+    };
+    BrowserReplayStopOutputSchema = {
+      ...BrowserReplayBaseOutput,
+      tool: import_zod30.z.literal("browser_replay_stop"),
+      view_url: NullableString2,
+      download_url: NullableString2,
+      raw: BrowserRawObject.optional()
+    };
+    BrowserListReplaysOutputSchema = {
+      ...BrowserBaseOutput,
+      tool: import_zod30.z.literal("browser_list_replays"),
+      replays: import_zod30.z.array(BrowserRawObject),
+      count: import_zod30.z.number().int().min(0)
+    };
+    BrowserReplayDownloadOutputSchema = {
+      ...BrowserReplayBaseOutput,
+      tool: import_zod30.z.literal("browser_replay_download"),
+      file_path: NullableString2,
+      bytes: import_zod30.z.number().int().min(0).nullable(),
+      mime_type: NullableString2,
+      download_url: NullableString2
+    };
+    BrowserReplayMarkOutputSchema = {
+      ...BrowserReplayBaseOutput,
+      tool: import_zod30.z.literal("browser_replay_mark"),
+      annotation: BrowserRawObject,
+      source_width: import_zod30.z.number().nullable(),
+      source_height: import_zod30.z.number().nullable(),
+      target: BrowserRawObject.nullable(),
+      hint: import_zod30.z.string()
+    };
+    BrowserReplayAnnotateOutputSchema = {
+      ...BrowserReplayBaseOutput,
+      tool: import_zod30.z.literal("browser_replay_annotate"),
+      source_file_path: NullableString2,
+      annotated_file_path: NullableString2,
+      bytes: import_zod30.z.number().int().min(0).nullable(),
+      width: import_zod30.z.number().int().min(0).nullable(),
+      height: import_zod30.z.number().int().min(0).nullable(),
+      annotation_count: import_zod30.z.number().int().min(0).nullable(),
+      mime_type: NullableString2
+    };
+    BrowserCloseOutputSchema = {
+      ...BrowserBaseOutput,
+      tool: import_zod30.z.literal("browser_close"),
+      closed: import_zod30.z.boolean(),
+      raw: BrowserRawObject.optional()
+    };
+    BrowserListSessionsOutputSchema = {
+      ok: import_zod30.z.boolean(),
+      tool: import_zod30.z.literal("browser_list_sessions"),
+      session_id: import_zod30.z.null(),
+      sessions: import_zod30.z.array(BrowserRawObject),
+      count: import_zod30.z.number().int().min(0)
+    };
+  }
+});
+
+// src/mcp/replay-annotator.ts
+function finiteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function clamp(value, min, max) {
+  return Math.min(max, Math.max(min, value));
+}
+function formatAssTime(seconds) {
+  const safe2 = Math.max(0, seconds);
+  const hours = Math.floor(safe2 / 3600);
+  const minutes = Math.floor(safe2 % 3600 / 60);
+  const wholeSeconds = Math.floor(safe2 % 60);
+  const centiseconds = Math.floor((safe2 - Math.floor(safe2)) * 100);
+  return `${hours}:${String(minutes).padStart(2, "0")}:${String(wholeSeconds).padStart(2, "0")}.${String(centiseconds).padStart(2, "0")}`;
+}
+function cssHexToAssColor(color) {
+  const normalized = color?.trim().match(/^#?([0-9a-fA-F]{6})$/)?.[1] ?? "ff3b30";
+  const red = normalized.slice(0, 2);
+  const green = normalized.slice(2, 4);
+  const blue = normalized.slice(4, 6);
+  return `&H${blue}${green}${red}&`;
+}
+function escapeAssText(value) {
+  return value.replace(/\\/g, "\\\\").replace(/\{/g, "\\{").replace(/\}/g, "\\}").replace(/\r?\n/g, "\\N");
+}
+function resolveCoordinateTransform(video, source, options) {
+  const explicitOffsetX = finiteNumber(options.sourceLeftOffset) ? options.sourceLeftOffset : null;
+  const explicitOffsetY = finiteNumber(options.sourceTopOffset) ? options.sourceTopOffset : null;
+  const inferredTopOffset = explicitOffsetY == null && Math.round(source.width) === Math.round(video.width) && source.height < video.height && video.height - source.height <= 220 ? video.height - source.height : 0;
+  const offsetX = explicitOffsetX ?? 0;
+  const offsetY = explicitOffsetY ?? inferredTopOffset;
+  return {
+    scaleX: (video.width - offsetX) / source.width,
+    scaleY: (video.height - offsetY) / source.height,
+    offsetX,
+    offsetY
+  };
 }
-async function requireMcpCallerKey(c) {
-  const xApiKey = c.req.header("x-api-key")?.trim();
-  const authHeader = c.req.header("Authorization")?.trim();
-  const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7).trim() : void 0;
-  if (!xApiKey && bearerToken && isBearerJwt(bearerToken)) {
-    let identity;
-    try {
-      const payload = await verifyScraperOAuthJwt(bearerToken);
-      identity = typeof payload.sub === "string" ? payload.sub : "";
-    } catch {
-      return mcpAuthError("Bearer token is invalid or expired");
-    }
-    if (!identity) return mcpAuthError("Bearer token has no subject");
-    const user2 = await getUserByEmail(identity);
-    if (!user2 || !user2.api_key || user2.key_active !== 1) return mcpAuthError("No active MCP Scraper account for this identity");
-    return user2.api_key;
+function transformPoint(x, y, transform) {
+  return {
+    x: x * transform.scaleX + transform.offsetX,
+    y: y * transform.scaleY + transform.offsetY
+  };
+}
+function scaleRect(annotation, transform) {
+  if (finiteNumber(annotation.left) && finiteNumber(annotation.top) && finiteNumber(annotation.width) && finiteNumber(annotation.height)) {
+    const origin = transformPoint(annotation.left, annotation.top, transform);
+    return {
+      left: origin.x,
+      top: origin.y,
+      width: annotation.width * transform.scaleX,
+      height: annotation.height * transform.scaleY
+    };
   }
-  const callerKey = xApiKey ?? bearerToken;
-  if (!callerKey) return mcpAuthError();
-  const user = await getUserByApiKey(callerKey);
-  if (!user) return mcpAuthError();
-  return callerKey;
+  if (finiteNumber(annotation.x) && finiteNumber(annotation.y)) {
+    const radius = finiteNumber(annotation.width) ? annotation.width / 2 : 28;
+    const point = transformPoint(annotation.x, annotation.y, transform);
+    return {
+      left: point.x - radius * transform.scaleX,
+      top: point.y - radius * transform.scaleY,
+      width: radius * 2 * transform.scaleX,
+      height: radius * 2 * transform.scaleY
+    };
+  }
+  throw new Error("annotation needs either left/top/width/height or x/y");
+}
+function rectPath(rect) {
+  const x1 = Math.round(rect.left);
+  const y1 = Math.round(rect.top);
+  const x2 = Math.round(rect.left + rect.width);
+  const y2 = Math.round(rect.top + rect.height);
+  return `m ${x1} ${y1} l ${x2} ${y1} l ${x2} ${y2} l ${x1} ${y2} l ${x1} ${y1}`;
+}
+function ellipsePath(rect) {
+  const cx = rect.left + rect.width / 2;
+  const cy = rect.top + rect.height / 2;
+  const rx = Math.max(4, rect.width / 2);
+  const ry = Math.max(4, rect.height / 2);
+  const points = [];
+  for (let i = 0; i <= 32; i += 1) {
+    const t = Math.PI * 2 * i / 32;
+    const x = Math.round(cx + Math.cos(t) * rx);
+    const y = Math.round(cy + Math.sin(t) * ry);
+    points.push(`${i === 0 ? "m" : "l"} ${x} ${y}`);
+  }
+  return points.join(" ");
+}
+function filledRectPath(left, top, width, height) {
+  return rectPath({ left, top, width, height });
+}
+function arrowPath(fromX, fromY, toX, toY, thickness) {
+  const dx = toX - fromX;
+  const dy = toY - fromY;
+  const length = Math.max(1, Math.hypot(dx, dy));
+  const ux = dx / length;
+  const uy = dy / length;
+  const px = -uy;
+  const py = ux;
+  const half = thickness / 2;
+  const head = Math.max(14, thickness * 4);
+  const baseX = toX - ux * head;
+  const baseY = toY - uy * head;
+  const p1x = Math.round(fromX + px * half);
+  const p1y = Math.round(fromY + py * half);
+  const p2x = Math.round(baseX + px * half);
+  const p2y = Math.round(baseY + py * half);
+  const p3x = Math.round(baseX + px * head * 0.55);
+  const p3y = Math.round(baseY + py * head * 0.55);
+  const p4x = Math.round(toX);
+  const p4y = Math.round(toY);
+  const p5x = Math.round(baseX - px * head * 0.55);
+  const p5y = Math.round(baseY - py * head * 0.55);
+  const p6x = Math.round(baseX - px * half);
+  const p6y = Math.round(baseY - py * half);
+  const p7x = Math.round(fromX - px * half);
+  const p7y = Math.round(fromY - py * half);
+  return `m ${p1x} ${p1y} l ${p2x} ${p2y} l ${p3x} ${p3y} l ${p4x} ${p4y} l ${p5x} ${p5y} l ${p6x} ${p6y} l ${p7x} ${p7y} l ${p1x} ${p1y}`;
+}
+function eventLine(start, end, body) {
+  return `Dialogue: 0,${formatAssTime(start)},${formatAssTime(end)},Default,,0,0,0,,${body}`;
+}
+function labelLine(start, end, x, y, label) {
+  const safeX = Math.round(x);
+  const safeY = Math.round(y);
+  return eventLine(
+    start,
+    end,
+    `{\\an7\\pos(${safeX},${safeY})\\fs30\\bord4\\shad0\\c&HFFFFFF&\\3c&H000000&}${escapeAssText(label)}`
+  );
 }
-function registerSerpIntelligenceCaptureTools(server, executor) {
+function shapeLine(start, end, path6, color, thickness, filled = false) {
+  const fillAlpha = filled ? "&H00&" : "&HFF&";
+  const border = filled ? 0 : thickness;
+  return eventLine(
+    start,
+    end,
+    `{\\an7\\pos(0,0)\\p1\\bord${border}\\shad0\\1a${fillAlpha}\\1c${color}\\3c${color}}${path6}`
+  );
+}
+function buildAssSubtitle(options, video) {
+  const source = {
+    width: options.sourceWidth && options.sourceWidth > 0 ? options.sourceWidth : video.width,
+    height: options.sourceHeight && options.sourceHeight > 0 ? options.sourceHeight : video.height
+  };
+  const transform = resolveCoordinateTransform(video, source, options);
+  const lines = [];
+  for (const annotation of options.annotations) {
+    const start = Math.max(0, annotation.start_seconds ?? 0);
+    const end = annotation.end_seconds && annotation.end_seconds > start ? annotation.end_seconds : start + 2;
+    const type = annotation.type ?? "box";
+    const color = cssHexToAssColor(annotation.color);
+    const thickness = Math.round(clamp(annotation.thickness ?? 5, 2, 24));
+    if (type === "label") {
+      if (!annotation.label) throw new Error("label annotation needs label");
+      const rect2 = scaleRect(annotation, transform);
+      lines.push(labelLine(start, end, rect2.left, Math.max(8, rect2.top), annotation.label));
+      continue;
+    }
+    if (type === "arrow") {
+      const rect2 = finiteNumber(annotation.to_x) && finiteNumber(annotation.to_y) ? null : scaleRect(annotation, transform);
+      const toPoint = finiteNumber(annotation.to_x) && finiteNumber(annotation.to_y) ? transformPoint(annotation.to_x, annotation.to_y, transform) : null;
+      const toX = toPoint ? toPoint.x : rect2.left + rect2.width / 2;
+      const toY = toPoint ? toPoint.y : rect2.top + rect2.height / 2;
+      const fromPoint = finiteNumber(annotation.from_x) && finiteNumber(annotation.from_y) ? transformPoint(annotation.from_x, annotation.from_y, transform) : null;
+      const fromX = fromPoint ? fromPoint.x : clamp(toX - 120, 12, video.width - 12);
+      const fromY = fromPoint ? fromPoint.y : clamp(toY - 90, 12, video.height - 12);
+      lines.push(shapeLine(start, end, arrowPath(fromX, fromY, toX, toY, thickness), color, thickness, true));
+      if (annotation.label) lines.push(labelLine(start, end, fromX + 8, Math.max(96, fromY - 36), annotation.label));
+      continue;
+    }
+    const rect = scaleRect(annotation, transform);
+    if (type === "underline") {
+      const underlineTop = rect.top + rect.height + thickness;
+      lines.push(shapeLine(start, end, filledRectPath(rect.left, underlineTop, rect.width, thickness), color, 0, true));
+    } else if (type === "circle") {
+      lines.push(shapeLine(start, end, ellipsePath(rect), color, thickness));
+    } else {
+      lines.push(shapeLine(start, end, rectPath(rect), color, thickness));
+    }
+    if (annotation.label) lines.push(labelLine(start, end, rect.left, Math.max(8, rect.top - 38), annotation.label));
+  }
+  return [
+    "[Script Info]",
+    "ScriptType: v4.00+",
+    `PlayResX: ${Math.round(video.width)}`,
+    `PlayResY: ${Math.round(video.height)}`,
+    "ScaledBorderAndShadow: yes",
+    "",
+    "[V4+ Styles]",
+    "Format: Name, Fontname, Fontsize, PrimaryColour, SecondaryColour, OutlineColour, BackColour, Bold, Italic, Underline, StrikeOut, ScaleX, ScaleY, Spacing, Angle, BorderStyle, Outline, Shadow, Alignment, MarginL, MarginR, MarginV, Encoding",
+    "Style: Default,Arial,30,&H00FFFFFF,&H000000FF,&H00000000,&H90000000,0,0,0,0,100,100,0,0,1,2,0,7,0,0,0,1",
+    "",
+    "[Events]",
+    "Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text",
+    ...lines,
+    ""
+  ].join("\n");
+}
+async function videoSize(inputFilePath) {
+  const { stdout } = await execFileAsync2("ffprobe", [
+    "-v",
+    "error",
+    "-select_streams",
+    "v:0",
+    "-show_entries",
+    "stream=width,height",
+    "-of",
+    "json",
+    inputFilePath
+  ], { maxBuffer: 1024 * 1024 });
+  const parsed = JSON.parse(stdout);
+  const stream = parsed.streams?.[0];
+  if (!stream?.width || !stream.height) throw new Error("could not read replay video dimensions");
+  return { width: stream.width, height: stream.height };
+}
+function ffmpegFilterPath(path6) {
+  return path6.replace(/\\/g, "\\\\").replace(/:/g, "\\:");
+}
+async function annotateReplayVideo(inputFilePath, outputFilePath, options) {
+  if (!options.annotations.length) throw new Error("annotations must include at least one item");
+  const size = await videoSize(inputFilePath);
+  const tmp = await (0, import_promises10.mkdtemp)((0, import_node_path13.join)((0, import_node_os8.tmpdir)(), "mcp-scraper-ass-"));
+  const assPath = (0, import_node_path13.join)(tmp, "annotations.ass");
+  try {
+    await (0, import_promises10.writeFile)(assPath, buildAssSubtitle(options, size), "utf8");
+    await execFileAsync2("ffmpeg", [
+      "-y",
+      "-i",
+      inputFilePath,
+      "-vf",
+      `ass=${ffmpegFilterPath(assPath)}`,
+      "-c:v",
+      "libx264",
+      "-pix_fmt",
+      "yuv420p",
+      "-movflags",
+      "+faststart",
+      "-c:a",
+      "copy",
+      outputFilePath
+    ], { maxBuffer: 1024 * 1024 * 20 });
+    const out = await (0, import_promises10.stat)(outputFilePath);
+    return {
+      filePath: outputFilePath,
+      bytes: out.size,
+      width: size.width,
+      height: size.height,
+      annotationCount: options.annotations.length
+    };
+  } finally {
+    await (0, import_promises10.rm)(tmp, { recursive: true, force: true });
+  }
+}
+var import_node_child_process4, import_promises10, import_node_os8, import_node_path13, import_node_util2, execFileAsync2;
+var init_replay_annotator = __esm({
+  "src/mcp/replay-annotator.ts"() {
+    "use strict";
+    import_node_child_process4 = require("child_process");
+    import_promises10 = require("fs/promises");
+    import_node_os8 = require("os");
+    import_node_path13 = require("path");
+    import_node_util2 = require("util");
