mcp-scraper 0.42.2 → 0.43.1

package/dist/{server-2S7KQTPC.js → server-WAB6Z47N.js}

@@ -2,8 +2,9 @@ import {
   SITE_EXTRACT_ARTIFACT_PREFIX,
   cleanupExpiredSiteExtractArtifacts,
   harvestPageMedia,
+  readOwnedSiteExtractArtifactBuffer,
   renewSiteExtractArtifactDownload
-} from "./chunk-6Q7V4IQV.js";
+} from "./chunk-6WLNXYRG.js";
 import {
   REQUIRED_LOCATION_STATE_CODES,
   importHostedCensusPlacesCsv,
@@ -40,7 +41,7 @@ import {
   resolveBackupKernelProxyId,
   resolveKernelProxyId,
   serpArrivalUrl
-} from "./chunk-DH42LIR3.js";
+} from "./chunk-LXVIQZ7Y.js";
 import {
   ApiErrorResponseSchema,
   ArtifactTemplateConfigSchema,
@@ -69,9 +70,10 @@ import {
   createConnectedDataArtifact,
   createDirectoryCsvArtifact,
   exportFanout,
-  getBlobStore,
+  handleMcpTasksHttpRequest,
   harvestTimeoutBudget,
   hashOwnerId,
+  isLoopbackBaseUrl,
   outputBaseDir,
   registerBrowserAgentMcpTools,
   registerMemoryMcpTools,
@@ -79,8 +81,9 @@ import {
   registerSerpIntelligenceCaptureTools,
   renewConnectedDataArtifactDownload,
   renewDirectoryArtifactDownload,
+  resolveDeploymentProfile,
   transcribeMediaUrl
-} from "./chunk-N2B4AAWG.js";
+} from "./chunk-HO4DOPEG.js";
 import {
   auditImageUrls,
   auditImages,
@@ -88,10 +91,12 @@ import {
   computeIssues,
   createPrivateArtifact,
   isPrivateIpAddress,
+  privateArtifactOwnerId,
+  readPrivateArtifactBuffer,
   readPrivateArtifactWindow,
   renewPrivateArtifactDownload,
   validatePublicHttpUrl
-} from "./chunk-MJKVDLVR.js";
+} from "./chunk-2K74LVV7.js";
 import {
   sanitizeAttempts,
   sanitizeHarvestResult,
@@ -133,7 +138,9 @@ import {
   RawMapsOverviewSchema,
   RawMapsReviewStatsSchema
 } from "./chunk-CB5C3BPB.js";
-import "./chunk-UQ7XJINF.js";
+import {
+  PACKAGE_VERSION
+} from "./chunk-3CQZ3DAT.js";
 import {
   abandonExtractSettlement,
   countSuccessfulPages,
@@ -156,7 +163,7 @@ import {
   setExtractJobTotal,
   settleExtractJob,
   terminalExtractJobStatus
-} from "./chunk-4MFUKI4X.js";
+} from "./chunk-GUI33Q27.js";
 import {
   BROWSER_OPEN_MIN_BALANCE_MC,
   CONCURRENCY_PRICE_ID,
@@ -204,7 +211,7 @@ import {
   tierChangeLeavesPrivateOffer,
   tierCreditsPerInterval,
   vendorCostUsdToMc
-} from "./chunk-SBLGBZZB.js";
+} from "./chunk-X5WDJ7D7.js";
 import {
   CaptchaError,
   MapsSearchIncompletePageError,
@@ -3629,7 +3636,7 @@ async function generateOgImage(post) {
 
 // src/api/server.ts
 import { Resend as Resend3 } from "resend";
-import { randomUUID as randomUUID19 } from "crypto";
+import { randomUUID as randomUUID20 } from "crypto";
 
 // src/api/kpo-extractor.ts
 import TurndownService from "turndown";
@@ -8658,7 +8665,7 @@ var siteExtractFn = inngest.createFunction(
       });
     }) : null;
     const finalized = await step.run("finalize", async () => {
-      const { assembleExtractArtifacts } = await import("./extract-bundle-DMZ63HZU.js");
+      const { assembleExtractArtifacts } = await import("./extract-bundle-IOM45SFL.js");
       const current = await getExtractJob(jobId2);
       if (!current) throw new Error("extract job disappeared before finalization");
       const stored = await assembleExtractArtifacts(current, { branding, imageAudit });
@@ -10202,11 +10209,11 @@ async function getDirectoryWorkflowJob(id, userId) {
   const result = userId == null ? await getDb().execute({ sql: "SELECT * FROM directory_workflow_jobs WHERE id = ? LIMIT 1", args: [id] }) : await getDb().execute({ sql: "SELECT * FROM directory_workflow_jobs WHERE id = ? AND user_id = ? LIMIT 1", args: [id, userId] });
   return result.rows[0] ? rowToJob(result.rows[0]) : null;
 }
