mcp-scraper 0.4.4 → 0.4.5

package/dist/bin/api-server.cjs

@@ -16934,22 +16934,8 @@ async function provisionMemoryForUser(user) {
   } catch {
   }
 }
-function memoryPlanForUser(user) {
-  switch (user.subscription_tier) {
-    case "starter":
-      return "pro";
-    case "growth":
-      return "team";
-    case "scale":
-      return "enterprise";
-    default:
-      return "free";
-  }
-}
 function resolveEffectiveMemoryPlan(user) {
-  const tierPlan = memoryPlanForUser(user);
-  const memoryProPlan = user.memory_plan === "pro" || user.memory_plan === "team" ? user.memory_plan : "free";
-  return MEMORY_PLAN_RANK[tierPlan] >= MEMORY_PLAN_RANK[memoryProPlan] ? tierPlan : memoryProPlan;
+  return user.memory_plan === "pro" || user.memory_plan === "team" ? user.memory_plan : "free";
 }
 async function getOrCreateUserMemoryKey(user) {
   const creds = await getUserMemoryCreds(user.id);
@@ -16999,7 +16985,7 @@ async function syncScheduleEntitlement(user, enabled, quotaPerPeriod) {
   }, {});
   return { ok: res.ok, error: res.error };
 }
-var import_node_crypto6, import_provision_defaults, import_set_schedule_entitlement, MEMORY_BASE_URL, ADMIN_KEY, MEMORY_PLAN_RANK;
+var import_node_crypto6, import_provision_defaults, import_set_schedule_entitlement, MEMORY_BASE_URL, ADMIN_KEY;
 var init_memory = __esm({
   "src/api/memory.ts"() {
     "use strict";
@@ -17010,7 +16996,6 @@ var init_memory = __esm({
     import_set_schedule_entitlement = require("mcpscraper-memory-tools/tools/schedule/set-schedule-entitlement");
     MEMORY_BASE_URL = () => (process.env.MCP_MEMORY_BASE_URL ?? "https://memory.mcpscraper.dev").replace(/\/$/, "");
     ADMIN_KEY = () => process.env.MCP_MEMORY_ADMIN_KEY?.trim() ?? "";
-    MEMORY_PLAN_RANK = { free: 0, pro: 1, team: 2, enterprise: 3 };
   }
 });
 
@@ -27018,7 +27003,7 @@ var PACKAGE_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    PACKAGE_VERSION = "0.4.4";
+    PACKAGE_VERSION = "0.4.5";
   }
 });
 
@@ -29277,7 +29262,7 @@ var init_export = __esm({
 });
 
 // src/mcp/browser-agent-tool-schemas.ts
-var import_zod34, NullableString2, BrowserRawObject, BrowserElementOutput, BrowserBaseOutput, BrowserReplayBaseOutput, BrowserOpenInputSchema, BrowserProfileConnectInputSchema, BrowserProfileListInputSchema, BrowserSessionInputSchema, BrowserLocateTargetSchema, BrowserLocateInputSchema, BrowserGotoInputSchema, BrowserClickInputSchema, BrowserTypeInputSchema, BrowserScrollInputSchema, BrowserPressInputSchema, BrowserReplayStopInputSchema, BrowserReplayDownloadInputSchema, BrowserReplayAnnotationSchema, BrowserReplayMarkInputSchema, BrowserReplayAnnotateInputSchema, BrowserListInputSchema, BrowserCaptureFanoutInputSchema, FanoutSourceOutput, BrowserCaptureFanoutOutputSchema, BrowserOpenOutputSchema, BrowserProfileLogin, BrowserProfileConnectOutputSchema, BrowserProfileListOutputSchema, BrowserScreenshotOutputSchema, BrowserReadOutputSchema, BrowserLocateOutputSchema, BrowserActionOutputSchema, BrowserReplayStartOutputSchema, BrowserReplayStopOutputSchema, BrowserListReplaysOutputSchema, BrowserReplayDownloadOutputSchema, BrowserReplayMarkOutputSchema, BrowserReplayAnnotateOutputSchema, BrowserCloseOutputSchema, BrowserListSessionsOutputSchema;