+    execFileAsync2 = (0, import_node_util2.promisify)(import_node_child_process4.execFile);
+  }
+});
+
+// src/mcp/browser-agent-mcp-server.ts
+function structuredResult(value, isError = false) {
+  const safe2 = sanitizeOutboundDiagnostics(value);
+  return {
+    content: [{ type: "text", text: JSON.stringify(safe2) }],
+    structuredContent: safe2,
+    isError
+  };
+}
+function errorMessage4(value) {
+  if (value && typeof value === "object") {
+    const data = value;
+    if (typeof data.error === "string") return data.error;
+    if (typeof data.message === "string") return data.message;
+  }
+  return typeof value === "string" ? value : "Browser Agent request failed";
+}
+function errorResult(tool, value, sessionId = null, replayId = null) {
+  return structuredResult({
+    ok: false,
+    tool,
+    session_id: sessionId,
+    ...replayId !== null ? { replay_id: replayId } : {},
+    error: errorMessage4(value),
+    raw: value && typeof value === "object" ? value : { value }
+  }, true);
+}
+function actionResult(tool, sessionId, ok, data, nextRecommendedTool = "browser_screenshot") {
+  if (!ok) return errorResult(tool, data, sessionId);
+  return structuredResult({
+    ok: true,
+    tool,
+    session_id: sessionId,
+    result: data && typeof data === "object" ? data : { value: data },
+    nextRecommendedTool
+  });
+}
+function outputBaseDir4() {
+  return process.env.MCP_SCRAPER_OUTPUT_DIR?.trim() || (0, import_node_path14.join)((0, import_node_os9.homedir)(), "Downloads", "mcp-scraper");
+}
+function safeFilePart2(value) {
+  return value.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 120) || "replay";
+}
+function replayFilePath(sessionId, replayId, filename) {
+  const requested = filename?.trim();
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const name = requested ? safeFilePart2(requested).replace(/\.mp4$/i, "") : `${stamp}-${safeFilePart2(sessionId)}-${safeFilePart2(replayId)}`;
+  return (0, import_node_path14.join)(outputBaseDir4(), "browser-replays", `${name}.mp4`);
+}
+function slugPart(value) {
+  const trimmed = value?.trim().toLowerCase();
+  if (!trimmed) return null;
+  return trimmed.replace(/^https?:\/\//, "").replace(/^www\./, "").replace(/\/.*$/, "").replace(/[^a-z0-9._-]+/g, "-").replace(/[._-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function savedProfileNameFromEmail(email) {
+  const value = slugPart(email);
+  if (!value) return null;
+  return value.slice(0, 80) || null;
+}
+function isEnrichedFanout(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return typeof candidate.platform === "string" && typeof candidate.capturedAt === "string" && typeof candidate.prompt === "string" && Array.isArray(candidate.queries) && Array.isArray(candidate.browsedUrls) && Array.isArray(candidate.citedUrls) && Array.isArray(candidate.browsedOnly) && Array.isArray(candidate.snippets) && !!candidate.counts && !!candidate.aggregates;
+}
+function annotatedReplayFilePath(sessionId, replayId, filename) {
+  const requested = filename?.trim();
+  if (requested) return replayFilePath(sessionId, replayId, requested);
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  return replayFilePath(sessionId, replayId, `${stamp}-${safeFilePart2(sessionId)}-${safeFilePart2(replayId)}-annotated`);
+}
+function finiteNumber2(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function expandElementBounds(element, viewport, padding) {
+  const sourceWidth = finiteNumber2(viewport?.width) && viewport.width > 0 ? viewport.width : 1920;
+  const sourceHeight = finiteNumber2(viewport?.height) && viewport.height > 0 ? viewport.height : 1080;
+  const left = Math.max(0, element.left - padding);
+  const top = Math.max(0, element.top - padding);
+  const right = Math.min(sourceWidth, element.left + element.width + padding);
+  const bottom = Math.min(sourceHeight, element.top + element.height + padding);
+  return {
+    left,
+    top,
+    width: Math.max(1, right - left),
+    height: Math.max(1, bottom - top),
+    sourceWidth,
+    sourceHeight
+  };
+}
+function registerBrowserAgentMcpTools(server, opts) {
+  const baseUrl = opts.baseUrl.replace(/\/$/, "");
+  const consoleBase = (opts.consoleBaseUrl ?? opts.baseUrl).replace(/\/$/, "");
+  const timeoutMs = opts.timeoutMs ?? 9e4;
+  async function req(method, path6, body, requestTimeoutMs = timeoutMs) {
+    try {
+      const res = await fetch(`${baseUrl}${path6}`, {
+        method,
+        headers: { "Content-Type": "application/json", "x-api-key": opts.apiKey },
+        body: body ? JSON.stringify(body) : void 0,
+        signal: AbortSignal.timeout(requestTimeoutMs)
+      });
+      const data = await res.json().catch(() => ({}));
+      return { ok: res.ok, data };
+    } catch (err) {
+      return { ok: false, data: { error: err instanceof Error ? err.message : String(err) } };
+    }
+  }
+  async function downloadReplay(sessionId, replayId, filename) {
+    const path6 = `/agent/sessions/${encodeURIComponent(sessionId)}/replays/${encodeURIComponent(replayId)}/download`;
+    try {
+      const res = await fetch(`${baseUrl}${path6}`, {
+        method: "GET",
+        headers: { "x-api-key": opts.apiKey },
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!res.ok) {
+        const data = await res.json().catch(async () => ({ error: await res.text().catch(() => `HTTP ${res.status}`) }));
+        return { ok: false, data };
+      }
+      const bytes = Buffer.from(await res.arrayBuffer());
+      const filePath = replayFilePath(sessionId, replayId, filename);
+      (0, import_node_fs10.mkdirSync)((0, import_node_path14.join)(outputBaseDir4(), "browser-replays"), { recursive: true });
+      (0, import_node_fs10.writeFileSync)(filePath, bytes);
+      return {
+        ok: true,
+        data: {
+          replay_id: replayId,
+          file_path: filePath,
+          bytes: bytes.length,
+          mime_type: res.headers.get("content-type") ?? "video/mp4",
+          download_url: `${baseUrl}${path6}`
+        }
+      };
+    } catch (err) {
+      return { ok: false, data: { error: err instanceof Error ? err.message : String(err) } };
+    }
+  }
+  const annotations = (title, readOnly = false) => ({
+    title,
+    readOnlyHint: readOnly,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: true
+  });
+  function normalizeLogin(conn) {
+    return {
+      connection_id: conn.connection_id ?? null,
+      domain: conn.domain,
+      status: conn.status,
+      account_email: conn.account_email ?? null,
+      note: conn.note ?? null,
+      watch_url: conn.connection_id && conn.status !== "AUTHENTICATED" ? `${consoleBase}/console/auth/${conn.connection_id}` : null,
+      last_connected_at: conn.last_connected_at ?? null
+    };
+  }
+  async function fetchConnectedLogins(profile) {
+    const list = await req("POST", "/agent/profiles/list", { profile });
+    return list.ok && Array.isArray(list.data?.connections) ? list.data.connections.map(normalizeLogin) : [];
+  }
+  server.registerTool(
+    "browser_profile_connect",
+    {
+      title: "Save a Site Login to a Profile",
+      description: `Save a logged-in browser session so this server can reuse a site the user is signed into (ChatGPT, Claude, Reddit, or any account-gated site). Returns an mcpscraper.dev watch_url \u2014 give it to the user, they sign in once, and the cookies are saved to a named profile for later browser_open calls. ONE profile holds MANY logins: call this again with the SAME profile and a DIFFERENT domain to stack another account (e.g. add claude.ai to a profile that already has chatgpt.com). Pass note to record what each login is. Side effects: opens a short-lived sign-in session and persists cookies to the profile; it does NOT import the user's existing browser cookies (they log in fresh). NOT for one-off scraping of public pages (use extract_url) and NOT a way to drive the browser (use browser_open). Sample asks: "save my ChatGPT login", "connect my Reddit account", "add my Claude login to the same profile". After the user signs in, poll browser_profile_list until the login reads AUTHENTICATED, then browser_open with the profile.`,
+      inputSchema: BrowserProfileConnectInputSchema,
+      outputSchema: BrowserProfileConnectOutputSchema,
+      annotations: annotations("Save a Site Login to a Profile")
+    },
+    async (input) => {
+      const domain = slugPart(input.domain) || "chatgpt.com";
+      const setupUrl = input.login_url ?? input.url ?? (domain === "chatgpt.com" ? "https://chatgpt.com/" : `https://${domain}/`);
+      const profile = input.profile?.trim() || savedProfileNameFromEmail(input.email) || browserServiceProfileName();
+      if (!profile) {
+        return errorResult("browser_profile_connect", {
+          error: "profile or email is required when BROWSER_AGENT_PROFILE_NAME is not available"
+        });
+      }
+      const accountEmail = input.email?.trim() || null;
+      const note = input.note?.trim() || null;
+      const open = await req("POST", "/agent/profiles/onboard", {
+        label: input.label ?? `Login setup: ${domain} \u2192 ${profile}`,
+        profile,
+        domain,
+        login_url: setupUrl,
+        ...accountEmail ? { account_email: accountEmail } : {},
+        ...note ? { note } : {}
+      });
+      if (!open.ok) return errorResult("browser_profile_connect", open.data);
+      const connectedLogins = await fetchConnectedLogins(profile).catch(() => []);
+      return structuredResult({
+        ok: true,
+        tool: "browser_profile_connect",
+        session_id: null,
+        auth_connection_id: open.data.connection_id,
+        watch_url: `${consoleBase}/console/auth/${open.data.connection_id}`,
+        live_view_url: null,
+        profile,
+        domain,
+        setup_url: setupUrl,
+        account_email: accountEmail,
+        note,
+        status: open.data.status ?? null,
+        flow_status: open.data.flow_status ?? null,
+        flow_step: open.data.flow_step ?? null,
+        flow_expires_at: open.data.flow_expires_at ?? null,
+        post_login_url: open.data.post_login_url ?? null,
+        connected_logins: connectedLogins,
+        next_steps: [
+          `Give the user watch_url so they can sign in to ${domain}.`,
+          "Poll browser_profile_list (with this profile) until the login reads AUTHENTICATED.",
+          "To add another account to this same profile, call browser_profile_connect again with the same profile and a different domain.",
+          "When authenticated, call browser_open with this profile to drive the logged-in session."
+        ],
+        raw: open.data
+      });
+    }
+  );
+  server.registerTool(
+    "browser_profile_list",
+    {
+      title: "List Saved Logins in a Profile",
+      description: `List every site login saved in a profile, each with its current auth status (NEEDS_AUTH / AUTHENTICATED), account email, and note. Use it to (1) see what a profile is connected to before opening a session, and (2) poll a just-saved login until it flips to AUTHENTICATED. Read-only, no cost. Pass profile (or email to derive it); narrow with domain or connection_id to poll a single login. Sample asks: "what's connected in my profile", "is my ChatGPT login ready yet", "which accounts are saved". Pairs with browser_profile_connect (which adds logins) and browser_open (which uses them).`,
+      inputSchema: BrowserProfileListInputSchema,
+      outputSchema: BrowserProfileListOutputSchema,
+      annotations: annotations("List Saved Logins in a Profile", true)
+    },
+    async (input) => {
+      const profile = input.profile?.trim() || savedProfileNameFromEmail(input.email) || browserServiceProfileName();
+      if (!profile) {
+        return errorResult("browser_profile_list", {
+          error: "profile or email is required when BROWSER_AGENT_PROFILE_NAME is not available"
+        });
+      }
+      const domain = slugPart(input.domain) || void 0;
+      const res = await req("POST", "/agent/profiles/list", {
+        profile,
+        ...domain ? { domain } : {},
+        ...input.connection_id ? { connection_id: input.connection_id } : {}
+      });
+      if (!res.ok) return errorResult("browser_profile_list", res.data);
+      const connections = (Array.isArray(res.data?.connections) ? res.data.connections : []).map(normalizeLogin);
+      return structuredResult({
+        ok: true,
+        tool: "browser_profile_list",
+        session_id: null,
+        profile,
+        connections,
+        count: connections.length
+      });
+    }
+  );
+  server.registerTool(
+    "browser_open",
+    {
+      title: "Open Browser Session",
+      description: "Open a direct no-proxy hosted browser session you can drive. Pass a saved profile name to load a session that is already logged into the sites saved in that profile (one profile can hold several logins). To set up or refresh a login first, use browser_profile_connect, then poll browser_profile_list until it reads AUTHENTICATED. Returns a session_id used by all other browser_* tools.",
+      inputSchema: BrowserOpenInputSchema,
+      outputSchema: BrowserOpenOutputSchema,
+      annotations: annotations("Open Browser Session")
+    },
+    async (input) => {
+      const profile = input.profile ?? browserServiceProfileName();
+      const saveProfileChanges = input.save_profile_changes ?? browserServiceProfileSaveChanges();
+      const open = await req("POST", "/agent/sessions", {
+        label: input.label,
+        ...profile ? { profile } : {},
+        ...profile && typeof saveProfileChanges === "boolean" ? { save_profile_changes: saveProfileChanges } : {},
+        disable_default_proxy: true,
+        timeout_seconds: input.timeout_seconds,
+        ...input.url ? { url: input.url } : {}
+      });
+      if (!open.ok) return errorResult("browser_open", open.data);
+      const session = open.data;
+      return structuredResult({
+        ok: true,
+        tool: "browser_open",
+        session_id: session.session_id,
+        watch_url: `${consoleBase}/console/${session.session_id}`,
+        live_view_url: null,
+        url: input.url ?? null,
+        hint: "Call browser_screenshot to see the page. Click by the x,y of an element from the snapshot.",
+        raw: session
+      });
+    }
+  );
+  server.registerTool(
+    "browser_screenshot",
+    {
+      title: "See Page (Screenshot + Elements)",
+      description: "Capture what the browser currently shows. Returns a screenshot image PLUS a text snapshot listing interactive elements with their center x,y coordinates, the page url and title, and visible text. This is your primary way to perceive the page. Click elements by their listed x,y. If a Cloudflare/CAPTCHA challenge is visible, wait and screenshot again rather than clicking it.",