-async function getDirectoryWorkflowJobByIdempotencyKey(userId, idempotencyKey2) {
+async function getDirectoryWorkflowJobByIdempotencyKey(userId, idempotencyKey3) {
   await ensureDirectoryWorkflowRepositorySchema();
   const result = await getDb().execute({
     sql: "SELECT * FROM directory_workflow_jobs WHERE user_id = ? AND idempotency_key = ? LIMIT 1",
-    args: [userId, idempotencyKey2]
+    args: [userId, idempotencyKey3]
   });
   return result.rows[0] ? rowToJob(result.rows[0]) : null;
 }
@@ -10372,7 +10379,7 @@ async function recordDirectoryWorkflowJobSettlement(jobId2, billedMc) {
 async function createOrGetDirectoryWorkflowJob(input) {
   await ensureDirectoryWorkflowRepositorySchema();
   const id = requiredBoundedString(input.id, "job id", 200);
-  const idempotencyKey2 = requiredBoundedString(input.idempotencyKey, "idempotency key", 500);
+  const idempotencyKey3 = requiredBoundedString(input.idempotencyKey, "idempotency key", 500);
   const requestFingerprint2 = requiredBoundedString(input.requestFingerprint, "request fingerprint", 200);
   const debitKey2 = requiredBoundedString(input.debitKey, "debit key", 500);
   const holdMc = nonNegativeSafeInteger(input.holdMc, "holdMc");
@@ -10387,7 +10394,7 @@ async function createOrGetDirectoryWorkflowJob(input) {
       args: [
         id,
         input.userId,
-        idempotencyKey2,
+        idempotencyKey3,
         requestFingerprint2,
         JSON.stringify(safeOptions2),
         JSON.stringify(input.plan),
@@ -10402,10 +10409,10 @@ async function createOrGetDirectoryWorkflowJob(input) {
             SELECT 'directory:' || id, id, ?, 'held'
             FROM directory_workflow_jobs
             WHERE user_id = ? AND idempotency_key = ?`,
-      args: [DIRECTORY_EVENT_NAME, input.userId, idempotencyKey2]
+      args: [DIRECTORY_EVENT_NAME, input.userId, idempotencyKey3]
     }
   ], "write");
-  const job = await getDirectoryWorkflowJobByIdempotencyKey(input.userId, idempotencyKey2);
+  const job = await getDirectoryWorkflowJobByIdempotencyKey(input.userId, idempotencyKey3);
   if (!job) throw new Error("directory workflow job could not be created");
   return {
     job,
@@ -12646,15 +12653,15 @@ function normalizeIdempotencyKey(value) {
   }
   return key;
 }
-function tokenFor(id, idempotencyKey2) {
-  return createHmac("sha256", billingSecret()).update(id).update(":").update(idempotencyKey2).digest("base64url");
+function tokenFor(id, idempotencyKey3) {
+  return createHmac("sha256", billingSecret()).update(id).update(":").update(idempotencyKey3).digest("base64url");
 }
-function tokenHash(token3) {
-  return createHash3("sha256").update(token3).digest("hex");
+function tokenHash(token4) {
+  return createHash3("sha256").update(token4).digest("hex");
 }
-function verifyToken(row, token3) {
+function verifyToken(row, token4) {
   const expected = Buffer.from(row.token_hash, "hex");
-  const actual = Buffer.from(tokenHash(token3), "hex");
+  const actual = Buffer.from(tokenHash(token4), "hex");
   if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
     throw new UnifiedBillingError("unauthorized", "invalid billing authorization token", 401);
   }
@@ -12693,10 +12700,10 @@ async function authorizationById(id) {
   });
   return result.rows[0] ? result.rows[0] : null;
 }
-async function eventByKey(idempotencyKey2) {
+async function eventByKey(idempotencyKey3) {
   const result = await getDb().execute({
     sql: "SELECT id, authorization_id, status, amount_mc, raw_cost_usd_nanos, multiplier_bps, metadata FROM billing_events WHERE idempotency_key = ? LIMIT 1",
-    args: [idempotencyKey2]