+var import_zod34, NullableString2, BrowserRawObject, BrowserElementOutput, BrowserBaseOutput, BrowserReplayBaseOutput, BrowserOpenInputSchema, BrowserProfileConnectInputSchema, BrowserProfileListInputSchema, BrowserSessionInputSchema, BrowserLocateTargetSchema, BrowserLocateInputSchema, BrowserGotoInputSchema, BrowserClickInputSchema, BrowserTypeInputSchema, BrowserScrollInputSchema, BrowserPressInputSchema, BrowserReplayStopInputSchema, BrowserReplayDownloadInputSchema, BrowserReplayAnnotationSchema, BrowserReplayMarkInputSchema, BrowserReplayAnnotateInputSchema, BrowserListInputSchema, BrowserCaptureFanoutInputSchema, FanoutSourceOutput, BrowserCaptureFanoutOutputSchema, BrowserOpenOutputSchema, BrowserProfileLogin, BrowserProfileConnectOutputSchema, BrowserProfileListOutputSchema, BrowserExtensionImportInputSchema, BrowserExtensionImportOutputSchema, BrowserExtensionSummary, BrowserExtensionListInputSchema, BrowserExtensionListOutputSchema, BrowserExtensionDeleteInputSchema, BrowserExtensionDeleteOutputSchema, BrowserScreenshotOutputSchema, BrowserReadOutputSchema, BrowserLocateOutputSchema, BrowserActionOutputSchema, BrowserReplayStartOutputSchema, BrowserReplayStopOutputSchema, BrowserListReplaysOutputSchema, BrowserReplayDownloadOutputSchema, BrowserReplayMarkOutputSchema, BrowserReplayAnnotateOutputSchema, BrowserCloseOutputSchema, BrowserListSessionsOutputSchema;
 var init_browser_agent_tool_schemas = __esm({
   "src/mcp/browser-agent-tool-schemas.ts"() {
     "use strict";
@@ -29299,7 +29284,10 @@ var init_browser_agent_tool_schemas = __esm({
       url: import_zod34.z.string().url().optional().describe("Optional URL to navigate to immediately after opening."),
       profile: import_zod34.z.string().optional().describe("Optional saved hosted profile name to load a logged-in session for a site."),
       save_profile_changes: import_zod34.z.boolean().optional().describe("Persist cookies/storage back to the named profile on close. Avoid parallel sessions writing to the same profile."),
-      timeout_seconds: import_zod34.z.number().int().min(60).max(259200).optional().describe("Session lifetime before auto-termination. Defaults to 600.")
+      timeout_seconds: import_zod34.z.number().int().min(60).max(259200).optional().describe("Session lifetime before auto-termination. Defaults to 600."),
+      extension_names: import_zod34.z.array(import_zod34.z.string()).optional().describe(
+        "Names of extensions previously added with browser_extension_import (see browser_extension_list for what's available) to load into this session. Loading extensions restarts the browser, adding a few seconds to startup."
+      )
     };
     BrowserProfileConnectInputSchema = {
       email: import_zod34.z.string().optional().describe("Account email for the login. Derives a stable profile name and is recorded as a note. Does NOT import existing cookies \u2014 the user signs in fresh."),
@@ -29526,6 +29514,43 @@ var init_browser_agent_tool_schemas = __esm({
       connections: import_zod34.z.array(BrowserProfileLogin).describe("All site logins saved in this profile, each with its current auth status and note."),
       count: import_zod34.z.number().int().min(0)
     };
+    BrowserExtensionImportInputSchema = {
+      store_url: import_zod34.z.string().url().describe("Chrome Web Store URL of the extension to add, e.g. https://chromewebstore.google.com/detail/<slug>/<id>."),
+      name: import_zod34.z.string().min(1).max(64).describe('Short name to save this extension under, e.g. "ani-ai". Reuse it later in extension_names on browser_open.')