+      inputSchema: BrowserSessionInputSchema,
+      outputSchema: BrowserScreenshotOutputSchema,
+      annotations: annotations("See Page", true)
+    },
+    async (input) => {
+      const res = await req("POST", `/agent/sessions/${input.session_id}/screenshot`);
+      if (!res.ok) return errorResult("browser_screenshot", res.data, input.session_id);
+      const { image_base64, mime_type, url, title, elements, text } = res.data;
+      const content = [];
+      if (image_base64) content.push({ type: "image", data: image_base64, mimeType: mime_type ?? "image/png" });
+      const structured = {
+        ok: true,
+        tool: "browser_screenshot",
+        session_id: input.session_id,
+        url: url ?? null,
+        title: title ?? null,
+        text: typeof text === "string" ? text : "",
+        elements: Array.isArray(elements) ? elements : [],
+        screenshot: image_base64 ? { mime_type: mime_type ?? "image/png", inline: true } : null
+      };
+      content.push({
+        type: "text",
+        text: JSON.stringify(structured)
+      });
+      return { content, structuredContent: structured };
+    }
+  );
+  server.registerTool(
+    "browser_read",
+    {
+      title: "Read Page Text + Elements",
+      description: "Return the page url, title, visible text, and the list of interactive elements (with x,y) without an image. Cheaper than browser_screenshot when you only need to read content or find a target element to click.",
+      inputSchema: BrowserSessionInputSchema,
+      outputSchema: BrowserReadOutputSchema,
+      annotations: annotations("Read Page", true)
+    },
+    async (input) => {
+      const res = await req("POST", `/agent/sessions/${input.session_id}/read`);
+      if (!res.ok) return errorResult("browser_read", res.data, input.session_id);
+      return structuredResult({
+        ok: true,
+        tool: "browser_read",
+        session_id: input.session_id,
+        url: res.data?.url ?? null,
+        title: res.data?.title ?? null,
+        text: typeof res.data?.text === "string" ? res.data.text : "",
+        elements: Array.isArray(res.data?.elements) ? res.data.elements : [],
+        raw: res.data
+      });
+    }
+  );
+  server.registerTool(
+    "browser_locate",
+    {
+      title: "Locate DOM Targets",
+      description: "Locate exact visible DOM elements or text ranges in the current browser viewport and return left/top/width/height bounds in screenshot pixels. Use this before drawing annotations or when a callout must literally circle, box, underline, or point to a real element. Prefer CSS selectors for exact UI elements; use text when selector is unknown. When a replay is actively recording, the result includes replay_elapsed_seconds for timing.",
+      inputSchema: BrowserLocateInputSchema,
+      outputSchema: BrowserLocateOutputSchema,
+      annotations: annotations("Locate DOM Targets", true)
+    },
+    async (input) => {
+      const res = await req("POST", `/agent/sessions/${input.session_id}/locate`, { targets: input.targets });
+      if (!res.ok) return errorResult("browser_locate", res.data, input.session_id);
+      return structuredResult({
+        ok: true,
+        tool: "browser_locate",
+        session_id: input.session_id,
+        url: res.data?.url ?? null,
+        title: res.data?.title ?? null,
+        viewport: res.data?.viewport ?? null,
+        replay: res.data?.replay ?? null,
+        targets: Array.isArray(res.data?.targets) ? res.data.targets : [],
+        raw: res.data
+      });
+    }
+  );
+  server.registerTool(
+    "browser_goto",
+    {
+      title: "Navigate To URL",
+      description: "Navigate an existing browser session to a URL when the user asks you to go to another page or continue browsing in the same session. Use browser_open first if no session exists. Follow with browser_screenshot to see redirects, login walls, CAPTCHA/Cloudflare state, or the loaded page.",
+      inputSchema: BrowserGotoInputSchema,
+      outputSchema: BrowserActionOutputSchema,
+      annotations: annotations("Navigate To URL")
+    },
+    async (input) => {
+      const res = await req("POST", `/agent/sessions/${input.session_id}/goto`, { url: input.url });
+      return actionResult("browser_goto", input.session_id, res.ok, res.data, "browser_screenshot");
+    }
+  );
+  server.registerTool(
+    "browser_click",
+    {
+      title: "Click",
+      description: "Click a visible page target using screenshot pixel coordinates. Use this when the user asks you to press a button, open a menu, choose a result, or activate a visible UI element. Use x/y only from the latest browser_screenshot, browser_read, or browser_locate result; do not guess coordinates. Follow with browser_screenshot when the click may change the page.",
+      inputSchema: BrowserClickInputSchema,
+      outputSchema: BrowserActionOutputSchema,
+      annotations: annotations("Click")
+    },
+    async (input) => {
+      const res = await req("POST", `/agent/sessions/${input.session_id}/click`, {
+        x: input.x,
+        y: input.y,
+        button: input.button,
+        num_clicks: input.num_clicks
+      });
+      return actionResult("browser_click", input.session_id, res.ok, res.data, "browser_screenshot");
+    }
+  );
+  server.registerTool(
+    "browser_type",
+    {
+      title: "Type Text",
+      description: 'Type text into the currently focused browser field. Use this when the user asks you to fill a search box, form field, login field, or editable text area. Click or Tab to the field first if focus is uncertain. Use browser_press with ["Return"] to submit, and browser_screenshot afterward when page state matters.',
+      inputSchema: BrowserTypeInputSchema,
+      outputSchema: BrowserActionOutputSchema,
+      annotations: annotations("Type Text")
+    },
+    async (input) => {
+      const res = await req("POST", `/agent/sessions/${input.session_id}/type`, { text: input.text, delay: input.delay });
+      return actionResult("browser_type", input.session_id, res.ok, res.data, "browser_screenshot");
+    }
+  );
+  server.registerTool(
+    "browser_scroll",
+    {
+      title: "Scroll",
+      description: "Scroll the page to reveal more content before reading, clicking, or locating elements. Positive delta_y scrolls down; negative delta_y scrolls up. Follow with browser_screenshot or browser_read to inspect newly revealed content.",
+      inputSchema: BrowserScrollInputSchema,
+      outputSchema: BrowserActionOutputSchema,
+      annotations: annotations("Scroll")
+    },
+    async (input) => {
+      const res = await req("POST", `/agent/sessions/${input.session_id}/scroll`, {
+        delta_y: input.delta_y,
+        delta_x: input.delta_x,
+        x: input.x,
+        y: input.y
+      });
+      return actionResult("browser_scroll", input.session_id, res.ok, res.data, "browser_screenshot");
+    }
+  );
+  server.registerTool(
+    "browser_press",
+    {
+      title: "Press Keys",
+      description: 'Press keyboard keys or combinations in the active browser session. Use this for submit, Escape, Tab navigation, select-all, or keyboard shortcuts. Examples: ["Return"], ["Escape"], ["Tab"], ["Ctrl+a"], ["Ctrl+Shift+Tab"]. Use browser_type for text entry and browser_screenshot after keypresses that may change the page.',
+      inputSchema: BrowserPressInputSchema,
+      outputSchema: BrowserActionOutputSchema,
+      annotations: annotations("Press Keys")
+    },
+    async (input) => {
+      const res = await req("POST", `/agent/sessions/${input.session_id}/press`, { keys: input.keys });
+      return actionResult("browser_press", input.session_id, res.ok, res.data, "browser_screenshot");
+    }
+  );
+  server.registerTool(
+    "browser_replay_start",
+    {
+      title: "Start Recording",
+      description: "Start recording an MP4 replay of the session. Returns replay_id, view_url when available, and a download_url. Use to capture a task for later review; stop with browser_replay_stop.",
+      inputSchema: BrowserSessionInputSchema,
+      outputSchema: BrowserReplayStartOutputSchema,
+      annotations: annotations("Start Recording")
+    },
+    async (input) => {
+      const res = await req("POST", `/agent/sessions/${input.session_id}/replay/start`);
+      if (!res.ok) return errorResult("browser_replay_start", res.data, input.session_id);
+      return structuredResult({
+        ok: true,
+        tool: "browser_replay_start",
+        session_id: input.session_id,
+        replay_id: res.data?.replay_id ?? res.data?.replayId ?? null,
+        view_url: res.data?.view_url ?? res.data?.viewUrl ?? null,
+        download_url: res.data?.download_url ?? res.data?.downloadUrl ?? null,
+        raw: res.data
+      });
+    }
+  );
+  server.registerTool(
+    "browser_replay_stop",
+    {
+      title: "Stop Recording",
+      description: "Stop a replay recording and expose the final view_url and download_url. Use browser_replay_download to save the MP4 to the configured output directory.",
+      inputSchema: BrowserReplayStopInputSchema,
+      outputSchema: BrowserReplayStopOutputSchema,
+      annotations: annotations("Stop Recording")
+    },
+    async (input) => {
+      const res = await req("POST", `/agent/sessions/${input.session_id}/replay/stop`, { replay_id: input.replay_id });
+      if (!res.ok) return errorResult("browser_replay_stop", res.data, input.session_id, input.replay_id);
+      return structuredResult({
+        ok: true,
+        tool: "browser_replay_stop",
+        session_id: input.session_id,
+        replay_id: res.data?.replay_id ?? res.data?.replayId ?? input.replay_id,
+        view_url: res.data?.view_url ?? res.data?.viewUrl ?? null,
+        download_url: res.data?.download_url ?? res.data?.downloadUrl ?? null,
+        raw: res.data
+      });
+    }
+  );
+  server.registerTool(
+    "browser_list_replays",
+    {
+      title: "List Replay Videos",
+      description: "List replay recordings for a browser session, including final view_url and authenticated download_url values when available.",
+      inputSchema: BrowserSessionInputSchema,
+      outputSchema: BrowserListReplaysOutputSchema,
+      annotations: annotations("List Replay Videos", true)
+    },
+    async (input) => {
+      const res = await req("GET", `/agent/sessions/${input.session_id}/replays`);
+      if (!res.ok) return errorResult("browser_list_replays", res.data, input.session_id);
+      const replays = Array.isArray(res.data?.replays) ? res.data.replays : [];
+      return structuredResult({
+        ok: true,
+        tool: "browser_list_replays",
+        session_id: input.session_id,
+        replays,
+        count: replays.length
+      });
+    }
+  );
+  server.registerTool(
+    "browser_replay_download",
+    {
+      title: "Download Replay MP4",
+      description: "Download a replay recording through MCP Scraper and save the MP4 under MCP_SCRAPER_OUTPUT_DIR/browser-replays. Use after browser_replay_stop or browser_list_replays.",
+      inputSchema: BrowserReplayDownloadInputSchema,
+      outputSchema: BrowserReplayDownloadOutputSchema,
+      annotations: annotations("Download Replay MP4")
+    },
+    async (input) => {
+      const res = await downloadReplay(input.session_id, input.replay_id, input.filename);
+      if (!res.ok) return errorResult("browser_replay_download", res.data, input.session_id, input.replay_id);
+      return structuredResult({
+        ok: true,
+        tool: "browser_replay_download",
+        session_id: input.session_id,
+        replay_id: input.replay_id,
+        file_path: res.data?.file_path ?? null,
+        bytes: typeof res.data?.bytes === "number" ? res.data.bytes : null,
+        mime_type: res.data?.mime_type ?? null,
+        download_url: res.data?.download_url ?? null
+      });
+    }
+  );
+  server.registerTool(
+    "browser_replay_mark",
+    {
+      title: "Mark Replay Annotation",
+      description: "While a replay is actively recording, locate one exact DOM target and return a ready-to-use annotation object with DOM bounds and replay-relative timing. Use this instead of guessing start_seconds or drawing rough rectangles. Workflow: start browser_replay_start, navigate until the target is visible and stable, call browser_replay_mark for each callout, then stop the replay and pass the returned annotations to browser_replay_annotate.",
+      inputSchema: BrowserReplayMarkInputSchema,
+      outputSchema: BrowserReplayMarkOutputSchema,
+      annotations: annotations("Mark Replay Annotation", true)
+    },
+    async (input) => {
+      const res = await req("POST", `/agent/sessions/${input.session_id}/locate`, { targets: [input.target] });
+      if (!res.ok) return errorResult("browser_replay_mark", res.data, input.session_id);
+      const target = res.data?.targets?.[0];
+      const element = target?.element;
+      const elapsed = res.data?.replay?.replay_elapsed_seconds;
+      if (!target?.found || !element) {
+        return errorResult("browser_replay_mark", { error: target?.error ?? "target not found in current viewport", target }, input.session_id);
+      }
+      if (!finiteNumber2(elapsed)) {
+        return errorResult("browser_replay_mark", { error: "no active replay clock found; call browser_replay_start before browser_replay_mark" }, input.session_id);
+      }
+      const padded = expandElementBounds(element, res.data?.viewport, input.padding ?? 8);
+      const start = Math.max(0, elapsed + (input.start_offset_seconds ?? -0.25));
+      const duration = input.duration_seconds ?? 4;
+      const annotation = {
+        type: input.type ?? "box",
+        start_seconds: Number(start.toFixed(3)),
+        end_seconds: Number((start + duration).toFixed(3)),
+        left: Math.round(padded.left),
+        top: Math.round(padded.top),
+        width: Math.round(padded.width),
+        height: Math.round(padded.height),
+        ...input.label ? { label: input.label } : {},
+        ...input.color ? { color: input.color } : {},
+        ...input.thickness ? { thickness: input.thickness } : {}
+      };
+      return structuredResult({
+        ok: true,
+        tool: "browser_replay_mark",
+        session_id: input.session_id,
+        replay_id: res.data?.replay?.replay_id ?? res.data?.replay?.replayId ?? null,
+        annotation,
+        source_width: padded.sourceWidth,
+        source_height: padded.sourceHeight,
+        replay: res.data.replay,
+        target,
+        hint: "Append annotation to your annotations array. Use source_width/source_height with browser_replay_annotate."