+    args: [idempotencyKey3]
   });
   return result.rows[0] ? result.rows[0] : null;
 }
@@ -12733,7 +12740,7 @@ function mapSettlementEvent(row, balanceMc, duplicate) {
 }
 async function authorizeScheduledRun(args) {
   const identity = normalizeIdentity(args.identity);
-  const idempotencyKey2 = normalizeIdempotencyKey(args.idempotencyKey);
+  const idempotencyKey3 = normalizeIdempotencyKey(args.idempotencyKey);
   const user = await resolveSchedulingUser(identity);
   if (!hasPaidSchedulingAccess(user)) {
     throw new UnifiedBillingError(PAID_PLAN_REQUIRED_CODE, PAID_PLAN_REQUIRED_MESSAGE, 403);
@@ -12747,7 +12754,7 @@ async function authorizeScheduledRun(args) {
   }
   const existing = await getDb().execute({
     sql: "SELECT id, user_id, idempotency_key, status, minimum_amount_mc, maximum_amount_mc, token_hash, expires_at FROM billing_authorizations WHERE idempotency_key = ? LIMIT 1",
-    args: [idempotencyKey2]
+    args: [idempotencyKey3]
   });
   if (existing.rows[0]) {
     const row = existing.rows[0];
@@ -12771,16 +12778,16 @@ async function authorizeScheduledRun(args) {
     );
   }
   const id = randomUUID3();
-  const token3 = tokenFor(id, idempotencyKey2);
+  const token4 = tokenFor(id, idempotencyKey3);
   const expiresAt = new Date(Date.now() + AUTHORIZATION_TTL_MS).toISOString();
   const inserted = await getDb().execute({
     sql: "INSERT OR IGNORE INTO billing_authorizations (id, user_id, idempotency_key, billing_class, status, minimum_amount_mc, maximum_amount_mc, token_hash, metadata, expires_at) VALUES (?, ?, ?, ?, 'authorized', ?, ?, ?, ?, ?)",
-    args: [id, user.id, idempotencyKey2, SCHEDULED_RUN_BILLING_CLASS, SCHEDULED_RUN_BASE_MC, maximumMc, tokenHash(token3), safeMetadata2(args.metadata), expiresAt]
+    args: [id, user.id, idempotencyKey3, SCHEDULED_RUN_BILLING_CLASS, SCHEDULED_RUN_BASE_MC, maximumMc, tokenHash(token4), safeMetadata2(args.metadata), expiresAt]
   });
   if (inserted.rowsAffected === 0) {
     const raced = await getDb().execute({
       sql: "SELECT id, user_id, idempotency_key, status, minimum_amount_mc, maximum_amount_mc, token_hash, expires_at FROM billing_authorizations WHERE idempotency_key = ? LIMIT 1",
-      args: [idempotencyKey2]
+      args: [idempotencyKey3]
     });
     if (!raced.rows[0]) throw new Error("billing authorization insert raced without a readable winner");
     const row = raced.rows[0];
@@ -12791,7 +12798,7 @@ async function authorizeScheduledRun(args) {
   }
   return {
     id,
-    token: token3,
+    token: token4,
     status: "authorized",
     minimumMc: SCHEDULED_RUN_BASE_MC,
     maximumMc,
@@ -13061,11 +13068,11 @@ function signSession(userId) {
   const sig = createHmac2("sha256", secret()).update(payload).digest("hex");
   return `${payload}.${sig}`;
 }
-function verifySession(token3) {
-  const dot = token3.lastIndexOf(".");
+function verifySession(token4) {
+  const dot = token4.lastIndexOf(".");
   if (dot === -1) return null;
-  const payload = token3.slice(0, dot);
-  const sig = token3.slice(dot + 1);
+  const payload = token4.slice(0, dot);
+  const sig = token4.slice(dot + 1);
   const expected = createHmac2("sha256", secret()).update(payload).digest("hex");
   if (!safeEqualHex(sig, expected)) return null;
   const id = parseInt(payload);
@@ -13293,11 +13300,11 @@ var ConnectedUsageBillingError = class extends Error {
 function hash(value) {
   return createHash4("sha256").update(value).digest("hex");
 }
-function eventKey(idempotencyKey2) {
-  return `connected-usage:${hash(idempotencyKey2)}`;
+function eventKey(idempotencyKey3) {
+  return `connected-usage:${hash(idempotencyKey3)}`;