+    };
+    BrowserExtensionImportOutputSchema = {
+      ok: import_zod34.z.boolean(),
+      tool: import_zod34.z.literal("browser_extension_import"),
+      session_id: import_zod34.z.null(),
+      name: import_zod34.z.string().describe("The name this extension was saved under."),
+      source_url: import_zod34.z.string().describe("The store URL this extension was imported from."),
+      size_bytes: import_zod34.z.number().nullable().describe("Size of the extension package in bytes.")
+    };
+    BrowserExtensionSummary = import_zod34.z.object({
+      name: import_zod34.z.string(),
+      source: import_zod34.z.string().describe('Always "store" for extensions added via browser_extension_import.'),
+      source_url: NullableString2,
+      size_bytes: import_zod34.z.number().nullable(),
+      created_at: import_zod34.z.string()
+    });
+    BrowserExtensionListInputSchema = {};
+    BrowserExtensionListOutputSchema = {
+      ok: import_zod34.z.boolean(),
+      tool: import_zod34.z.literal("browser_extension_list"),
+      session_id: import_zod34.z.null(),
+      extensions: import_zod34.z.array(BrowserExtensionSummary).describe("Every extension available to load via extension_names on browser_open."),
+      count: import_zod34.z.number().int().min(0)
+    };
+    BrowserExtensionDeleteInputSchema = {
+      name: import_zod34.z.string().min(1).describe("Name of the extension to remove, as returned by browser_extension_list.")
+    };
+    BrowserExtensionDeleteOutputSchema = {
+      ok: import_zod34.z.boolean(),
+      tool: import_zod34.z.literal("browser_extension_delete"),
+      session_id: import_zod34.z.null(),
+      name: import_zod34.z.string(),
+      deleted: import_zod34.z.boolean()
+    };
     BrowserScreenshotOutputSchema = {
       ...BrowserBaseOutput,
       tool: import_zod34.z.literal("browser_screenshot"),
@@ -30149,6 +30174,71 @@ function registerBrowserAgentMcpTools(server, opts) {
       });
     }
   );
+  server.registerTool(
+    "browser_extension_import",
+    {
+      title: "Add Browser Extension",
+      description: "Add a Chrome extension from its Chrome Web Store page so it can be loaded into browser_open sessions via extension_names. One-time setup per extension \u2014 check what's already added with browser_extension_list first. The extension starts logged out in any session; sign into it once inside a session, pairing with a saved profile (browser_open's profile + save_profile_changes) to keep it signed in on future opens.",
+      inputSchema: BrowserExtensionImportInputSchema,
+      outputSchema: recordOutputSchema("browser_extension_import", BrowserExtensionImportOutputSchema),
+      annotations: annotations("Add Browser Extension")
+    },
+    async (input) => {
+      const res = await req("POST", "/agent/extensions/import", { store_url: input.store_url, name: input.name });
+      if (!res.ok) return errorResult("browser_extension_import", res.data);
+      return structuredResult({
+        ok: true,
+        tool: "browser_extension_import",
+        session_id: null,
+        name: res.data.name,
+        source_url: res.data.source_url,
+        size_bytes: res.data.size_bytes ?? null
+      });
+    }
+  );
+  server.registerTool(
+    "browser_extension_list",
+    {
+      title: "List Browser Extensions",
+      description: "List extensions added via browser_extension_import, for use as extension_names on browser_open. Read-only, no cost.",
+      inputSchema: BrowserExtensionListInputSchema,
+      outputSchema: recordOutputSchema("browser_extension_list", BrowserExtensionListOutputSchema),