+      });
+    }
+  );
+  server.registerTool(
+    "browser_replay_annotate",
+    {
+      title: "Annotate Replay MP4",
+      description: "Download a browser replay MP4, render visual annotations over it, and save a new annotated MP4 under MCP_SCRAPER_OUTPUT_DIR/browser-replays. Use this after browser_replay_stop when the user wants proof videos with circles, boxes, arrows, underlines, or labels. For accurate timing and placement, prefer annotations returned by browser_replay_mark while the replay is recording; otherwise use exact left/top/width/height bounds from browser_locate. If the replay video size differs from the screenshot coordinate space, pass source_width and source_height.",
+      inputSchema: BrowserReplayAnnotateInputSchema,
+      outputSchema: BrowserReplayAnnotateOutputSchema,
+      annotations: annotations("Annotate Replay MP4")
+    },
+    async (input) => {
+      const sourceName = input.filename ? `${input.filename}-source` : void 0;
+      const downloaded = await downloadReplay(input.session_id, input.replay_id, sourceName);
+      if (!downloaded.ok) return errorResult("browser_replay_annotate", downloaded.data, input.session_id, input.replay_id);
+      try {
+        const sourcePath = String(downloaded.data.file_path);
+        const outputPath = annotatedReplayFilePath(input.session_id, input.replay_id, input.filename);
+        (0, import_node_fs10.mkdirSync)((0, import_node_path14.join)(outputBaseDir4(), "browser-replays"), { recursive: true });
+        const result = await annotateReplayVideo(sourcePath, outputPath, {
+          annotations: input.annotations,
+          sourceWidth: input.source_width,
+          sourceHeight: input.source_height,
+          sourceLeftOffset: input.source_left_offset,
+          sourceTopOffset: input.source_top_offset
+        });
+        return structuredResult({
+          ok: true,
+          tool: "browser_replay_annotate",
+          session_id: input.session_id,
+          replay_id: input.replay_id,
+          source_file_path: sourcePath,
+          annotated_file_path: result.filePath,
+          bytes: result.bytes,
+          width: result.width,
+          height: result.height,
+          annotation_count: result.annotationCount,
+          mime_type: "video/mp4"
+        });
+      } catch (err) {
+        return errorResult("browser_replay_annotate", { error: err instanceof Error ? err.message : String(err) }, input.session_id, input.replay_id);
+      }
+    }
+  );
+  server.registerTool(
+    "browser_close",
+    {
+      title: "Close Browser Session",
+      description: "Close and release a browser session when the task is done, when the user asks to stop the browser, or when active browser billing should end. Use browser_list_sessions first if you need to recover the session_id.",
+      inputSchema: BrowserSessionInputSchema,
+      outputSchema: BrowserCloseOutputSchema,
+      annotations: { title: "Close Browser Session", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }
+    },
+    async (input) => {
+      const res = await req("DELETE", `/agent/sessions/${input.session_id}`);
+      if (!res.ok) return errorResult("browser_close", res.data, input.session_id);
+      return structuredResult({
+        ok: true,
+        tool: "browser_close",
+        session_id: input.session_id,
+        closed: true,
+        raw: res.data
+      });
+    }
+  );
+  server.registerTool(
+    "browser_list_sessions",
+    {
+      title: "List Browser Sessions",
+      description: "List browser sessions and their status, with a watch_url for each. Use this to recover a session_id, find an active browser, or decide which session to close. Use browser_open to create a new session.",
+      inputSchema: BrowserListInputSchema,
+      outputSchema: BrowserListSessionsOutputSchema,
+      annotations: annotations("List Browser Sessions", true)
+    },
+    async (input) => {
+      const res = await req("GET", `/agent/sessions${input.include_closed ? "?all=1" : ""}`);
+      if (!res.ok) return errorResult("browser_list_sessions", res.data);
+      const sessions = (res.data.sessions ?? []).map((s) => ({ ...s, watch_url: `${consoleBase}/console/${s.session_id}` }));
+      return structuredResult({
+        ok: true,
+        tool: "browser_list_sessions",
+        session_id: null,
+        sessions,
+        count: sessions.length
+      });
+    }
+  );
+  server.registerTool(
+    "query_fanout_workflow",
+    {
+      title: "Capture AI Search Fan-Out",
+      description: `Capture the query fan-out behind a ChatGPT or Claude web-search answer for Answer Engine Optimization (AEO): the exact sub-queries the model issued, every researched URL split into cited vs browsed-only (with citation frequency and snippet), each source tagged by category (First-party/vendor, News/media, Reddit, Social/video, Encyclopedia, Review site, Docs, Blog), plus top sourced sites and citation order. Set export=true for durable JSON, CSV, TSV, and HTML artifacts; export paths are returned relative to MCP_SCRAPER_OUTPUT_DIR. This returns the raw structured data; YOU analyze it \u2014 classify each sub-query by funnel stage (Problem-aware, Solution-aware, Decision-aware, Retention) and type (BoFu, Branded, Comparison, How-to, Search operator), name the brands the model researched, and give AEO insights. Sample asks: "capture the fan-out for this ChatGPT answer", "what did Claude search and cite for best CRM", "show the sub-queries and sources behind this AI answer". WRITE NOTE: passing prompt submits a real message in the user's logged-in account (a new conversation turn) \u2014 only send when the user wants that; omit prompt to capture a prompt the user just ran. Setup, if not already connected or if the profile disconnected: call browser_profile_connect, give the user the watch_url, let them complete login, then poll browser_profile_list until status is AUTHENTICATED. After that, browser_open the saved direct no-proxy profile and go to chatgpt.com or claude.ai. Fan-out is captured only as it streams, so the session must be open when the prompt runs. NOT for Google AI Overview citations \u2014 use harvest_paa for those; this tool is ChatGPT and Claude only.`,
+      inputSchema: BrowserCaptureFanoutInputSchema,
+      outputSchema: BrowserCaptureFanoutOutputSchema,
+      annotations: annotations("Capture AI Search Fan-Out")
+    },
+    async (input) => {
+      const emit = (result, exports3) => structuredResult({
+        ok: true,
+        tool: "query_fanout_workflow",
+        session_id: input.session_id,
+        platform: result.platform,
+        captured_at: result.capturedAt,
+        prompt: result.prompt,
+        meta: result.meta,
+        queries: result.queries,
+        browsed_urls: result.browsedUrls,
+        cited_urls: result.citedUrls,
+        browsed_only: result.browsedOnly,
+        snippets: result.snippets,
+        counts: result.counts,
+        aggregates: result.aggregates,
+        first_party_domain: result.firstPartyDomain,
+        exports: exports3 ?? null,
+        ...result.debug ? { debug: result.debug } : {}
+      });
+      const res = await req("POST", `/agent/sessions/${input.session_id}/capture-fanout`, {
+        prompt: input.prompt,
+        wait_ms: input.wait_ms,
+        first_party_domain: input.first_party_domain,
+        reset: input.reset,
+        export: input.export
+      }, Math.max(timeoutMs, (input.wait_ms ?? (input.prompt ? 9e4 : 8e3)) + 3e4));
+      if (!res.ok) return errorResult("query_fanout_workflow", res.data, input.session_id);
+      const hosted = res.data?.result ?? res.data;
+      let exports2 = res.data?.exports ?? null;
+      if (input.export && !exports2 && isEnrichedFanout(hosted)) {
+        try {
+          exports2 = exportFanout(hosted);
+        } catch (err) {
+          return errorResult(
+            "query_fanout_workflow",
+            {
+              error: `Fan-out captured but local export failed: ${err instanceof Error ? err.message : String(err)}`,
+              result: hosted
+            },
+            input.session_id
+          );
+        }
+      }
+      return emit(hosted, exports2);
+    }
+  );
+}
+var import_mcp2, import_node_fs10, import_node_os9, import_node_path14;
+var init_browser_agent_mcp_server = __esm({
+  "src/mcp/browser-agent-mcp-server.ts"() {
+    "use strict";
+    import_mcp2 = require("@modelcontextprotocol/sdk/server/mcp.js");
+    import_node_fs10 = require("fs");
+    import_node_os9 = require("os");
+    import_node_path14 = require("path");
+    init_browser_service_env();
+    init_export();
+    init_version();
+    init_browser_agent_tool_schemas();
+    init_replay_annotator();
+    init_outbound_sanitize();
+  }
+});
+
+// src/mcp/mcp-oauth.ts
+function oauthIssuer() {
+  return (process.env.OAUTH_ISSUER ?? "https://mcpscraper.dev").replace(/\/$/, "");
+}
+function oauthResourceUrl() {
+  return (process.env.MCP_SCRAPER_RESOURCE_URL ?? "https://mcpscraper.dev/mcp").replace(/\/$/, "");
+}
+function oauthResourceBaseUrl() {
+  return (process.env.OAUTH_RS_BASE_URL ?? "https://mcpscraper.dev").replace(/\/$/, "");
+}
+function protectedResourceMetadata() {
+  return {
+    resource: oauthResourceUrl(),
+    authorization_servers: [oauthIssuer()],
+    scopes_supported: ["scraper.use"],
+    bearer_methods_supported: ["header"]
+  };
+}
+function wwwAuthenticateValue() {
+  return `Bearer resource_metadata="${oauthResourceBaseUrl()}/.well-known/oauth-protected-resource"`;
+}
+function isBearerJwt(token) {
+  return !token.startsWith("sk_") && token.split(".").length === 3;
+}
+function getJwks() {
+  if (jwksSingleton) return jwksSingleton;
+  jwksSingleton = (0, import_jose.createRemoteJWKSet)(new URL(`${oauthIssuer()}/.well-known/jwks.json`));
+  return jwksSingleton;
+}
+async function verifyScraperOAuthJwt(token) {
+  const { payload } = await (0, import_jose.jwtVerify)(token, getJwks(), {
+    issuer: oauthIssuer(),
+    audience: oauthResourceUrl()
+  });
+  return payload;
+}
+var import_jose, jwksSingleton;
+var init_mcp_oauth = __esm({
+  "src/mcp/mcp-oauth.ts"() {
+    "use strict";
+    import_jose = require("jose");
+    jwksSingleton = null;
+  }
+});
+
+// src/mcp/mcp-routes.ts
+function mcpAuthError(message = "authentication required") {
+  const body = JSON.stringify({
+    jsonrpc: "2.0",
+    id: null,
+    error: {
+      code: -32001,
+      message
+    }
+  });
+  return new Response(body, {
+    status: 401,
+    headers: {
+      "Content-Type": "application/json",
+      "WWW-Authenticate": wwwAuthenticateValue()
+    }
+  });
+}
+async function requireMcpCallerKey(c) {
+  const xApiKey = c.req.header("x-api-key")?.trim();
+  const authHeader = c.req.header("Authorization")?.trim();
+  const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7).trim() : void 0;
+  if (!xApiKey && bearerToken && isBearerJwt(bearerToken)) {
+    let identity;
+    try {
+      const payload = await verifyScraperOAuthJwt(bearerToken);
+      identity = typeof payload.sub === "string" ? payload.sub : "";
+    } catch {
+      return mcpAuthError("Bearer token is invalid or expired");
+    }
+    if (!identity) return mcpAuthError("Bearer token has no subject");
+    const user2 = await getUserByEmail(identity);
+    if (!user2 || !user2.api_key || user2.key_active !== 1) return mcpAuthError("No active MCP Scraper account for this identity");
+    return user2.api_key;
+  }
+  const callerKey = xApiKey ?? bearerToken;
+  if (!callerKey) return mcpAuthError();
+  const user = await getUserByApiKey(callerKey);
+  if (!user) return mcpAuthError();
+  return callerKey;
+}
+function registerSerpIntelligenceCaptureTools(server, executor) {
   server.registerTool("capture_serp_snapshot", {
     title: "SERP Intelligence Snapshot",
     description: "Capture a structured SERP Intelligence Google snapshot through POST /serp-intelligence/capture, the same product capture path used by Phoenix. Split query from location and infer gl/hl. Routing is automatic \u2014 leave proxyMode unset. Set debug true when investigating location evidence, proxy behavior, CAPTCHA, or capture reliability.",
@@ -26725,6 +28269,7 @@ var init_mcp_routes = __esm({
     import_webStandardStreamableHttp = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
     init_paa_mcp_server();
     init_http_mcp_tool_executor();
+    init_browser_agent_mcp_server();
     init_mcp_response_formatter();
     init_db();
     init_mcp_oauth();
@@ -26742,8 +28287,10 @@ var init_mcp_routes = __esm({
           sessionIdGenerator: void 0,
           enableJsonResponse: true
         });
+        const consoleBaseUrl = process.env.BROWSER_AGENT_CONSOLE_URL?.trim() || baseUrl;
         const server = buildPaaExtractorMcpServer(executor, { savesReportsLocally: false });
         registerSerpIntelligenceCaptureTools(server, executor);
+        registerBrowserAgentMcpTools(server, { baseUrl, apiKey: callerKey, consoleBaseUrl });
         await server.connect(transport);
         return transport.handleRequest(c.req.raw);
       } catch {
@@ -27595,200 +29142,65 @@ var init_build = __esm({
 
 // src/services/fanout/classify.ts
 function classifyDomain(domain, firstPartyDomain) {
-  const d = domain.toLowerCase().replace(/^www\./, "");
-  if (firstPartyDomain) {
-    const fp = firstPartyDomain.toLowerCase().replace(/^www\./, "");
-    if (fp && (d === fp || d.endsWith("." + fp))) return "First-party/vendor";
-  }
-  if (/(^|\.)reddit\.com$/i.test(d)) return "Reddit";
-  if (SOCIAL.test(d)) return "Social/video";
-  if (ENCYCLOPEDIA.test(d)) return "Encyclopedia";
-  if (REVIEW.test(d)) return "Review site";
-  if (NEWS.test(d) || /(^|\.)news\./i.test(d)) return "News/media";
-  if (/^docs?\.|^developer\.|^developers\.|readthedocs|\.dev$/i.test(d)) return "Docs";
-  return "Blog";
-}
-function emptyCategoryCounts() {
-  return { "First-party/vendor": 0, "News/media": 0, Reddit: 0, "Social/video": 0, Encyclopedia: 0, "Review site": 0, Docs: 0, Blog: 0 };
-}
-function enrichFanout(result, opts = {}) {
-  const addSiteType = (s) => ({ ...s, siteType: classifyDomain(s.domain, opts.firstPartyDomain) });
-  const browsedUrls = result.browsedUrls.map(addSiteType);
-  const citedUrls = result.citedUrls.map(addSiteType);
-  const browsedOnly = result.browsedOnly.map(addSiteType);
-  const byCategory = emptyCategoryCounts();
-  const domainAgg = /* @__PURE__ */ new Map();
-  for (const s of browsedUrls) {
-    byCategory[s.siteType]++;
-    const cur = domainAgg.get(s.domain);
-    if (!cur) domainAgg.set(s.domain, { domain: s.domain, count: 1, cited: s.cited, timesCited: s.timesCited, siteType: s.siteType });
-    else {
-      cur.count++;
-      cur.cited = cur.cited || s.cited;
-      cur.timesCited += s.timesCited;
-    }
-  }
-  const topSites = [...domainAgg.values()].sort((a, b) => b.count - a.count || b.timesCited - a.timesCited);
-  const citationOrder = citedUrls.slice().sort((a, b) => b.timesCited - a.timesCited).map((s, i) => ({ rank: i + 1, domain: s.domain, url: s.url, timesCited: s.timesCited }));
-  return {
-    platform: result.platform,
-    capturedAt: result.capturedAt,
-    prompt: result.prompt,
-    meta: result.meta,
-    queries: result.subQueries,
-    browsedUrls,
-    citedUrls,
-    browsedOnly,
-    snippets: result.snippets,
-    counts: result.counts,
-    aggregates: { topSites, citationOrder, byCategory },
-    firstPartyDomain: opts.firstPartyDomain ? opts.firstPartyDomain.toLowerCase().replace(/^www\./, "") : null,
-    ...result.debug ? { debug: result.debug } : {}
-  };
-}
-var SOCIAL, ENCYCLOPEDIA, REVIEW, NEWS;
-var init_classify = __esm({
-  "src/services/fanout/classify.ts"() {
-    "use strict";