 }
-function debitKey(idempotencyKey2) {
-  return `connected-usage-debit:${hash(idempotencyKey2)}`;
+function debitKey(idempotencyKey3) {
+  return `connected-usage-debit:${hash(idempotencyKey3)}`;
 }
 function normalizeIdentity2(identity) {
   return identity.trim().toLowerCase();
@@ -13655,7 +13662,7 @@ async function listConnectedUsageHistory(userId, limit = 100) {
 
 // src/api/internal-billing-routes.ts
 var internalBillingApp = new Hono3();
-var metadataSchema = z12.record(z12.unknown()).optional();
+var metadataSchema = z12.record(z12.string(), z12.unknown()).optional();
 var schedulingAccessSchema = z12.object({
   identity: z12.string().min(1).max(320),
   provisionCredentials: z12.boolean().optional()
@@ -14394,9 +14401,9 @@ var YouTubeExtractor = class {
   }
   async fetchContinuation(page, endpoint, contToken, context) {
     const result = await page.evaluate(
-      async ({ ep, token: token3, ctx }) => {
+      async ({ ep, token: token4, ctx }) => {
         const body = {
-          continuation: token3,
+          continuation: token4,
           context: {
             client: {
               clientName: ctx.clientName,
@@ -15012,7 +15019,7 @@ var HarvestBodySchema = z15.object({
   pages: z15.number().int().min(1).max(2).optional(),
   recency: z15.enum(["day", "week", "month", "year"]).optional()
 });
-var ExtractUrlBodySchema = z15.object({
+var ExtractUrlBodyShape = {
   url: z15.string().min(1, "url is required"),
   screenshot: z15.boolean().optional(),
   screenshotDevice: z15.enum(["desktop", "mobile"]).optional(),
@@ -15020,23 +15027,41 @@ var ExtractUrlBodySchema = z15.object({
   includeFeaturedImage: z15.boolean().optional(),
   downloadMedia: z15.boolean().optional(),
   mediaTypes: z15.array(z15.enum(["image", "video", "audio"])).optional(),
-  allowLocal: z15.boolean().optional(),
+  delivery: z15.enum(["auto", "inline", "artifact", "memory"]).optional(),
+  preserveMedia: z15.boolean().optional(),
   depositToVault: z15.boolean().optional(),
   vaultName: z15.string().trim().min(1).max(120).optional()
-});
-var DiffPageBodySchema = z15.object({
+};
+var ExtractUrlBodySchema = z15.object(ExtractUrlBodyShape).strict();
+var ExtractUrlLocalBodySchema = z15.object({
+  ...ExtractUrlBodyShape,
+  allowLocal: z15.boolean().optional()
+}).strict();
+var DiffPageBodyShape = {
   url: z15.string().min(1, "url is required"),
-  allowLocal: z15.boolean().optional(),
   resetBaseline: z15.boolean().optional()
-});
+};
+var DiffPageBodySchema = z15.object(DiffPageBodyShape).strict();
+var DiffPageLocalBodySchema = z15.object({
+  ...DiffPageBodyShape,
+  allowLocal: z15.boolean().optional()
+}).strict();
 var ArchiveReadBodySchema = z15.object({
-  url: z15.string().url("url must be a valid HTTPS ZIP URL"),
+  artifactId: z15.string().trim().min(1).optional(),
+  url: z15.string().url("url must be a valid HTTPS ZIP URL").optional(),
   path: z15.string().trim().min(1).max(2e3).optional(),
   offset: z15.number().int().min(0).optional(),
   maxBytes: z15.number().int().min(1).max(2e5).optional(),
   maxEntries: z15.number().int().min(1).max(1e3).optional(),
   depositToLibrary: z15.boolean().optional()
 }).superRefine((value, ctx) => {
+  if ((value.artifactId ? 1 : 0) + (value.url ? 1 : 0) !== 1) {
+    ctx.addIssue({
+      code: z15.ZodIssueCode.custom,
+      path: ["artifactId"],
+      message: "Provide exactly one of artifactId or url"
+    });
+  }
   if (value.depositToLibrary && !value.path) {
     ctx.addIssue({
       code: z15.ZodIssueCode.custom,
@@ -15050,7 +15075,8 @@ var MapUrlsBodySchema = z15.object({