+      annotations: annotations("List Browser Extensions", true)
+    },
+    async () => {
+      const res = await req("GET", "/agent/extensions");
+      if (!res.ok) return errorResult("browser_extension_list", res.data);
+      const extensions = Array.isArray(res.data?.extensions) ? res.data.extensions : [];
+      return structuredResult({
+        ok: true,
+        tool: "browser_extension_list",
+        session_id: null,
+        extensions,
+        count: extensions.length
+      });
+    }
+  );
+  server.registerTool(
+    "browser_extension_delete",
+    {
+      title: "Remove Browser Extension",
+      description: "Remove a previously added extension by name so it can no longer be loaded via extension_names.",
+      inputSchema: BrowserExtensionDeleteInputSchema,
+      outputSchema: recordOutputSchema("browser_extension_delete", BrowserExtensionDeleteOutputSchema),
+      annotations: { title: "Remove Browser Extension", readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false }
+    },
+    async (input) => {
+      const res = await req("DELETE", `/agent/extensions/${encodeURIComponent(input.name)}`);
+      if (!res.ok) return errorResult("browser_extension_delete", res.data);
+      return structuredResult({
+        ok: true,
+        tool: "browser_extension_delete",
+        session_id: null,
+        name: input.name,
+        deleted: true
+      });
+    }
+  );
   server.registerTool(
     "browser_open",
     {
@@ -30167,7 +30257,8 @@ function registerBrowserAgentMcpTools(server, opts) {
         ...profile && typeof saveProfileChanges === "boolean" ? { save_profile_changes: saveProfileChanges } : {},
         disable_default_proxy: true,
         timeout_seconds: input.timeout_seconds,
-        ...input.url ? { url: input.url } : {}
+        ...input.url ? { url: input.url } : {},
+        ...input.extension_names?.length ? { extension_names: input.extension_names } : {}
       });
       if (!open.ok) return errorResult("browser_open", open.data);
       const session = open.data;
@@ -33435,8 +33526,58 @@ async function migrateBrowserAgent() {
   } catch {
   }
   await db.execute(`CREATE INDEX IF NOT EXISTS browser_auth_connections_profile ON browser_auth_connections(profile)`);
+  await db.execute(`
+    CREATE TABLE IF NOT EXISTS browser_agent_extensions (
+      id           TEXT PRIMARY KEY,
+      user_id      INTEGER NOT NULL,
+      name         TEXT NOT NULL,
+      backend_id   TEXT NOT NULL,
+      backend_name TEXT NOT NULL,
+      source       TEXT NOT NULL DEFAULT 'store',
+      source_url   TEXT,
+      size_bytes   INTEGER,
+      created_at   TEXT NOT NULL DEFAULT (datetime('now'))
+    )
+  `);
+  await db.execute(`CREATE UNIQUE INDEX IF NOT EXISTS browser_agent_extensions_user_name ON browser_agent_extensions(user_id, name)`);
+  await db.execute(`CREATE INDEX IF NOT EXISTS browser_agent_extensions_user ON browser_agent_extensions(user_id)`);
   _ready2 = true;
 }
+async function createExtensionRow(input) {
+  const db = getDb();
+  const id = `bext_${(0, import_node_crypto11.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
+  await db.execute({
+    sql: `INSERT INTO browser_agent_extensions (id, user_id, name, backend_id, backend_name, source, source_url, size_bytes)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+    args: [id, input.userId, input.name, input.backendId, input.backendName, input.source, input.sourceUrl, input.sizeBytes]
+  });
+  const row = await getExtensionRow(input.userId, input.name);
+  if (!row) throw new Error("extension insert failed");
+  return row;
+}