-    SOCIAL = /(^|\.)(youtube\.com|youtu\.be|instagram\.com|tiktok\.com|facebook\.com|fb\.com|x\.com|twitter\.com|linkedin\.com|pinterest\.com|threads\.net|vimeo\.com)$/i;
-    ENCYCLOPEDIA = /(^|\.)(wikipedia\.org|wikimedia\.org|britannica\.com|merriam-webster\.com|dictionary\.com|fandom\.com|investopedia\.com)$/i;
-    REVIEW = /(^|\.)(yelp\.com|trustpilot\.com|g2\.com|capterra\.com|angi\.com|angieslist\.com|bbb\.org|consumeraffairs\.com|bestcompany\.com|sitejabber\.com|clutch\.co|bestpickreports\.com|homeguide\.com|porch\.com|ontoplist\.com|thumbtack\.com)$/i;
-    NEWS = /(^|\.)(reuters\.com|apnews\.com|nytimes\.com|wsj\.com|washingtonpost\.com|bloomberg\.com|cnbc\.com|forbes\.com|bbc\.com|theguardian\.com|cnn\.com|npr\.org|usatoday\.com|expressnews\.com|mysanantonio\.com|beaumontenterprise\.com)$/i;
-  }
-});
-
-// src/services/fanout/export.ts
-function outputBaseDir3() {
-  return process.env.MCP_SCRAPER_OUTPUT_DIR?.trim() || (0, import_node_path12.join)((0, import_node_os7.homedir)(), "Downloads", "mcp-scraper");
-}
-function safe(value) {
-  return value.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80) || "capture";
-}
-function writeTable(path6, rows, delimiter) {
-  (0, import_node_fs9.writeFileSync)(path6, import_papaparse3.default.unparse(rows.length ? rows : [{}], { delimiter }));
-}
-function exportFanout(enriched) {
-  const stamp = safe(enriched.capturedAt.replace(/[:.]/g, "-"));
-  const outputDir = outputBaseDir3();
-  const relativeDir = (0, import_node_path12.join)("fanout", `${stamp}-${safe(enriched.platform)}`);
-  const dir = (0, import_node_path12.join)(outputDir, relativeDir);
-  (0, import_node_fs9.mkdirSync)(dir, { recursive: true });
-  const queryRows = enriched.queries.map((q, i) => ({ index: i + 1, query: q }));
-  const citationRows = enriched.aggregates.citationOrder.map((c) => {
-    const src = enriched.citedUrls.find((s) => s.url === c.url);
-    return { rank: c.rank, domain: c.domain, url: c.url, timesCited: c.timesCited, siteType: src?.siteType ?? "", title: src?.title ?? "" };
-  });
-  const sourceRows2 = enriched.browsedUrls.map((s) => ({ domain: s.domain, url: s.url, cited: s.cited, timesCited: s.timesCited, siteType: s.siteType, title: s.title, round: s.round ?? "" }));
-  const browsedOnlyRows = enriched.browsedOnly.map((s) => ({ domain: s.domain, url: s.url, cited: s.cited, timesCited: s.timesCited, siteType: s.siteType, title: s.title, round: s.round ?? "" }));
-  const snippetRows = enriched.snippets.map((s) => ({ domain: s.domain, url: s.url, title: s.title, text: s.text }));
-  const domainRows = enriched.aggregates.topSites.map((d) => ({ domain: d.domain, count: d.count, cited: d.cited, timesCited: d.timesCited, siteType: d.siteType }));
-  const relativePaths = {
-    relativeTo: "MCP_SCRAPER_OUTPUT_DIR or ~/Downloads/mcp-scraper",
-    dir: relativeDir,
-    json: (0, import_node_path12.join)(relativeDir, "fanout.json"),
-    queriesCsv: (0, import_node_path12.join)(relativeDir, "queries.csv"),
-    queriesTsv: (0, import_node_path12.join)(relativeDir, "queries.tsv"),
-    citationsCsv: (0, import_node_path12.join)(relativeDir, "citations.csv"),
-    sourcesCsv: (0, import_node_path12.join)(relativeDir, "sources.csv"),
-    browsedOnlyCsv: (0, import_node_path12.join)(relativeDir, "browsed-only.csv"),
-    snippetsCsv: (0, import_node_path12.join)(relativeDir, "snippets.csv"),
-    domainsCsv: (0, import_node_path12.join)(relativeDir, "domains.csv"),
-    report: (0, import_node_path12.join)(relativeDir, "report.html")
-  };
-  (0, import_node_fs9.writeFileSync)((0, import_node_path12.join)(outputDir, relativePaths.json), JSON.stringify(enriched, null, 2));
-  writeTable((0, import_node_path12.join)(outputDir, relativePaths.queriesCsv), queryRows, ",");
-  writeTable((0, import_node_path12.join)(outputDir, relativePaths.queriesTsv), queryRows, "	");
-  writeTable((0, import_node_path12.join)(outputDir, relativePaths.citationsCsv), citationRows, ",");
-  writeTable((0, import_node_path12.join)(outputDir, relativePaths.sourcesCsv), sourceRows2, ",");
-  writeTable((0, import_node_path12.join)(outputDir, relativePaths.browsedOnlyCsv), browsedOnlyRows, ",");
-  writeTable((0, import_node_path12.join)(outputDir, relativePaths.snippetsCsv), snippetRows, ",");
-  writeTable((0, import_node_path12.join)(outputDir, relativePaths.domainsCsv), domainRows, ",");
-  (0, import_node_fs9.writeFileSync)((0, import_node_path12.join)(outputDir, relativePaths.report), renderReportHtml(enriched));
-  return relativePaths;
+  const d = domain.toLowerCase().replace(/^www\./, "");
+  if (firstPartyDomain) {
+    const fp = firstPartyDomain.toLowerCase().replace(/^www\./, "");
+    if (fp && (d === fp || d.endsWith("." + fp))) return "First-party/vendor";
+  }
+  if (/(^|\.)reddit\.com$/i.test(d)) return "Reddit";
+  if (SOCIAL.test(d)) return "Social/video";
+  if (ENCYCLOPEDIA.test(d)) return "Encyclopedia";
+  if (REVIEW.test(d)) return "Review site";
+  if (NEWS.test(d) || /(^|\.)news\./i.test(d)) return "News/media";
+  if (/^docs?\.|^developer\.|^developers\.|readthedocs|\.dev$/i.test(d)) return "Docs";
+  return "Blog";
 }
-function esc(s) {
-  return String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function emptyCategoryCounts() {
+  return { "First-party/vendor": 0, "News/media": 0, Reddit: 0, "Social/video": 0, Encyclopedia: 0, "Review site": 0, Docs: 0, Blog: 0 };
 }
-function renderReportHtml(enriched) {
-  const data = JSON.stringify(enriched).replace(/</g, "\\u003c");
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>AI Search Fan-Out \u2014 ${esc(enriched.platform)}</title>
-<style>
-:root{--bg:#0b0d12;--panel:#151922;--line:#252b38;--ink:#e8ecf3;--mut:#8b95a7;--acc:#5b9dff;--cite:#39d98a;--browse:#5a6677}
-*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink);font:14px/1.5 -apple-system,BlinkMacSystemFont,Segoe UI,Roboto,sans-serif}
-.wrap{max-width:980px;margin:0 auto;padding:28px 20px 80px}
-h1{font-size:20px;margin:0 0 2px}.sub{color:var(--mut);margin:0 0 20px;font-size:13px}
-.stat{font-size:30px;font-weight:700}.stat small{font-size:13px;font-weight:400;color:var(--mut)}
-.cards{display:grid;grid-template-columns:repeat(4,1fr);gap:10px;margin:18px 0}
-.card{background:var(--panel);border:1px solid var(--line);border-radius:10px;padding:12px 14px}
-.card b{font-size:22px;display:block}.card span{color:var(--mut);font-size:12px}
-.bars{margin:8px 0 22px}.bar{display:flex;align-items:center;gap:8px;margin:4px 0}
-.bar .lab{width:150px;color:var(--mut);font-size:12px;text-align:right}.bar .track{flex:1;background:#10141c;border-radius:5px;overflow:hidden}
-.bar .fill{background:var(--acc);height:16px}.bar .n{width:34px;font-size:12px;color:var(--mut)}
-.tabs{display:flex;gap:8px;margin:22px 0 12px}.tab{background:var(--panel);border:1px solid var(--line);color:var(--ink);padding:7px 14px;border-radius:8px;cursor:pointer}
-.tab.on{background:var(--acc);border-color:var(--acc);color:#04101f;font-weight:600}
-.chips{display:flex;flex-wrap:wrap;gap:6px;margin-bottom:12px}
-.chip{background:var(--panel);border:1px solid var(--line);color:var(--mut);padding:4px 10px;border-radius:20px;cursor:pointer;font-size:12px}
-.chip.on{border-color:var(--acc);color:var(--ink)}.chip b{color:var(--ink)}
-.row{background:var(--panel);border:1px solid var(--line);border-radius:8px;padding:10px 12px;margin:6px 0;display:flex;gap:10px;align-items:flex-start}
-.row .idx{color:var(--mut);min-width:22px}.row .main{flex:1}
-.tag{font-size:11px;padding:2px 7px;border-radius:6px;border:1px solid var(--line);color:var(--mut);margin-right:5px}
-.dom{font-weight:600}.url{color:var(--mut);font-size:12px;word-break:break-all}
-.pill{font-size:11px;padding:2px 7px;border-radius:6px}.pill.cite{background:rgba(57,217,138,.15);color:var(--cite)}.pill.brow{background:rgba(90,102,119,.2);color:#aeb8c8}
-.copy{background:none;border:1px solid var(--line);color:var(--mut);border-radius:6px;cursor:pointer;font-size:11px;padding:2px 8px}
-.hide{display:none}
-</style>
-</head>
-<body><div class="wrap">
-<h1>AI Search Fan-Out</h1>
-<p class="sub" id="sub"></p>
-<div class="stat" id="stat"></div>
-<div class="cards" id="cards"></div>
-<div id="charts"></div>
-<div class="tabs"><button class="tab on" data-tab="q">Queries</button><button class="tab" data-tab="u">URLs</button></div>
-<div class="chips" id="chips"></div>
-<div id="list"></div>
-</div>
-<script>
-const D=${data};
-const el=(t,c,h)=>{const e=document.createElement(t);if(c)e.className=c;if(h!=null)e.innerHTML=h;return e};
-document.getElementById('sub').textContent=D.platform+' \xB7 '+(D.meta.model||'model n/a')+' \xB7 '+D.meta.rounds+' search round(s) \xB7 prompt: '+(D.prompt||'');
-document.getElementById('stat').innerHTML='Total Fan-Out: '+D.counts.subQueries+' <small>sub-queries \xB7 '+D.counts.browsed+' URLs researched \xB7 '+D.counts.cited+' cited</small>';
-const cards=[['Sub-queries',D.counts.subQueries],['Researched',D.counts.browsed],['Cited',D.counts.cited],['Browsed-only',D.counts.browsedOnly]];
-const cc=document.getElementById('cards');cards.forEach(([k,v])=>{const c=el('div','card');c.appendChild(el('b',null,v));c.appendChild(el('span',null,k));cc.appendChild(c)});
-function barChart(title,obj){const max=Math.max(1,...Object.values(obj));const box=el('div','bars');box.appendChild(el('div',null,'<b>'+title+'</b>'));Object.entries(obj).forEach(([k,v])=>{const r=el('div','bar');r.appendChild(el('div','lab',k));const t=el('div','track');const f=el('div','fill');f.style.width=(v/max*100)+'%';t.appendChild(f);r.appendChild(t);r.appendChild(el('div','n',v));box.appendChild(r)});return box}
-const charts=document.getElementById('charts');
-charts.appendChild(barChart('URL Categories',D.aggregates.byCategory));
-let tab='q',filter=null;
-const chips=document.getElementById('chips'),list=document.getElementById('list');
-function render(){
-  chips.innerHTML='';list.innerHTML='';
-  if(tab==='q'){
-    D.queries.forEach((q,i)=>{const r=el('div','row');r.appendChild(el('div','idx',i+1));const m=el('div','main');m.appendChild(el('div',null,esc(q)));r.appendChild(m);const b=el('button','copy','copy');b.onclick=()=>navigator.clipboard.writeText(q);r.appendChild(b);list.appendChild(r)});
-  } else {
-    const counts={};D.browsedUrls.forEach(s=>{counts[s.siteType]=(counts[s.siteType]||0)+1});
-    Object.entries(counts).forEach(([k,v])=>{const c=el('button','chip'+(filter===k?' on':''),k+' <b>'+v+'</b>');c.onclick=()=>{filter=filter===k?null:k;render()};chips.appendChild(c)});
-    D.browsedUrls.forEach(s=>{if(filter&&s.siteType!==filter)return;const r=el('div','row');const m=el('div','main');m.appendChild(el('div',null,'<span class="dom">'+esc(s.domain)+'</span> <span class="pill '+(s.cited?'cite':'brow')+'">'+(s.cited?'cited '+s.timesCited+'\xD7':'browsed')+'</span> <span class="tag">'+s.siteType+'</span>'));m.appendChild(el('div','url',esc(s.url)));r.appendChild(m);list.appendChild(r)});
+function enrichFanout(result, opts = {}) {
+  const addSiteType = (s) => ({ ...s, siteType: classifyDomain(s.domain, opts.firstPartyDomain) });
+  const browsedUrls = result.browsedUrls.map(addSiteType);
+  const citedUrls = result.citedUrls.map(addSiteType);
+  const browsedOnly = result.browsedOnly.map(addSiteType);
+  const byCategory = emptyCategoryCounts();
+  const domainAgg = /* @__PURE__ */ new Map();
+  for (const s of browsedUrls) {
+    byCategory[s.siteType]++;
+    const cur = domainAgg.get(s.domain);
+    if (!cur) domainAgg.set(s.domain, { domain: s.domain, count: 1, cited: s.cited, timesCited: s.timesCited, siteType: s.siteType });
+    else {
+      cur.count++;
+      cur.cited = cur.cited || s.cited;
+      cur.timesCited += s.timesCited;
+    }
   }
+  const topSites = [...domainAgg.values()].sort((a, b) => b.count - a.count || b.timesCited - a.timesCited);
+  const citationOrder = citedUrls.slice().sort((a, b) => b.timesCited - a.timesCited).map((s, i) => ({ rank: i + 1, domain: s.domain, url: s.url, timesCited: s.timesCited }));
+  return {
+    platform: result.platform,
+    capturedAt: result.capturedAt,
+    prompt: result.prompt,
+    meta: result.meta,
+    queries: result.subQueries,
+    browsedUrls,
+    citedUrls,
+    browsedOnly,
+    snippets: result.snippets,
+    counts: result.counts,
+    aggregates: { topSites, citationOrder, byCategory },
+    firstPartyDomain: opts.firstPartyDomain ? opts.firstPartyDomain.toLowerCase().replace(/^www\./, "") : null,
+    ...result.debug ? { debug: result.debug } : {}
+  };
 }
-function esc(s){return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;')}
-document.querySelectorAll('.tab').forEach(t=>t.onclick=()=>{document.querySelectorAll('.tab').forEach(x=>x.classList.remove('on'));t.classList.add('on');tab=t.dataset.tab;filter=null;render()});
-render();
-</script>
-</body></html>`;
-}
-var import_node_fs9, import_node_os7, import_node_path12, import_papaparse3;
-var init_export = __esm({
-  "src/services/fanout/export.ts"() {
+var SOCIAL, ENCYCLOPEDIA, REVIEW, NEWS;
+var init_classify = __esm({
+  "src/services/fanout/classify.ts"() {
     "use strict";
-    import_node_fs9 = require("fs");
-    import_node_os7 = require("os");
-    import_node_path12 = require("path");
-    import_papaparse3 = __toESM(require("papaparse"), 1);
+    SOCIAL = /(^|\.)(youtube\.com|youtu\.be|instagram\.com|tiktok\.com|facebook\.com|fb\.com|x\.com|twitter\.com|linkedin\.com|pinterest\.com|threads\.net|vimeo\.com)$/i;
+    ENCYCLOPEDIA = /(^|\.)(wikipedia\.org|wikimedia\.org|britannica\.com|merriam-webster\.com|dictionary\.com|fandom\.com|investopedia\.com)$/i;
+    REVIEW = /(^|\.)(yelp\.com|trustpilot\.com|g2\.com|capterra\.com|angi\.com|angieslist\.com|bbb\.org|consumeraffairs\.com|bestcompany\.com|sitejabber\.com|clutch\.co|bestpickreports\.com|homeguide\.com|porch\.com|ontoplist\.com|thumbtack\.com)$/i;
+    NEWS = /(^|\.)(reuters\.com|apnews\.com|nytimes\.com|wsj\.com|washingtonpost\.com|bloomberg\.com|cnbc\.com|forbes\.com|bbc\.com|theguardian\.com|cnn\.com|npr\.org|usatoday\.com|expressnews\.com|mysanantonio\.com|beaumontenterprise\.com)$/i;
   }
 });
 
@@ -29181,7 +30593,7 @@ function decryptMemoryKey(stored) {
 }
 async function memoryCall(toolName, args, userMemoryKey) {
   try {
-    const res = await fetch(`${MEMORY_BASE_URL()}/api/mcp/thorbitMemoryServer/tools/${toolName}/execute`, {
+    const res = await fetch(`${MEMORY_BASE_URL()}/api/mcp/memoryServer/tools/${toolName}/execute`, {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ data: { ...args, apiKey: userMemoryKey } })
@@ -29572,7 +30984,7 @@ var init_oauth_routes = __esm({
     init_memory();
     init_mcp_oauth();
     ISSUER = "https://mcpscraper.dev";
-    RESOURCE = () => process.env.MCP_MEMORY_RESOURCE_URL ?? "https://mcp-memory-omega.vercel.app/mcp/thorbitMemoryServer/mcp";
+    RESOURCE = () => process.env.MCP_MEMORY_RESOURCE_URL ?? "https://memory.mcpscraper.dev/mcp";
     SCRAPER_RESOURCE = () => (process.env.MCP_SCRAPER_RESOURCE_URL ?? "https://mcpscraper.dev/mcp").replace(/\/$/, "");
     MEMORY_SCOPES = ["memory.read", "memory.write", "memory.admin"];
     SCRAPER_SCOPES = ["scraper.use"];
@@ -29782,6 +31194,684 @@ var init_oauth_routes = __esm({
   }
 });
 
+// src/api/chat-routes.ts
+function tokenOk(token) {
+  return !!token && token.startsWith("mk_") && token.length > 10;
+}
+function jsonError(message, status = 400) {
+  return new Response(JSON.stringify({ ok: false, error: message }), { status, headers: { "content-type": "application/json" } });
+}
+function parseAttachNote(v) {
+  if (!v || typeof v !== "object") return void 0;
+  const a = v;
+  return a.vault && a.path ? { vault: a.vault, path: a.path } : void 0;
+}
+function renderChatPage(token) {