   maxUrls: z15.number().int().min(1).max(2e3).optional(),
   concurrency: z15.number().int().min(1).max(20).optional(),
   browserFallback: z15.boolean().optional(),
-  kernelFallback: z15.boolean().optional()
+  kernelFallback: z15.boolean().optional(),
+  delivery: z15.enum(["auto", "inline", "artifact"]).optional()
 });
 var WaybackInventoryBodySchema = z15.object({
   url: z15.string().min(1, "url is required"),
@@ -15066,6 +15092,8 @@ var ExtractSiteBodySchema = z15.object({
   rotateProxyEvery: z15.number().int().min(1).max(100).optional(),
   background: z15.boolean().optional(),
   downloadImages: z15.boolean().optional(),
+  preserveMedia: z15.boolean().optional(),
+  delivery: z15.enum(["auto", "artifact"]).optional(),
   formats: z15.array(z15.enum(["markdown", "links", "json", "images", "branding", "issues"])).optional()
 });
 var YoutubeHarvestBodySchema = z15.object({
@@ -16275,7 +16303,7 @@ function advertiserTokenOverlap(query, candidate) {
   const candidateTokens = new Set(normalizeAdvertiserName(candidate).split(" ").filter(Boolean));
   if (queryTokens.size === 0 || candidateTokens.size === 0) return 0;
   let overlap = 0;
-  for (const token3 of queryTokens) if (candidateTokens.has(token3)) overlap++;
+  for (const token4 of queryTokens) if (candidateTokens.has(token4)) overlap++;
   return overlap / queryTokens.size;
 }
 function assessPageIntelMatch(body, result) {
@@ -17463,11 +17491,85 @@ adminCreditsApp.get("/lookup", async (c) => {
 // src/api/instagram-routes.ts
 import { Hono as Hono10 } from "hono";
 import { z as z19 } from "zod";
-import { mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
+import { mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 import { spawn } from "child_process";
 
+// src/api/blob-store.ts
+import { mkdirSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join as join4, dirname as dirname2 } from "path";
+function byteLength(data) {
+  return Buffer.isBuffer(data) ? data.length : Buffer.byteLength(data);
+}
+var LocalBlobStore = class {
+  constructor(baseDir) {
+    this.baseDir = baseDir;
+  }
+  baseDir;
+  kind = "local";
+  async put(key, data, contentType = "application/octet-stream") {
+    const path5 = join4(this.baseDir, "blobs", key);
+    mkdirSync(dirname2(path5), { recursive: true });
+    writeFileSync(path5, data);
+    return { key, url: `file://${path5}`, bytes: byteLength(data), contentType };
+  }
+  async get(key) {
+    const path5 = join4(this.baseDir, "blobs", key);
+    try {
+      const { readFileSync: readFileSync4 } = await import("fs");
+      return readFileSync4(path5);
+    } catch {
+      return null;
+    }
+  }
+};
+function localBaseDir() {
+  return process.env.MCP_SCRAPER_OUTPUT_DIR?.trim() || join4(homedir(), "Downloads", "mcp-scraper");
+}
+var cached = null;
+function getBlobStore() {
+  if (cached) return cached;
+  if (process.env.BLOB_READ_WRITE_TOKEN) {
+    cached = new VercelBlobStore(process.env.BLOB_READ_WRITE_TOKEN);
+  } else {
+    cached = new LocalBlobStore(localBaseDir());
+  }
+  return cached;
+}
+var VercelBlobStore = class {
+  constructor(token4) {
+    this.token = token4;
+  }
+  token;
+  kind = "vercel-blob";
+  async put(key, data, contentType = "application/octet-stream") {
+    const { put } = await import("@vercel/blob");
+    const body = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    const result = await put(key, body, {
+      access: "public",
+      token: this.token,
+      contentType,
+      addRandomSuffix: true
+    });
+    return { key, url: result.url, bytes: byteLength(data), contentType };
+  }
+  async get(key) {
+    try {