+async function getExtensionRow(userId, name) {
+  const db = getDb();
+  const res = await db.execute({
+    sql: `SELECT * FROM browser_agent_extensions WHERE user_id = ? AND name = ?`,
+    args: [userId, name]
+  });
+  return res.rows[0] ?? null;
+}
+async function listExtensionRows(userId) {
+  const db = getDb();
+  const res = await db.execute({
+    sql: `SELECT * FROM browser_agent_extensions WHERE user_id = ? ORDER BY created_at DESC`,
+    args: [userId]
+  });
+  return res.rows;
+}
+async function deleteExtensionRow(userId, name) {
+  const db = getDb();
+  await db.execute({
+    sql: `DELETE FROM browser_agent_extensions WHERE user_id = ? AND name = ?`,
+    args: [userId, name]
+  });
+}
 async function createAuthConnectionRow(input) {
   const db = getDb();
   const connectionId = `authc_${(0, import_node_crypto11.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
@@ -34353,6 +34494,28 @@ function isProfileConflict(err) {
   const message = err instanceof Error ? err.message : String(err);
   return /\b409\b|conflict|already exists/i.test(message);
 }
+function isNotFound(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return /\b404\b|not found/i.test(message);
+}
+async function importExtensionFromStore(storeUrl, backendName) {
+  const k = client();
+  const archive = await k.extensions.downloadFromChromeStore({ url: storeUrl });
+  const uploaded = await k.extensions.upload({ file: archive, name: backendName });
+  return {
+    backendId: uploaded.id,
+    backendName: uploaded.name ?? backendName,
+    sizeBytes: typeof uploaded.size_bytes === "number" ? uploaded.size_bytes : null
+  };
+}
+async function deleteExtensionBackend(backendName) {
+  const k = client();
+  try {
+    await k.extensions.delete(backendName);
+  } catch (err) {
+    if (!isNotFound(err)) throw err;
+  }
+}
 async function ensureProfile(k, name) {
   try {
     await k.profiles.create({ name });
@@ -34371,6 +34534,7 @@ async function createSession(opts = {}) {
   const resolvedSaveProfileChanges = opts.saveProfileChanges ?? browserServiceProfileSaveChanges();
   const disableDefaultProxy = opts.disableDefaultProxy ?? !resolvedProxyId;
   const startUrl = opts.startUrl?.trim();
+  const extensionNames = (opts.extensionNames ?? []).map((name) => name.trim()).filter(Boolean);
   if (resolvedProfileName && resolvedSaveProfileChanges === true) {
     await ensureProfile(k, resolvedProfileName);
   }
@@ -34384,7 +34548,8 @@ async function createSession(opts = {}) {
         name: resolvedProfileName,
         ...typeof resolvedSaveProfileChanges === "boolean" ? { save_changes: resolvedSaveProfileChanges } : {}
       }
-    } : {}
+    } : {},
+    ...extensionNames.length ? { extensions: extensionNames.map((name) => ({ name })) } : {}
   };
   const browser = await k.browsers.create(createPayload);
   const runtimeSessionId = browser.session_id;
@@ -34781,6 +34946,15 @@ function parseAgentDate(value) {
   const legacyParsed = Date.parse(`${value.replace(" ", "T")}Z`);
   return Number.isFinite(legacyParsed) ? legacyParsed : null;
 }
+function publicExtension(row) {
+  return {
+    name: row.name,
+    source: row.source,
+    source_url: row.source_url,
+    size_bytes: row.size_bytes,
+    created_at: row.created_at
+  };
+}
 function replayClock(row) {
   if (!row) return null;
   const startedAtMs = parseAgentDate(row.started_at);
@@ -34927,6 +35101,15 @@ function buildBrowserAgentRoutes() {
     const body = await c.req.json().catch(() => ({}));
     const timeoutSeconds = typeof body.timeout_seconds === "number" ? body.timeout_seconds : void 0;
     const startUrl = typeof body.url === "string" ? body.url : void 0;