+  return `<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Chat Everywhere</title>
+<style>
+  :root { color-scheme: light }
+  * { box-sizing: border-box }
+  body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif; color: #1B1523; background: #EDEAF2; }
+  [id="app"] { display: flex; height: 100vh; }
+  [id="sidebar"] { width: 264px; flex-shrink: 0; display: flex; flex-direction: column; background: #2B0E36; color: #fff; }
+  [id="sidebar"] .brand { display:flex; align-items:center; gap:8px; padding:18px 16px 14px; border-bottom:1px solid rgba(255,255,255,.08); font-weight:700; }
+  [id="sidebar"] .section-label { font:700 11px system-ui; color:#B79FC4; letter-spacing:.05em; text-transform:uppercase; padding:14px 14px 4px; }
+  [id="channel-list"], [id="dm-list"] { padding: 0 8px; }
+  .chan-row { width:100%; display:flex; align-items:center; gap:7px; padding:7px 8px; border-radius:6px; border:none; background:transparent; color:#D9C7E0; cursor:pointer; text-align:left; font:500 13.5px system-ui; }
+  .chan-row:hover, .chan-row.active { background: rgba(255,255,255,.08); color:#fff; }
+  .badge { background:#FF6F91; color:#fff; font:700 10.5px system-ui; padding:1px 6px; border-radius:999px; margin-left:auto; }
+  [id="mentions-btn"] { margin: 8px 14px; display:flex; align-items:center; gap:8px; background:rgba(255,255,255,.07); border:none; border-radius:7px; padding:8px 10px; color:#EFE7F4; cursor:pointer; font:600 13px system-ui; }
+  [id="create-btn"] { margin: 4px 14px; background: transparent; border: 1px dashed rgba(255,255,255,.25); border-radius:7px; padding:6px 10px; color:#D9C7E0; cursor:pointer; font:600 12px system-ui; }
+  [id="main"] { flex: 1; display:flex; flex-direction:column; background:#fff; min-width:0; }
+  [id="chan-header"] { display:flex; align-items:center; justify-content:space-between; padding:14px 20px; border-bottom:1px solid #E6DEEA; }
+  [id="chan-title"] { font:700 16px system-ui; }
+  [id="manage-btn"] { background:transparent; border:1px solid #E6DEEA; border-radius:999px; padding:5px 12px; font:600 12px system-ui; color:#6B6275; cursor:pointer; }
+  [id="messages"] { flex:1; overflow:auto; padding:10px 8px; }
+  .msg { display:flex; gap:10px; padding:10px 16px; border-bottom:1px solid #F0ECF3; }
+  .avatar { width:36px; height:36px; border-radius:8px; display:flex; align-items:center; justify-content:center; color:#fff; font:600 12px system-ui; flex-shrink:0; }
+  .msg-body { flex:1; min-width:0; position:relative; }
+  .msg { position:relative; }
+  .msg-head { display:flex; align-items:center; gap:6px; flex-wrap:wrap; }
+  .msg-author { font:600 14px system-ui; }
+  .agent-pill { font:700 9px system-ui; letter-spacing:.05em; color:#fff; background:#0E8074; padding:2px 6px; border-radius:4px; }
+  .msg-ts { font:400 12px system-ui; color:#A89BB5; }
+  .msg-content { font-size:15px; line-height:1.5; color:#2B2433; white-space:pre-wrap; margin-top:2px; }
+  .reactions { display:flex; gap:6px; margin-top:7px; flex-wrap:wrap; align-items:center; }
+  .reaction { display:flex; align-items:center; gap:4px; padding:3px 8px; border-radius:999px; border:1px solid #E6DEEA; background:#F7F4FA; cursor:pointer; font:500 12px system-ui; color:#5A5165; }
+  .reply-summary, .thread-link { margin-top:7px; display:inline-flex; align-items:center; gap:5px; border:none; background:transparent; cursor:pointer; font:600 12.5px system-ui; color:#6B3FA0; padding:0; }
+  .seen { display:flex; align-items:center; gap:5px; margin-top:6px; font-size:11px; color:#A89BB5; }
+  .msg-actions { position:absolute; top:-6px; right:8px; display:flex; gap:2px; background:#fff; border:1px solid #E6DEEA; border-radius:8px; padding:2px; box-shadow:0 2px 6px rgba(0,0,0,.05); opacity:0; pointer-events:none; transition:opacity .1s; }
+  .msg:hover .msg-actions, .msg-actions.pinned-open { opacity:1; pointer-events:auto; }
+  .icon-btn { display:flex; align-items:center; justify-content:center; width:26px; height:26px; border-radius:6px; border:none; background:transparent; color:#948C9C; cursor:pointer; font-size:14px; flex-shrink:0; }
+  .icon-btn:hover { background:#F2EEF5; color:#6B3FA0; }
+  .emoji-popover { position:absolute; top:32px; right:10px; background:#fff; border:1px solid #E6DEEA; border-radius:10px; box-shadow:0 8px 24px rgba(0,0,0,.12); padding:6px; display:none; gap:2px; z-index:40; }
+  .emoji-popover.open { display:flex; }
+  .emoji-opt { width:30px; height:30px; display:flex; align-items:center; justify-content:center; border:none; background:transparent; cursor:pointer; font-size:17px; border-radius:6px; }
+  .emoji-opt:hover { background:#F2EEF5; }
+  [id="composer-row"] { padding:12px 20px 16px; border-top:1px solid #E6DEEA; }
+  [id="composer"] { width:100%; box-sizing:border-box; resize:none; height:46px; border:1px solid #E6DEEA; border-radius:9px; padding:11px 14px; font:14px system-ui; outline:none; }
+  [id="composer"]:focus { border-color:#6B3FA0; }
+  [id="send-btn"] { background:#6B3FA0; color:#fff; border:none; border-radius:7px; padding:8px 18px; font:600 13.5px system-ui; cursor:pointer; margin-top:8px; float:right; }
+  [id="thread-panel"] { width:340px; flex-shrink:0; border-left:1px solid #E6DEEA; display:none; flex-direction:column; background:#FCFBFD; }
+  [id="thread-panel"].open { display:flex; }
+  [id="thread-header"] { display:flex; align-items:center; justify-content:space-between; padding:14px 16px; border-bottom:1px solid #E6DEEA; font:700 14.5px system-ui; }
+  [id="thread-close"] { background:transparent; border:none; cursor:pointer; font:600 16px system-ui; color:#948C9C; }
+  [id="thread-messages"] { flex:1; overflow:auto; }
+  [id="thread-composer-row"] { padding:12px 16px 16px; border-top:1px solid #E6DEEA; }
+  [id="thread-composer"] { width:100%; box-sizing:border-box; resize:none; height:40px; border:1px solid #E6DEEA; border-radius:9px; padding:9px 12px; font:13.5px system-ui; outline:none; }
+  .overlay { position:fixed; inset:0; background:rgba(27,21,35,.42); display:none; align-items:center; justify-content:center; z-index:50; }
+  .overlay.open { display:flex; }
+  .modal { width:420px; max-height:640px; background:#fff; border-radius:12px; box-shadow:0 30px 70px rgba(0,0,0,.25); display:flex; flex-direction:column; overflow:hidden; }
+  .modal-head { display:flex; align-items:center; justify-content:space-between; padding:16px 18px; border-bottom:1px solid #E6DEEA; font:700 15px system-ui; }
+  .modal-body { padding:16px 18px; overflow:auto; flex:1; }
+  .modal-foot { padding:14px 18px; border-top:1px solid #E6DEEA; display:flex; justify-content:flex-end; gap:8px; }
+  .modal label { font:600 12px system-ui; color:#6B6275; display:block; margin-bottom:6px; margin-top: 12px; }
+  .modal input, .modal select { width:100%; box-sizing:border-box; border:1px solid #E6DEEA; border-radius:8px; padding:9px 12px; font:14px system-ui; outline:none; }
+  .btn { background:transparent; border:1px solid #E6DEEA; border-radius:7px; padding:8px 16px; font:600 13px system-ui; cursor:pointer; color:#6B6275; }
+  .btn-primary { background:#6B3FA0; color:#fff; border:none; border-radius:7px; padding:8px 18px; font:600 13px system-ui; cursor:pointer; }
+  .member-row { display:flex; align-items:center; gap:9px; padding:6px 4px; font:500 13.5px system-ui; }
+  .member-row .x { margin-left:auto; background:transparent; border:none; cursor:pointer; color:#C2BACB; font:600 14px system-ui; }
+  .empty { padding: 40px; text-align:center; color:#948C9C; font:14px system-ui; }
+  .note-chip { margin-top:8px; display:inline-flex; align-items:center; gap:6px; padding:5px 10px; border-radius:8px; border:1px solid #E6DEEA; background:#FAF7FC; cursor:pointer; font:600 12.5px system-ui; color:#6B3FA0; text-decoration:underline; text-decoration-color:#D9CCEB; }
+  .note-chip:hover { background:#F2EEF5; }
+  [id="composer-row"] { position:relative; }
+  .attach-chip-row { display:none; align-items:center; gap:6px; margin-bottom:6px; font:500 12.5px system-ui; color:#6B3FA0; }
+  .attach-chip-row.show { display:flex; }
+  .attach-chip-row button { background:transparent; border:none; cursor:pointer; color:#B7ADC2; font:600 13px system-ui; }
+  [id="attach-btn"] { background:transparent; border:1px solid #E6DEEA; border-radius:7px; padding:8px 12px; font:600 13px system-ui; cursor:pointer; color:#6B6275; margin-top:8px; float:right; margin-right:8px; }
+  [id="thread-attach-btn"] { background:transparent; border:1px solid #E6DEEA; border-radius:7px; padding:7px 10px; font:600 12.5px system-ui; cursor:pointer; color:#6B6275; margin-top:7px; float:right; margin-right:8px; }
+  [id="note-picker-search"] { margin-bottom:10px; }
+  .note-pick-row { padding:8px 6px; border-radius:7px; cursor:pointer; font:500 13.5px system-ui; color:#3D3548; }
+  .note-pick-row:hover { background:#F2EEF5; }
+  .note-pick-row .vault-tag { color:#A89BB5; font-size:11.5px; margin-left:6px; }
+  [id="note-card-body"] { font-size:14.5px; line-height:1.55; color:#2B2433; white-space:pre-wrap; }
+</style>
+</head>
+<body>
+<div id="app">
+  <div id="sidebar">
+    <div class="brand">Chat Everywhere</div>
+    <button id="mentions-btn">@ Mentions <span id="mentions-badge" class="badge" style="display:none"></span></button>
+    <div class="section-label">Channels</div>
+    <div id="channel-list"></div>
+    <button id="create-btn">+ New channel</button>
+  </div>
+  <div id="main">
+    <div id="chan-header" style="display:none">
+      <div id="chan-title"></div>
+      <button id="manage-btn">Members</button>
+    </div>
+    <div id="messages"><div class="empty">Pick a channel on the left.</div></div>
+    <div id="composer-row" style="display:none">
+      <div id="attach-chip-row" class="attach-chip-row"><span>\u{1F4CE} <span id="attach-chip-label"></span></span><button id="attach-chip-clear" title="Remove attachment">x</button></div>
+      <textarea id="composer" placeholder="Message... @ to mention someone"></textarea>
+      <button id="send-btn">Send</button>
+      <button id="attach-btn" title="Attach a note">\u{1F4CE} Attach note</button>
+      <div style="clear:both"></div>
+    </div>
+  </div>
+  <div id="thread-panel">
+    <div id="thread-header"><span>Thread</span><button id="thread-close">x</button></div>
+    <div id="thread-messages"></div>
+    <div id="thread-composer-row">
+      <div id="thread-attach-chip-row" class="attach-chip-row"><span>\u{1F4CE} <span id="thread-attach-chip-label"></span></span><button id="thread-attach-chip-clear" title="Remove attachment">x</button></div>
+      <textarea id="thread-composer" placeholder="Reply in thread"></textarea>
+      <button id="thread-send-btn" class="btn-primary" style="margin-top:7px;float:right">Reply</button>
+      <button id="thread-attach-btn" title="Attach a note">\u{1F4CE} Attach</button>
+      <div style="clear:both"></div>
+    </div>
+  </div>
+</div>
+
+<div id="note-picker-overlay" class="overlay">
+  <div class="modal">
+    <div class="modal-head">Attach a note <button id="note-picker-close" style="background:none;border:none;font-size:18px;cursor:pointer;color:#948C9C">x</button></div>
+    <div class="modal-body">
+      <input id="note-picker-search" placeholder="Search your notes by title or path..." />
+      <div id="note-picker-list"></div>
+    </div>
+  </div>
+</div>
+
+<div id="note-card-overlay" class="overlay">
+  <div class="modal">
+    <div class="modal-head"><span id="note-card-title"></span><button id="note-card-close" style="background:none;border:none;font-size:18px;cursor:pointer;color:#948C9C">x</button></div>
+    <div class="modal-body"><div id="note-card-body"></div></div>
+  </div>
+</div>
+
+<div id="mentions-overlay" class="overlay">
+  <div class="modal">
+    <div class="modal-head">Where am I tagged <button id="mentions-close" style="background:none;border:none;font-size:18px;cursor:pointer;color:#948C9C">x</button></div>
+    <div id="mentions-list" class="modal-body"></div>
+  </div>
+</div>
+
+<div id="create-overlay" class="overlay">
+  <div class="modal">
+    <div class="modal-head">New channel</div>
+    <div class="modal-body">
+      <label>Channel name</label>
+      <input id="new-channel-name" placeholder="e.g. fundraise-q3" />
+      <label>Invite by email (comma-separated, optional)</label>
+      <input id="new-channel-invites" placeholder="andrew@x.com, seo@y.com" />
+      <div id="create-error" style="color:#C2410C;font:13px system-ui;margin-top:8px;display:none"></div>
+    </div>
+    <div class="modal-foot">
+      <button class="btn" id="create-cancel">Cancel</button>
+      <button class="btn-primary" id="create-submit">Create</button>
+    </div>
+  </div>
+</div>
+
+<div id="manage-overlay" class="overlay">
+  <div class="modal">
+    <div class="modal-head">Members</div>
+    <div class="modal-body">
+      <div id="member-list"></div>
+      <label>Invite someone</label>
+      <input id="invite-email" placeholder="email" />
+      <select id="invite-scope" style="margin-top:8px">
+        <option value="write">Write - can post</option>
+        <option value="read">Read - view only</option>
+        <option value="admin">Admin - manage members</option>
+      </select>
+      <div id="invite-error" style="color:#C2410C;font:13px system-ui;margin-top:8px;display:none"></div>
+    </div>
+    <div class="modal-foot">
+      <button class="btn-primary" id="invite-submit">Invite</button>
+      <button class="btn" id="manage-close">Done</button>
+    </div>
+  </div>
+</div>
+
+<script>
+const TOKEN = ${JSON.stringify(token)};
+const state = { channels: [], activeVault: null, activeName: null, members: [], threadParent: null, pollTimer: null, pendingAttach: null, threadPendingAttach: null, ownNotes: null, pickerTarget: 'main' };
+
+function api(path, opts) {
+  const url = '/chat/api/' + path;
+  return fetch(url, opts).then(r => r.json());
+}
+function get(path, params) {
+  const qs = new URLSearchParams({ token: TOKEN, ...params }).toString();
+  return api(path + '?' + qs);
+}
+function post(path, body) {
+  return api(path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ token: TOKEN, ...body }) });
+}
+
+function colorFor(email) {
+  let h = 0;
+  for (let i = 0; i < email.length; i++) h = (h * 31 + email.charCodeAt(i)) % 360;
+  return 'hsl(' + h + ', 55%, 45%)';
+}
+function initialsFor(email) {
+  const local = (email || '?').split('@')[0];
+  return (local.slice(0, 2) || '??').toUpperCase();
+}
+function esc(s) {
+  return (s || '').replace(/[&<>]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;' }[c]));
+}
+function fmtTime(iso) {
+  try { return new Date(iso).toLocaleTimeString([], { hour: 'numeric', minute: '2-digit' }); } catch (e) { return ''; }
+}
+
+async function loadChannels() {
+  const r = await get('channels', {});
+  if (!r.ok) { document.getElementById('channel-list').innerHTML = '<div class="empty">' + esc(r.error || 'failed to load') + '</div>'; return; }
+  state.channels = r.channels || [];
+  const list = document.getElementById('channel-list');
+  list.innerHTML = '';
+  state.channels.forEach(ch => {
+    const btn = document.createElement('button');
+    btn.className = 'chan-row' + (ch.handle === state.activeVault ? ' active' : '');
+    btn.textContent = '# ' + ch.vault;
+    btn.onclick = () => openChannel(ch.handle, ch.vault);
+    list.appendChild(btn);
+  });
+  if (!state.channels.length) list.innerHTML = '<div class="empty" style="color:#B79FC4">No channels yet</div>';
+}
+
+async function openChannel(handle, name) {
+  state.activeVault = handle;
+  state.activeName = name;
+  closeThread();
+  document.querySelectorAll('.chan-row').forEach(b => b.classList.toggle('active', b.textContent === '# ' + name));