+      const { list } = await import("@vercel/blob");
+      const res = await list({ prefix: key, token: this.token, limit: 1 });
+      const match = res.blobs.find((b) => b.pathname === key || b.pathname.startsWith(key));
+      if (!match) return null;
+      const resp = await fetch(match.url);
+      if (!resp.ok) return null;
+      return Buffer.from(await resp.arrayBuffer());
+    } catch {
+      return null;
+    }
+  }
+};
+
 // src/extractor/InstagramContentExtractor.ts
 var CONTENT_PATH_RE = /^\/(?:[^/]+\/)?(p|reel|tv)\/([A-Za-z0-9_-]+)\/?/i;
 var CDN_HOST_RE = /(^|\.)((cdninstagram\.com)|(scontent[^/]*\.cdninstagram\.com))$/i;
@@ -18069,9 +18171,9 @@ instagramApp.post("/media-download", createApiKeyAuth(), async (c) => {
             downloads.push({ kind, url: track.url, savedPath: stored.url, sizeBytes: stored.bytes, mimeType, error: null });
             const isMuxInput = muxEligible && (track.url === extraction.selectedVideoTrack.url || track.url === extraction.selectedAudioTrack.url);
             if (isMuxInput) {
-              if (!muxWorkDir) muxWorkDir = mkdtempSync(join4(tmpdir(), "ig-mux-"));
-              const localPath = join4(muxWorkDir, trackFilename(track, index, extraction.shortcode));
-              writeFileSync(localPath, bytes);
+              if (!muxWorkDir) muxWorkDir = mkdtempSync(join5(tmpdir(), "ig-mux-"));
+              const localPath = join5(muxWorkDir, trackFilename(track, index, extraction.shortcode));
+              writeFileSync2(localPath, bytes);
               muxInputs.set(track.url, localPath);
             }
           } catch (err) {
@@ -18079,7 +18181,7 @@ instagramApp.post("/media-download", createApiKeyAuth(), async (c) => {
           }
         }
         if (muxEligible && muxWorkDir && muxInputs.has(extraction.selectedVideoTrack.url) && muxInputs.has(extraction.selectedAudioTrack.url)) {
-          const outPath = join4(muxWorkDir, "muxed.mp4");
+          const outPath = join5(muxWorkDir, "muxed.mp4");
           const muxed = await runFfmpegMux(muxInputs.get(extraction.selectedVideoTrack.url), muxInputs.get(extraction.selectedAudioTrack.url), outPath);
           if (muxed.ok) {
             const stored = await store.put(`${prefix}/muxed.mp4`, readFileSync2(outPath), "video/mp4");
@@ -20522,7 +20624,7 @@ import { readFile as readFile2 } from "fs/promises";
 import { Hono as Hono18 } from "hono";
 import { z as z26 } from "zod";
 var workflowApp = new Hono18();
-var WorkflowInputSchema = z26.record(z26.unknown()).default({});
+var WorkflowInputSchema = z26.record(z26.string(), z26.unknown()).default({});
 var WorkflowIdSchema = z26.string().min(1);
 var CadenceSchema = z26.enum(["daily", "weekly", "monthly"]);
 var ScheduleStatusSchema = z26.enum(["active", "paused"]);
@@ -22061,7 +22163,7 @@ serpIntelligenceApp.post("/page-snapshots", async (c) => {
 
 // src/mcp/mcp-routes.ts
 import { Hono as Hono20 } from "hono";
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { createMcpHandler } from "@modelcontextprotocol/server";
 
 // src/mcp/memory-mcp-tool-executor.ts
 var MemoryMcpToolExecutor = class {
@@ -22099,6 +22201,58 @@ var MemoryMcpToolExecutor = class {
   }
 };
 
+// src/api/image-source-artifacts.ts
+import { randomUUID as randomUUID9 } from "crypto";
+var IMAGE_SOURCE_ARTIFACT_PREFIX = "image-sources/";
+var IMAGE_SOURCE_ARTIFACT_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var IMAGE_SOURCE_DOWNLOAD_TTL_MS = 15 * 60 * 1e3;
+var IMAGE_SOURCE_MAX_BYTES = 20 * 1024 * 1024;
+var ALLOWED_IMAGE_TYPES = /* @__PURE__ */ new Map([
+  ["image/jpeg", "jpg"],
+  ["image/png", "png"],