+    const extensionNames = Array.isArray(body.extension_names) ? body.extension_names.filter((v) => typeof v === "string") : void 0;
+    let resolvedExtensionBackendNames;
+    if (extensionNames && extensionNames.length) {
+      const names = extensionNames;
+      const rows = await Promise.all(names.map((name) => getExtensionRow(user.id, name)));
+      const missing = names.filter((_, i) => !rows[i]);
+      if (missing.length) return c.json({ error: `extension(s) not found: ${missing.join(", ")}` }, 400);
+      resolvedExtensionBackendNames = rows.map((row) => row.backend_name);
+    }
     const gate = await acquireConcurrencyGate(user, "browser_agent_session", {
       ttlSeconds: browserSessionLockTtlSeconds(timeoutSeconds),
       metadata: { label: typeof body.label === "string" ? body.label : null }
@@ -34941,7 +35124,8 @@ function buildBrowserAgentRoutes() {
         saveProfileChanges: typeof body.save_profile_changes === "boolean" ? body.save_profile_changes : void 0,
         startUrl,
         disableDefaultProxy: typeof body.disable_default_proxy === "boolean" ? body.disable_default_proxy : void 0,
-        viewport: body.viewport && typeof body.viewport === "object" ? body.viewport : void 0
+        viewport: body.viewport && typeof body.viewport === "object" ? body.viewport : void 0,
+        extensionNames: resolvedExtensionBackendNames
       });
       runtimeSessionId = created.runtimeSessionId;
       const row = await createSessionRow({
@@ -35244,6 +35428,52 @@ function buildBrowserAgentRoutes() {
       }))
     });
   });
+  app2.post("/extensions/import", async (c) => {
+    const user = c.get("user");
+    const body = await c.req.json().catch(() => ({}));
+    const storeUrl = typeof body.store_url === "string" ? body.store_url.trim() : "";
+    const name = typeof body.name === "string" ? body.name.trim() : "";
+    if (!storeUrl) return c.json({ error: "store_url is required" }, 400);
+    if (!name || !EXTENSION_NAME_RE.test(name)) {
+      return c.json({ error: "name is required (1-64 characters: letters, numbers, spaces, dots, underscores, hyphens)" }, 400);
+    }
+    const existing = await getExtensionRow(user.id, name);
+    if (existing) return c.json({ error: `an extension named "${name}" already exists \u2014 delete it first or pick another name` }, 409);
+    const backendName = `u${user.id}_${(0, import_node_crypto12.randomUUID)().replace(/-/g, "")}`;
+    try {
+      const imported = await importExtensionFromStore(storeUrl, backendName);
+      const row = await createExtensionRow({
+        userId: user.id,
+        name,
+        backendId: imported.backendId,
+        backendName: imported.backendName,
+        source: "store",
+        sourceUrl: storeUrl,
+        sizeBytes: imported.sizeBytes
+      });
+      return c.json(publicExtension(row));
+    } catch (err) {
+      return c.json(failure(err), 502);
+    }
+  });
+  app2.get("/extensions", async (c) => {
+    const user = c.get("user");
+    const rows = await listExtensionRows(user.id);
+    return c.json({ extensions: rows.map(publicExtension) });
+  });
+  app2.delete("/extensions/:name", async (c) => {
+    const user = c.get("user");
+    const name = c.req.param("name");
+    const row = await getExtensionRow(user.id, name);
+    if (!row) return c.json({ error: "not found" }, 404);
+    try {
+      await deleteExtensionBackend(row.backend_name);
+    } catch (err) {
+      return c.json(failure(err), 502);
+    }
+    await deleteExtensionRow(user.id, name);
+    return c.json({ ok: true });
+  });