+  document.getElementById('chan-header').style.display = 'flex';
+  document.getElementById('chan-title').textContent = '#' + name;
+  document.getElementById('composer-row').style.display = 'block';
+  await loadMembers();
+  await loadMessages();
+  restartPolling();
+}
+
+const QUICK_EMOJI = ['\u{1F44D}', '\u2764\uFE0F', '\u{1F602}', '\u{1F389}', '\u{1F440}', '\u2705'];
+
+function renderMessage(m, container, compact) {
+  const div = document.createElement('div');
+  div.className = 'msg';
+  const author = m.authorIdentity || 'unknown';
+  div.innerHTML =
+    '<div class="avatar" style="background:' + colorFor(author) + (compact ? ';width:28px;height:28px' : '') + '">' + initialsFor(author) + '</div>' +
+    '<div class="msg-body">' +
+      '<div class="msg-head"><span class="msg-author">' + esc(author) + '</span>' +
+        (m.authorIsAgent ? '<span class="agent-pill">AGENT</span>' : '') +
+        '<span class="msg-ts">' + fmtTime(m.postedAt) + '</span></div>' +
+      (!compact ? '<span class="msg-actions">' +
+        '<button class="icon-btn reply-icon" title="Reply">\u{1F4AC}</button>' +
+        '<button class="icon-btn react-icon" title="Add reaction">\u{1F642}</button>' +
+      '</span>' : '') +
+      '<div class="msg-content"></div>' +
+      (m.attachedNote ? '<button class="note-chip">\u{1F4CE} ' + esc(m.attachedNote.title) + '</button>' : '') +
+      (m.reactions && m.reactions.length ? '<div class="reactions"></div>' : '') +
+      (!compact ? '<button class="reply-summary" style="' + (m.replyCount ? '' : 'display:none') + '">' + (m.replyCount || 0) + ' replies' + (m.lastReplyAt ? ' - last ' + fmtTime(m.lastReplyAt) : '') + '</button>' : '') +
+      (!compact ? '<div class="emoji-popover"></div>' : '') +
+      (m.readBy && m.readBy.length ? '<div class="seen">seen by ' + m.readBy.length + '</div>' : '') +
+    '</div>';
+  div.querySelector('.msg-content').textContent = m.content;
+  const noteChip = div.querySelector('.note-chip');
+  if (noteChip) noteChip.onclick = () => openNoteCard(state.activeVault, m.messageId);
+  if (m.reactions && m.reactions.length) {
+    const counts = {};
+    m.reactions.forEach(r => { counts[r.emoji] = (counts[r.emoji] || 0) + 1; });
+    const rdiv = div.querySelector('.reactions');
+    Object.entries(counts).forEach(([emoji, count]) => {
+      const b = document.createElement('button');
+      b.className = 'reaction';
+      b.textContent = emoji + ' ' + count;
+      b.onclick = () => react(m.messageId, emoji);
+      rdiv.appendChild(b);
+    });
+  }
+  if (!compact) {
+    const replyBtn = div.querySelector('.reply-summary');
+    if (replyBtn) replyBtn.onclick = () => openThread(m.messageId);
+    const replyIcon = div.querySelector('.reply-icon');
+    if (replyIcon) replyIcon.onclick = () => openThread(m.messageId);
+    const reactIcon = div.querySelector('.react-icon');
+    const popover = div.querySelector('.emoji-popover');
+    if (reactIcon && popover) {
+      QUICK_EMOJI.forEach(emoji => {
+        const b = document.createElement('button');
+        b.className = 'emoji-opt';
+        b.textContent = emoji;
+        b.onclick = () => { react(m.messageId, emoji); popover.classList.remove('open'); };
+        popover.appendChild(b);
+      });
+      const actions = div.querySelector('.msg-actions');
+      reactIcon.onclick = (e) => {
+        e.stopPropagation();
+        document.querySelectorAll('.emoji-popover.open').forEach(p => { if (p !== popover) { p.classList.remove('open'); p.closest('.msg-body').querySelector('.msg-actions').classList.remove('pinned-open'); } });
+        popover.classList.toggle('open');
+        if (actions) actions.classList.toggle('pinned-open', popover.classList.contains('open'));
+      };
+      document.addEventListener('click', () => { popover.classList.remove('open'); if (actions) actions.classList.remove('pinned-open'); });
+    }
+  }
+  container.appendChild(div);
+}
+
+async function loadMessages() {
+  const r = await get('messages', { vault: state.activeVault });
+  const box = document.getElementById('messages');
+  box.innerHTML = '';
+  if (!r.ok) { box.innerHTML = '<div class="empty">' + esc(r.error) + '</div>'; return; }
+  (r.messages || []).forEach(m => renderMessage(m, box, false));
+  box.scrollTop = box.scrollHeight;
+}
+
+async function react(messageId, emoji) {
+  await post('react', { vault: state.activeVault, messageId, emoji });
+  if (state.threadParent) await loadThread(state.threadParent); else await loadMessages();
+}
+
+document.getElementById('send-btn').onclick = async () => {
+  const ta = document.getElementById('composer');
+  const content = ta.value.trim();
+  if (!content && !state.pendingAttach) return;
+  ta.value = '';
+  const attachNote = state.pendingAttach ? { vault: state.pendingAttach.vault, path: state.pendingAttach.path } : undefined;
+  clearAttach('main');
+  await post('post', { vault: state.activeVault, content: content || (attachNote ? 'shared a note' : ''), attachNote });
+  await loadMessages();
+};
+document.getElementById('composer').addEventListener('keydown', e => {
+  if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); document.getElementById('send-btn').click(); }
+});
+
+function clearAttach(target) {
+  if (target === 'main') {
+    state.pendingAttach = null;
+    document.getElementById('attach-chip-row').classList.remove('show');
+  } else {
+    state.threadPendingAttach = null;
+    document.getElementById('thread-attach-chip-row').classList.remove('show');
+  }
+}
+document.getElementById('attach-chip-clear').onclick = () => clearAttach('main');
+document.getElementById('thread-attach-chip-clear').onclick = () => clearAttach('thread');
+
+async function openNotePicker(target) {
+  state.pickerTarget = target;
+  document.getElementById('note-picker-search').value = '';
+  document.getElementById('note-picker-overlay').classList.add('open');
+  if (!state.ownNotes) {
+    const r = await get('notes-own', {});
+    state.ownNotes = r.ok ? (r.notes || []) : [];
+  }
+  renderNotePickerList(state.ownNotes);
+  document.getElementById('note-picker-search').focus();
+}
+function renderNotePickerList(notes) {
+  const box = document.getElementById('note-picker-list');
+  box.innerHTML = '';
+  if (!notes.length) { box.innerHTML = '<div class="empty">No notes found.</div>'; return; }
+  notes.forEach(n => {
+    const row = document.createElement('div');
+    row.className = 'note-pick-row';
+    row.innerHTML = esc(n.title) + '<span class="vault-tag">' + esc(n.vault) + '/' + esc(n.path) + '</span>';
+    row.onclick = () => {
+      const chip = { vault: n.vault, path: n.path, title: n.title };
+      if (state.pickerTarget === 'main') {
+        state.pendingAttach = chip;
+        document.getElementById('attach-chip-label').textContent = n.title;
+        document.getElementById('attach-chip-row').classList.add('show');
+      } else {
+        state.threadPendingAttach = chip;
+        document.getElementById('thread-attach-chip-label').textContent = n.title;
+        document.getElementById('thread-attach-chip-row').classList.add('show');
+      }
+      document.getElementById('note-picker-overlay').classList.remove('open');
+    };
+    box.appendChild(row);
+  });
+}
+document.getElementById('attach-btn').onclick = () => openNotePicker('main');
+document.getElementById('thread-attach-btn').onclick = () => openNotePicker('thread');
+document.getElementById('note-picker-close').onclick = () => document.getElementById('note-picker-overlay').classList.remove('open');
+document.getElementById('note-picker-search').addEventListener('input', e => {
+  const q = e.target.value.trim().toLowerCase();
+  const filtered = !q ? state.ownNotes : (state.ownNotes || []).filter(n => n.title.toLowerCase().includes(q) || n.path.toLowerCase().includes(q));
+  renderNotePickerList(filtered || []);
+});
+
+async function openNoteCard(vault, messageId) {
+  document.getElementById('note-card-title').textContent = 'Loading...';
+  document.getElementById('note-card-body').textContent = '';
+  document.getElementById('note-card-overlay').classList.add('open');
+  const r = await get('message-note', { vault, messageId });
+  if (!r.ok) {
+    document.getElementById('note-card-title').textContent = 'Unavailable';
+    document.getElementById('note-card-body').textContent = r.error || 'Could not load this note.';
+    return;
+  }
+  document.getElementById('note-card-title').textContent = r.note.title;
+  document.getElementById('note-card-body').textContent = r.note.content;
+}
+document.getElementById('note-card-close').onclick = () => document.getElementById('note-card-overlay').classList.remove('open');
+
+async function openThread(parentMessageId) {
+  state.threadParent = parentMessageId;
+  document.getElementById('thread-panel').classList.add('open');
+  await loadThread(parentMessageId);
+}
+function closeThread() {
+  state.threadParent = null;
+  document.getElementById('thread-panel').classList.remove('open');
+}
+document.getElementById('thread-close').onclick = closeThread;
+
+async function loadThread(parentMessageId) {
+  const rootBox = document.getElementById('thread-messages');
+  rootBox.innerHTML = '';
+  const all = await get('messages', { vault: state.activeVault });
+  const root = (all.messages || []).find(m => m.messageId === parentMessageId);
+  if (root) renderMessage(root, rootBox, true);
+  const r = await get('messages', { vault: state.activeVault, parentMessageId });
+  const replyHeader = document.createElement('div');
+  replyHeader.style.cssText = 'padding:6px 16px;font:600 11.5px system-ui;color:#948C9C;border-bottom:1px solid #F2EEF5;margin-bottom:4px';
+  replyHeader.textContent = (r.messages || []).length + ' replies';
+  rootBox.appendChild(replyHeader);
+  (r.messages || []).forEach(m => renderMessage(m, rootBox, true));
+}
+document.getElementById('thread-send-btn').onclick = async () => {
+  const ta = document.getElementById('thread-composer');
+  const content = ta.value.trim();
+  if ((!content && !state.threadPendingAttach) || !state.threadParent) return;
+  ta.value = '';
+  const attachNote = state.threadPendingAttach ? { vault: state.threadPendingAttach.vault, path: state.threadPendingAttach.path } : undefined;
+  clearAttach('thread');
+  await post('reply', { vault: state.activeVault, parentMessageId: state.threadParent, content: content || (attachNote ? 'shared a note' : ''), attachNote });
+  await loadThread(state.threadParent);
+  await loadChannels();
+};
+
+async function loadMembers() {
+  const r = await get('members', { vault: state.activeVault });
+  state.members = r.ok ? (r.members || []) : [];
+}
+
+document.getElementById('manage-btn').onclick = async () => {
+  await loadMembers();
+  const list = document.getElementById('member-list');
+  list.innerHTML = '';
+  state.members.forEach(m => {
+    const row = document.createElement('div');
+    row.className = 'member-row';
+    row.innerHTML = '<span class="avatar" style="width:24px;height:24px;background:' + colorFor(m.identity) + '">' + initialsFor(m.identity) + '</span>' +
+      '<span>' + esc(m.identity) + (m.isAgent ? ' <span class="agent-pill">AGENT</span>' : '') + '</span>' +
+      '<span style="font:600 10.5px system-ui;color:#6B6275;background:#F2EEF5;padding:2px 7px;border-radius:999px;margin-left:auto">' + (m.scope.admin ? 'admin' : m.scope.write ? 'write' : 'read') + '</span>';
+    list.appendChild(row);
+  });
+  document.getElementById('manage-overlay').classList.add('open');
+};
+document.getElementById('manage-close').onclick = () => document.getElementById('manage-overlay').classList.remove('open');
+document.getElementById('invite-submit').onclick = async () => {
+  const email = document.getElementById('invite-email').value.trim();
+  const scope = document.getElementById('invite-scope').value;
+  const errEl = document.getElementById('invite-error');
+  errEl.style.display = 'none';
+  if (!email) return;
+  const r = await post('invite', { vault: state.activeVault, email, scope });
+  if (!r.ok) { errEl.textContent = r.error || 'invite failed'; errEl.style.display = 'block'; return; }
+  document.getElementById('invite-email').value = '';
+  document.getElementById('manage-btn').click();
+};
+
+document.getElementById('create-btn').onclick = () => document.getElementById('create-overlay').classList.add('open');
+document.getElementById('create-cancel').onclick = () => document.getElementById('create-overlay').classList.remove('open');
+document.getElementById('create-submit').onclick = async () => {
+  const name = document.getElementById('new-channel-name').value.trim();
+  const invitesRaw = document.getElementById('new-channel-invites').value.trim();
+  const errEl = document.getElementById('create-error');
+  errEl.style.display = 'none';
+  if (!name) return;
+  const inviteEmails = invitesRaw ? invitesRaw.split(',').map(s => s.trim()).filter(Boolean) : [];
+  const r = await post('channel', { name, inviteEmails });
+  if (!r.ok) { errEl.textContent = r.error || 'create failed'; errEl.style.display = 'block'; return; }
+  document.getElementById('create-overlay').classList.remove('open');
+  document.getElementById('new-channel-name').value = '';
+  document.getElementById('new-channel-invites').value = '';
+  await loadChannels();
+  if (r.members && r.members.some(m => !m.ok)) {
+    alert('Channel created, but some invites failed: ' + r.members.filter(m => !m.ok).map(m => m.identity + ' (' + m.error + ')').join(', '));
+  }
+};
+
+document.getElementById('mentions-btn').onclick = async () => {
+  const r = await get('mentions', {});
+  const list = document.getElementById('mentions-list');
+  list.innerHTML = '';
+  (r.mentions || []).forEach(m => {
+    const row = document.createElement('button');
+    row.style.cssText = 'display:block;width:100%;text-align:left;background:transparent;border:none;cursor:pointer;padding:10px 0;border-bottom:1px solid #F2EEF5';
+    row.innerHTML = '<div style="font:600 11.5px system-ui;color:#6B3FA0">' + esc(m.channel) + '</div>' +
+      '<div style="font:600 13.5px system-ui">' + esc(m.authorIdentity) + ' <span style="font:400 12px;color:#948C9C">- ' + fmtTime(m.mentionedAt) + '</span></div>' +
+      '<div style="font:400 13.5px;color:#3D3548;margin-top:2px">' + esc(m.content) + '</div>';
+    row.onclick = () => { document.getElementById('mentions-overlay').classList.remove('open'); openChannel(m.channel, (state.channels.find(c => c.handle === m.channel) || {}).vault || m.channel); };
+    list.appendChild(row);
+  });
+  if (!(r.mentions || []).length) list.innerHTML = '<div class="empty">No mentions yet</div>';
+  document.getElementById('mentions-overlay').classList.add('open');
+};
+document.getElementById('mentions-close').onclick = () => document.getElementById('mentions-overlay').classList.remove('open');
+
+function restartPolling() {
+  if (state.pollTimer) clearInterval(state.pollTimer);
+  state.pollTimer = setInterval(async () => {
+    if (document.visibilityState !== 'visible' || !state.activeVault) return;
+    const r = await get('poll', { vault: state.activeVault });
+    if (r.ok && ((r.newMessages || []).length || (r.newReplies || []).length || (r.newReactions || []).length)) {
+      await loadMessages();
+      if (state.threadParent) await loadThread(state.threadParent);
+    }
+  }, 4000);
+}
+
+loadChannels();
+</script>
+</body>
+</html>`;
+}
+var import_hono15, chatApp;
+var init_chat_routes = __esm({
+  "src/api/chat-routes.ts"() {
+    "use strict";
+    import_hono15 = require("hono");
+    init_memory();
+    chatApp = new import_hono15.Hono();
+    chatApp.get("/api/channels", async (c) => {