+  ["image/webp", "webp"],
+  ["image/gif", "gif"]
+]);
+function token() {
+  return process.env.IMAGE_SOURCE_ARTIFACT_READ_WRITE_TOKEN?.trim() || process.env.PRIVATE_ARTIFACT_READ_WRITE_TOKEN?.trim() || process.env.CONNECTED_DATA_READ_WRITE_TOKEN?.trim() || process.env.CONNECTED_DATA_BLOB_READ_WRITE_TOKEN?.trim() || null;
+}
+function policy() {
+  return {
+    prefix: IMAGE_SOURCE_ARTIFACT_PREFIX,
+    artifactTtlMs: IMAGE_SOURCE_ARTIFACT_TTL_MS,
+    downloadTtlMs: IMAGE_SOURCE_DOWNLOAD_TTL_MS,
+    token: token()
+  };
+}
+function imageSourceArtifactOwnerId(artifactId) {
+  return privateArtifactOwnerId(artifactId, IMAGE_SOURCE_ARTIFACT_PREFIX);
+}
+async function createImageSourceArtifact(args) {
+  const extension = ALLOWED_IMAGE_TYPES.get(args.contentType);
+  if (!extension) throw new Error("image_source_type_unsupported");
+  if (args.content.length === 0 || args.content.length > IMAGE_SOURCE_MAX_BYTES) {
+    throw new Error("image_source_size_invalid");
+  }
+  const id = randomUUID9().replaceAll("-", "");
+  return createPrivateArtifact({
+    policy: policy(),
+    ownerId: args.ownerId,
+    artifactKey: `${id}.${extension}`,
+    createdAt: args.createdAt ?? /* @__PURE__ */ new Date(),
+    filename: args.filename ?? `mcp-scraper-image-${id.slice(0, 12)}.${extension}`,
+    contentType: args.contentType,
+    content: args.content
+  });
+}
+async function readOwnedImageSourceArtifact(args) {
+  if (imageSourceArtifactOwnerId(args.artifactId) !== args.ownerId) return null;
+  return readPrivateArtifactBuffer({
+    policy: policy(),
+    artifactId: args.artifactId,
+    maxBytes: IMAGE_SOURCE_MAX_BYTES
+  });
+}
+
 // src/mcp/memory-inprocess-executor.ts
 var CUTOVER = /* @__PURE__ */ new Map();
 function registerCutover(upstreamName, handler) {
@@ -22142,6 +22296,32 @@ var HybridMemoryToolExecutor = class {
         };
       }
     }
+    if (upstreamName === "image_asset_save" && typeof args.artifactId === "string") {
+      const image = await readOwnedImageSourceArtifact({
+        artifactId: args.artifactId,
+        ownerId: String(this.user.id)
+      });
+      if (!image) {
+        const result = {
+          ok: false,
+          code: "image_artifact_not_found",
+          error: "image artifact not found"
+        };
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }],
+          structuredContent: result,
+          isError: false
+        };
+      }
+      const sourceRef = typeof args.sourceRef === "object" && args.sourceRef !== null && !Array.isArray(args.sourceRef) ? args.sourceRef : {};
+      args = {
+        ...args,
+        artifactId: void 0,
+        imageBase64: image.toString("base64"),
+        sourceRef: { ...sourceRef, artifactId: args.artifactId }
+      };
+      delete args.artifactId;
+    }
     const handler = CUTOVER.get(upstreamName);
     if (!handler) return this.httpExecutor.callMemoryTool(upstreamName, args);
     const mkKey = await this.resolveMkKey();
@@ -22652,8 +22832,8 @@ function protectedResourceMetadata() {
 function wwwAuthenticateValue() {
   return `Bearer resource_metadata="${oauthResourceBaseUrl()}/.well-known/oauth-protected-resource"`;
 }
-function isBearerJwt(token3) {
-  return !token3.startsWith("sk_") && token3.split(".").length === 3;
+function isBearerJwt(token4) {
+  return !token4.startsWith("sk_") && token4.split(".").length === 3;
 }
 var jwksSingleton = null;
 function getJwks() {
@@ -22661,8 +22841,8 @@ function getJwks() {
   jwksSingleton = createRemoteJWKSet(new URL(`${oauthIssuer()}/.well-known/jwks.json`));
   return jwksSingleton;
 }
-async function verifyScraperOAuthJwt(token3) {