   app2.get("/sessions/:id/replays/:replayId/download", async (c) => {
     const user = c.get("user");
     const row = await loadOpenSession(c.req.param("id"), user.id);
@@ -35268,10 +35498,11 @@ function buildBrowserAgentRoutes() {
   });
   return app2;
 }
-var import_hono17, auth, DEFAULT_BROWSER_SESSION_LOCK_TTL_SECONDS;
+var import_node_crypto12, import_hono17, auth, DEFAULT_BROWSER_SESSION_LOCK_TTL_SECONDS, EXTENSION_NAME_RE;
 var init_browser_agent_routes = __esm({
   "src/api/browser-agent-routes.ts"() {
     "use strict";
+    import_node_crypto12 = require("crypto");
     import_hono17 = require("hono");
     init_api_auth();
     init_errors();
@@ -35282,6 +35513,7 @@ var init_browser_agent_routes = __esm({
     init_concurrency_gates();
     auth = createApiKeyAuth();
     DEFAULT_BROWSER_SESSION_LOCK_TTL_SECONDS = 2 * 60 * 60;
+    EXTENSION_NAME_RE = /^[\w .-]{1,64}$/;
   }
 });
 
@@ -35640,7 +35872,6 @@ var init_stripe_routes = __esm({
           const live = sub.status === "active" || sub.status === "trialing";
           const newTier = live ? tier.tier : null;
           await setSubscriptionTier(user.id, newTier, live ? tier.concurrency : 0, live ? sub.id : null);
-          await syncMemoryKeyPlan(user, resolveEffectiveMemoryPlan({ ...user, subscription_tier: newTier }));
         } else if (priceId === CONCURRENCY_PRICE_ID && event.type === "customer.subscription.created") {
           await setExtraConcurrencySlots(user.id, user.extra_concurrency_slots + 1);
           await setConcurrencySubId(user.id, sub.id);
@@ -35666,7 +35897,6 @@ var init_stripe_routes = __esm({
         if (!user) return c.json({ received: true });
         if (priceId && priceId in SUBSCRIPTION_TIERS) {
           await setSubscriptionTier(user.id, null, 0, null);
-          await syncMemoryKeyPlan(user, resolveEffectiveMemoryPlan({ ...user, subscription_tier: null }));
         } else if (priceId === CONCURRENCY_PRICE_ID) {
           await setExtraConcurrencySlots(user.id, Math.max(0, user.extra_concurrency_slots - 1));
           await setConcurrencySubId(user.id, null);
@@ -35690,7 +35920,7 @@ async function getKeys() {
   const privateKey = await (0, import_jose2.importPKCS8)(pem, "RS256", { extractable: true });
   const full = await (0, import_jose2.exportJWK)(privateKey);
   const publicJwk = { kty: full.kty, n: full.n, e: full.e };
-  const kid = (0, import_node_crypto12.createHash)("sha256").update(JSON.stringify({ e: publicJwk.e, kty: publicJwk.kty, n: publicJwk.n })).digest("base64url").slice(0, 16);
+  const kid = (0, import_node_crypto13.createHash)("sha256").update(JSON.stringify({ e: publicJwk.e, kty: publicJwk.kty, n: publicJwk.n })).digest("base64url").slice(0, 16);
   publicJwk.kid = kid;
   publicJwk.alg = "RS256";
   publicJwk.use = "sig";
@@ -35869,23 +36099,23 @@ async function validateAuthRequest(p) {
 }
 function pkceMatches(verifier, challenge) {
   if (!verifier) return false;
-  const computed = (0, import_node_crypto12.createHash)("sha256").update(verifier).digest("base64url");
+  const computed = (0, import_node_crypto13.createHash)("sha256").update(verifier).digest("base64url");
   return computed === challenge;
 }
 async function mintAccessToken(identity, scope, plan, audience) {
   const { privateKey, kid } = await getKeys();
-  return new import_jose2.SignJWT({ scope, plan }).setProtectedHeader({ alg: "RS256", kid }).setIssuer(ISSUER).setSubject(identity).setAudience(audience).setIssuedAt().setJti((0, import_node_crypto12.randomUUID)()).setExpirationTime(`${ACCESS_TTL_SECONDS}s`).sign(privateKey);