+      const token = c.req.query("token");
+      if (!tokenOk(token)) return jsonError("missing or malformed token", 401);
+      const r = await memoryCall("listVaultsTool", {}, token);
+      if (!r.ok) return c.json(r);
+      const vaults = (r.vaults ?? []).filter((v) => v.kind === "channel");
+      return c.json({ ok: true, channels: vaults });
+    });
+    chatApp.get("/api/messages", async (c) => {
+      const token = c.req.query("token");
+      if (!tokenOk(token)) return jsonError("missing or malformed token", 401);
+      const vault = c.req.query("vault");
+      if (!vault) return jsonError("vault is required");
+      const parentMessageId = c.req.query("parentMessageId") || void 0;
+      const r = await memoryCall("listChannelMessagesTool", { vault, parentMessageId }, token);
+      return c.json(r);
+    });
+    chatApp.get("/api/poll", async (c) => {
+      const token = c.req.query("token");
+      if (!tokenOk(token)) return jsonError("missing or malformed token", 401);
+      const vault = c.req.query("vault");
+      if (!vault) return jsonError("vault is required");
+      const r = await memoryCall("pollChannelTool", { vault }, token);
+      return c.json(r);
+    });
+    chatApp.post("/api/post", async (c) => {
+      const body = await c.req.json().catch(() => ({}));
+      if (!tokenOk(body.token)) return jsonError("missing or malformed token", 401);
+      if (!body.vault || !body.content) return jsonError("vault and content are required");
+      const attachNote = parseAttachNote(body.attachNote);
+      const r = await memoryCall("postMessageTool", { vault: body.vault, content: body.content, ...attachNote ? { attachNote } : {} }, body.token);
+      return c.json(r);
+    });
+    chatApp.post("/api/reply", async (c) => {
+      const body = await c.req.json().catch(() => ({}));
+      if (!tokenOk(body.token)) return jsonError("missing or malformed token", 401);
+      if (!body.vault || !body.parentMessageId || !body.content) return jsonError("vault, parentMessageId and content are required");
+      const attachNote = parseAttachNote(body.attachNote);
+      const r = await memoryCall("replyMessageTool", { vault: body.vault, parentMessageId: body.parentMessageId, content: body.content, ...attachNote ? { attachNote } : {} }, body.token);
+      return c.json(r);
+    });
+    chatApp.get("/api/notes-own", async (c) => {
+      const token = c.req.query("token");
+      if (!tokenOk(token)) return jsonError("missing or malformed token", 401);
+      const vaultsRes = await memoryCall("listVaultsTool", {}, token);
+      if (!vaultsRes.ok) return c.json(vaultsRes);
+      const ownVaults = (vaultsRes.vaults ?? []).filter((v) => v.role === "owner" && v.kind === "notes");
+      const lists = await Promise.all(ownVaults.map((v) => memoryCall("listTool", { vault: v.handle }, token)));
+      const notes = ownVaults.flatMap((v, i) => {
+        const r = lists[i];
+        return r.ok ? (r.notes ?? []).map((n) => ({ vault: v.handle, path: n.path, title: n.title })) : [];
+      });
+      return c.json({ ok: true, notes });
+    });
+    chatApp.get("/api/message-note", async (c) => {
+      const token = c.req.query("token");
+      if (!tokenOk(token)) return jsonError("missing or malformed token", 401);
+      const vault = c.req.query("vault");
+      const messageId = c.req.query("messageId");
+      if (!vault || !messageId) return jsonError("vault and messageId are required");
+      const r = await memoryCall("getMessageNoteTool", { vault, messageId }, token);
+      return c.json(r);
+    });
+    chatApp.post("/api/react", async (c) => {
+      const body = await c.req.json().catch(() => ({}));
+      if (!tokenOk(body.token)) return jsonError("missing or malformed token", 401);
+      if (!body.vault || !body.messageId || !body.emoji) return jsonError("vault, messageId and emoji are required");
+      const r = await memoryCall("reactMessageTool", { vault: body.vault, messageId: body.messageId, emoji: body.emoji, remove: !!body.remove }, body.token);
+      return c.json(r);
+    });
+    chatApp.get("/api/mentions", async (c) => {
+      const token = c.req.query("token");
+      if (!tokenOk(token)) return jsonError("missing or malformed token", 401);
+      const r = await memoryCall("myMentionsTool", {}, token);
+      return c.json(r);
+    });
+    chatApp.get("/api/members", async (c) => {
+      const token = c.req.query("token");
+      if (!tokenOk(token)) return jsonError("missing or malformed token", 401);
+      const vault = c.req.query("vault");
+      if (!vault) return jsonError("vault is required");
+      const r = await memoryCall("listChannelMembersTool", { vault }, token);
+      return c.json(r);
+    });
+    chatApp.post("/api/channel", async (c) => {
+      const body = await c.req.json().catch(() => ({}));
+      if (!tokenOk(body.token)) return jsonError("missing or malformed token", 401);
+      if (!body.name) return jsonError("name is required");
+      const inviteEmails = (body.inviteEmails ?? []).filter(Boolean).slice(0, 99);
+      const r = await memoryCall(
+        "createChannelTool",
+        { name: body.name, inviteMembers: inviteEmails.map((identity) => ({ identity })) },
+        body.token
+      );
+      return c.json(r);
+    });
+    chatApp.post("/api/invite", async (c) => {
+      const body = await c.req.json().catch(() => ({}));
+      if (!tokenOk(body.token)) return jsonError("missing or malformed token", 401);
+      if (!body.vault || !body.email) return jsonError("vault and email are required");
+      const scopeMap = {
+        read: { read: true },
+        write: { read: true, write: true },
+        admin: { read: true, write: true, admin: true }
+      };
+      const scope = scopeMap[body.scope ?? "write"] ?? scopeMap.write;
+      const r = await memoryCall("shareVaultTool", { vault: body.vault, granteeIdentity: body.email, scope }, body.token);
+      return c.json(r);
+    });
+    chatApp.post("/api/member-remove", async (c) => {
+      const body = await c.req.json().catch(() => ({}));
+      if (!tokenOk(body.token)) return jsonError("missing or malformed token", 401);
+      if (!body.vault || !body.identity) return jsonError("vault and identity are required");
+      const r = await memoryCall("removeChannelMemberTool", { vault: body.vault, identity: body.identity }, body.token);
+      return c.json(r);
+    });
+    chatApp.get("/:token", (c) => {
+      const token = c.req.param("token");
+      if (!tokenOk(token)) {
+        return c.html(`<!doctype html><html><body style="font-family:system-ui;padding:40px;color:#3D3548"><h2>This chat link isn't valid.</h2><p>Ask the AI to run get-chat-link again, or revoke-chat-link then get-chat-link if you think it was compromised.</p></body></html>`, 401);
+      }
+      return c.html(renderChatPage(token));
+    });
+  }
+});
+
 // src/api/site-audit-worker.ts
 async function drainSiteAuditQueue(budget) {
   const processedIds = [];
@@ -29898,21 +31988,21 @@ async function cleanupVercel(token, cutoff) {
   return { deleted, store: "vercel-blob" };
 }
 async function cleanupLocal(cutoff) {
-  const baseDir = process.env.MCP_SCRAPER_OUTPUT_DIR?.trim() || (0, import_node_path13.join)((0, import_node_os8.homedir)(), "Downloads", "mcp-scraper");
-  const dir = (0, import_node_path13.join)(baseDir, "blobs", SCRAPE_FALLBACK_PREFIX.replace(/\/$/, ""));
+  const baseDir = process.env.MCP_SCRAPER_OUTPUT_DIR?.trim() || (0, import_node_path15.join)((0, import_node_os10.homedir)(), "Downloads", "mcp-scraper");
+  const dir = (0, import_node_path15.join)(baseDir, "blobs", SCRAPE_FALLBACK_PREFIX.replace(/\/$/, ""));
   let deleted = 0;
   let entries;
   try {
-    entries = await (0, import_promises10.readdir)(dir);
+    entries = await (0, import_promises11.readdir)(dir);
   } catch {
     return { deleted: 0, store: "local" };
   }
   for (const name of entries) {
-    const path6 = (0, import_node_path13.join)(dir, name);
+    const path6 = (0, import_node_path15.join)(dir, name);
     try {
-      const s = await (0, import_promises10.stat)(path6);
+      const s = await (0, import_promises11.stat)(path6);
       if (s.isFile() && s.mtimeMs < cutoff) {
-        await (0, import_promises10.unlink)(path6);
+        await (0, import_promises11.unlink)(path6);
         deleted++;
       }
     } catch {
@@ -29929,13 +32019,13 @@ async function cleanupExpiredScrapeBlobs(maxAgeMs = SCRAPE_BLOB_TTL_MS) {
     return { deleted: 0, store: "none" };
   }
 }
-var import_promises10, import_node_os8, import_node_path13;
+var import_promises11, import_node_os10, import_node_path15;
 var init_scrape_blob_cleanup = __esm({
   "src/api/scrape-blob-cleanup.ts"() {
     "use strict";
-    import_promises10 = require("fs/promises");
-    import_node_os8 = require("os");
-    import_node_path13 = require("path");
+    import_promises11 = require("fs/promises");
+    import_node_os10 = require("os");
+    import_node_path15 = require("path");
     init_scrape_vault_sink();
   }
 });
@@ -30390,6 +32480,7 @@ function opForCostPath(p) {
     return "fb_ad";
   }
   if (p.startsWith("/instagram/")) return "instagram";
+  if (p === "/reddit/thread") return "reddit_thread";
   if (p.startsWith("/api/internal/site-architecture-auditor")) return "audit_site";
   if (p.startsWith("/agent/")) return "browser_session";
   return null;
@@ -30426,7 +32517,7 @@ function countPaaQuestions2(result) {
   return Array.isArray(value.flat) ? value.flat.length : 0;
 }
 function paaCostForQuestionCount2(questionCount) {
-  return Math.max(1, questionCount) * MC_COSTS.paa;
+  return MC_COSTS.paa_base + Math.max(1, questionCount) * MC_COSTS.paa;
 }
 async function checkHarvestLimits(user, reuseLockId) {
   if (reuseLockId && await reuseExistingConcurrencyGate(user.id, reuseLockId, 30 * 60)) return null;
@@ -30444,7 +32535,7 @@ async function checkHarvestLimits(user, reuseLockId) {
   }
   return null;
 }
-var import_resend, import_hono15, import_hono16, import_factory6, import_cookie2, import_stripe2, secureCookies2, isProduction2, sessionCookieOptions2, requireAllowedOrigin, auth2, adminAuth, sessionAuth, app, STRIPE_API_VERSION, SYNC_HARVEST_TIMEOUT_OVERRIDE_MS;
+var import_resend, import_hono16, import_hono17, import_factory6, import_cookie2, import_stripe2, secureCookies2, isProduction2, sessionCookieOptions2, requireAllowedOrigin, auth2, adminAuth, sessionAuth, app, STRIPE_API_VERSION, SYNC_HARVEST_TIMEOUT_OVERRIDE_MS;
 var init_server = __esm({
   "src/api/server.ts"() {
     "use strict";
@@ -30462,8 +32553,8 @@ var init_server = __esm({
     init_media_extractor();
     init_site_mapper();
     init_site_extractor();
-    import_hono15 = require("hono");
-    import_hono16 = require("inngest/hono");
+    import_hono16 = require("hono");
+    import_hono17 = require("inngest/hono");
     init_client();
     init_site_audit();
     init_site_extract();
@@ -30487,6 +32578,7 @@ var init_server = __esm({
     init_cost_telemetry();
     init_stripe_routes();
     init_oauth_routes();
+    init_chat_routes();
     init_site_audit_worker();
     import_factory6 = require("hono/factory");
     import_cookie2 = require("hono/cookie");
@@ -30549,7 +32641,7 @@ var init_server = __esm({
       c.set("sessionUser", { ...refreshed, balance_mc: balanceMc });
       return next();
     });
-    app = new import_hono15.Hono();
+    app = new import_hono16.Hono();
     STRIPE_API_VERSION = "2026-02-25.clover";
     app.use("*", async (c, next) => {
       await next();
@@ -30766,17 +32858,17 @@ var init_server = __esm({
     app.get("/memory/connect", auth2, async (c) => {
       const { key, error } = await getOrCreateUserMemoryKey(c.get("user"));
       if (!key) return c.json({ error: error ?? "memory unavailable" }, 502);
-      const command = `MCP_MEMORY_KEY=${key} npx -y -p @vilovieta/mcp-memory@latest mcp-memory`;
+      const url = "https://memory.mcpscraper.dev/mcp";
       const config = {
         mcpServers: {
-          "mcp-memory": {
-            command: "npx",
-            args: ["-y", "-p", "@vilovieta/mcp-memory@latest", "mcp-memory"],
-            env: { MCP_MEMORY_KEY: key }
+          Memory: {
+            url,
+            headers: { Authorization: `Bearer ${key}` }
           }
         }
       };
-      return c.json({ ok: true, command, config });
+      const codeCommand = `claude mcp add --transport http memory ${url} --header "Authorization: Bearer ${key}"`;
+      return c.json({ ok: true, url, key, config, codeCommand });
     });
     app.post("/memory/vault", auth2, async (c) => {
       const { key, error } = await getOrCreateUserMemoryKey(c.get("user"));
@@ -30968,7 +33060,7 @@ var init_server = __esm({
         serpOnly: body.serpOnly ?? false,
         pages: Math.min(2, Math.max(1, body.pages ?? 1))
       };
-      const harvestCost = options.serpOnly ? MC_COSTS.serp : options.maxQuestions * MC_COSTS.paa;
+      const harvestCost = options.serpOnly ? MC_COSTS.serp : paaCostForQuestionCount2(options.maxQuestions);
       const { ok: harvestOk, balance_mc: harvestBal } = await debitMc(user.id, harvestCost, options.serpOnly ? LedgerOperation.SERP : LedgerOperation.PAA, options.query);
       if (!harvestOk) return c.json(insufficientBalanceResponse(harvestBal, harvestCost), 402);
       const jobId = await createJob(user.id, options.query, { ...options, billingHoldMc: harvestCost }, body.callback_url);
@@ -31004,7 +33096,7 @@ var init_server = __esm({
         serpOnly: body.serpOnly ?? false,
         pages: Math.min(2, Math.max(1, body.pages ?? 1))
       };
-      const syncCost = options.serpOnly ? MC_COSTS.serp : options.maxQuestions * MC_COSTS.paa;
+      const syncCost = options.serpOnly ? MC_COSTS.serp : paaCostForQuestionCount2(options.maxQuestions);
       const { ok: syncOk, balance_mc: syncBal } = await debitMc(user.id, syncCost, options.serpOnly ? LedgerOperation.SERP : LedgerOperation.PAA, options.query);
       if (!syncOk) return c.json(insufficientBalanceResponse(syncBal, syncCost), 402);
       const jobId = await createRunningJob(user.id, options.query, options);
@@ -31612,7 +33704,7 @@ var init_server = __esm({
       ]);
       return c.json({ drained: results.length, results, sweepResult, reaped: reapResult, expired: expiredResult, blobCleanup, workflowDispatch: workflowDispatchResult });
     });
-    app.on(["GET", "POST", "PUT"], "/api/inngest", (0, import_hono16.serve)({ client: inngest, functions: [siteAuditFn, siteExtractFn] }));
+    app.on(["GET", "POST", "PUT"], "/api/inngest", (0, import_hono17.serve)({ client: inngest, functions: [siteAuditFn, siteExtractFn] }));
     app.route("/api/internal/site-architecture-auditor", siteAuditApp);
     app.route("/youtube", youtubeApp);
     app.route("/screenshot", screenshotApp);
@@ -31625,6 +33717,7 @@ var init_server = __esm({
     app.route("/serp-intelligence", serpIntelligenceApp);
     app.route("/mcp", mcpApp);
     app.route("/agent", buildBrowserAgentRoutes());
+    app.route("/chat", chatApp);
     app.get("/console", (c) => c.html(renderConsoleHtml()));
     app.get("/console/auth/:id", async (c) => {
       const id = c.req.param("id");
@@ -31749,10 +33842,10 @@ ${ATTRIBUTION_PIXEL_SCRIPT}
 });
 
 // bin/api-server.ts
-var import_node_fs10 = require("fs");
+var import_node_fs11 = require("fs");
 function loadDotEnv() {
   try {
-    for (const line of (0, import_node_fs10.readFileSync)(".env", "utf8").split("\n")) {
+    for (const line of (0, import_node_fs11.readFileSync)(".env", "utf8").split("\n")) {
       const eq = line.indexOf("=");
       if (eq < 1 || line.trimStart().startsWith("#")) continue;
       const k = line.slice(0, eq).trim();