+  return new import_jose2.SignJWT({ scope, plan }).setProtectedHeader({ alg: "RS256", kid }).setIssuer(ISSUER).setSubject(identity).setAudience(audience).setIssuedAt().setJti((0, import_node_crypto13.randomUUID)()).setExpirationTime(`${ACCESS_TTL_SECONDS}s`).sign(privateKey);
 }
 function tokenErrorResponse(c, error, description, status) {
   return c.json({ error, error_description: description }, status);
 }
-var import_hono19, import_cookie, import_node_crypto12, import_jose2, ISSUER, RESOURCE, SCRAPER_RESOURCE, MEMORY_SCOPES, SCRAPER_SCOPES, SUPPORTED_SCOPES, ACCESS_TTL_SECONDS, REFRESH_TTL_SECONDS, CODE_TTL_SECONDS, ROTATION_GRACE_SECONDS, secureCookies, sessionCookieOptions, cachedKeys, oauthApp;
+var import_hono19, import_cookie, import_node_crypto13, import_jose2, ISSUER, RESOURCE, SCRAPER_RESOURCE, MEMORY_SCOPES, SCRAPER_SCOPES, SUPPORTED_SCOPES, ACCESS_TTL_SECONDS, REFRESH_TTL_SECONDS, CODE_TTL_SECONDS, ROTATION_GRACE_SECONDS, secureCookies, sessionCookieOptions, cachedKeys, oauthApp;
 var init_oauth_routes = __esm({
   "src/api/oauth-routes.ts"() {
     "use strict";
     import_hono19 = require("hono");
     import_cookie = require("hono/cookie");
-    import_node_crypto12 = require("crypto");
+    import_node_crypto13 = require("crypto");
     import_jose2 = require("jose");
     init_session();
     init_db();
@@ -35971,7 +36201,7 @@ var init_oauth_routes = __esm({
         }
       }
       const clientName = typeof body.client_name === "string" ? body.client_name : null;
-      const clientId = `client_${(0, import_node_crypto12.randomBytes)(16).toString("hex")}`;
+      const clientId = `client_${(0, import_node_crypto13.randomBytes)(16).toString("hex")}`;
       await registerClient(clientId, redirectUris, clientName);
       console.log("[oauth-dcr] register OK client_id=%s redirect_uris=%s", clientId, JSON.stringify(redirectUris));
       return c.json({
@@ -36024,7 +36254,7 @@ var init_oauth_routes = __esm({
       if (action === "deny") return redirectWithError(p.redirect_uri, p.state, "access_denied");
       if (action !== "approve") return c.text("unsupported action", 400);
       const scope = negotiateScope(p.scope, user, p.resource);
-      const code = `code_${(0, import_node_crypto12.randomBytes)(32).toString("base64url")}`;
+      const code = `code_${(0, import_node_crypto13.randomBytes)(32).toString("base64url")}`;
       const expiresAt = new Date(Date.now() + CODE_TTL_SECONDS * 1e3).toISOString();
       await putCode({
         code,
@@ -36063,7 +36293,7 @@ var init_oauth_routes = __esm({
         const plan = user ? resolvePlan(user) : "free";
         const audience = record.resource ?? RESOURCE();
         const accessToken = await mintAccessToken(record.identity, record.scope, plan, audience);
-        const refreshToken = `rt_${(0, import_node_crypto12.randomBytes)(40).toString("base64url")}`;
+        const refreshToken = `rt_${(0, import_node_crypto13.randomBytes)(40).toString("base64url")}`;
         await putRefresh({
           refresh_token: refreshToken,
           client_id: clientId,
@@ -36093,7 +36323,7 @@ var init_oauth_routes = __esm({
         const plan = user ? resolvePlan(user) : "free";
         const audience = record.resource ?? RESOURCE();
         const accessToken = await mintAccessToken(record.identity, record.scope, plan, audience);
-        const nextRefresh = `rt_${(0, import_node_crypto12.randomBytes)(40).toString("base64url")}`;
+        const nextRefresh = `rt_${(0, import_node_crypto13.randomBytes)(40).toString("base64url")}`;
         await rotateRefresh(refreshToken, {
           refresh_token: nextRefresh,
           client_id: record.client_id,