-  const { payload } = await jwtVerify(token3, getJwks(), {
+async function verifyScraperOAuthJwt(token4) {
+  const { payload } = await jwtVerify(token4, getJwks(), {
     issuer: oauthIssuer(),
     audience: oauthResourceUrl()
   });
@@ -22717,37 +22897,91 @@ async function requireMcpCallerKey(c) {
   return { key: callerKey, user };
 }
 var mcpApp = new Hono20();
+function userFromAuthInfo(authInfo) {
+  const user = authInfo?.extra?.user;
+  if (!user || typeof user !== "object" || Array.isArray(user)) {
+    throw new Error("Authenticated MCP user context is missing.");
+  }
+  return user;
+}
+var mcpHandler = createMcpHandler(async ({ authInfo }) => {
+  const user = userFromAuthInfo(authInfo);
+  const callerKey = authInfo?.token ?? "";
+  if (!callerKey) throw new Error("Authenticated MCP token is missing.");
+  const baseUrl = process.env.MCP_SCRAPER_BASE_URL?.trim() ?? process.env.MCP_BASE_URL?.trim() ?? "https://mcpscraper.dev";
+  const executor = new HttpMcpToolExecutor(baseUrl, callerKey);
+  const consoleBaseUrl = process.env.BROWSER_AGENT_CONSOLE_URL?.trim() || baseUrl;
+  const server = buildPaaExtractorMcpServer(executor, {
+    savesReportsLocally: false,
+    ownerId: hashOwnerId(callerKey),
+    deploymentProfile: "production",
+    transportProfile: "hosted_http",
+    baseUrl,
+    taskHandleSecret: callerKey
+  });
+  registerSerpIntelligenceCaptureTools(server, executor, { exposeDevelopmentDiagnostics: false });
+  registerBrowserAgentMcpTools(server, { baseUrl, apiKey: callerKey, consoleBaseUrl, savesReportsLocally: false });
+  registerScheduledResultsMcpTools(server, new ScheduledResultsMcpExecutor(baseUrl, callerKey));
+  const memoryExecutor = new HybridMemoryToolExecutor(new MemoryMcpToolExecutor(baseUrl, callerKey), user);
+  registerMemoryMcpTools(server, memoryExecutor);
+  return server;
+}, {
+  legacy: "stateless",
+  responseMode: "auto",
+  onerror(error) {
+    console.error("[mcp] protocol error", error.message);
+  }
+});
+function allowedOrigin(request) {
+  const origin = request.headers.get("origin");
+  if (origin === null) return true;
+  const allowed = /* @__PURE__ */ new Set([
+    "https://mcpscraper.dev",
+    "https://www.mcpscraper.dev",
+    ...process.env.APP_ORIGIN?.trim() ? [process.env.APP_ORIGIN.trim()] : []
+  ]);
+  return allowed.has(origin);
+}
 mcpApp.all("/", async (c) => {
   try {
+    if (!allowedOrigin(c.req.raw)) {
+      return c.json({ jsonrpc: "2.0", id: null, error: { code: -32e3, message: "Forbidden Origin" } }, 403);
+    }
     const keyOrError = await requireMcpCallerKey(c);
     if (keyOrError instanceof Response) return keyOrError;
     const { key: callerKey, user } = keyOrError;
-    const baseUrl = process.env.MCP_SCRAPER_BASE_URL?.trim() ?? process.env.MCP_BASE_URL?.trim() ?? "https://mcpscraper.dev";
-    const executor = new HttpMcpToolExecutor(baseUrl, callerKey);
-    const transport = new WebStandardStreamableHTTPServerTransport({
-      sessionIdGenerator: void 0,
-      enableJsonResponse: true
+    const taskResponse = await handleMcpTasksHttpRequest(
+      c.req.raw,
+      new HttpMcpToolExecutor(
+        process.env.MCP_SCRAPER_BASE_URL?.trim() ?? process.env.MCP_BASE_URL?.trim() ?? "https://mcpscraper.dev",
+        callerKey
+      ),
+      {
+        ownerId: hashOwnerId(callerKey),
+        secret: callerKey,
+        serverInfo: { name: "mcp-scraper", version: PACKAGE_VERSION }
+      }
+    );
+    if (taskResponse) return taskResponse;
+    return mcpHandler.fetch(c.req.raw, {
+      authInfo: {
+        token: callerKey,
+        clientId: `mcp-scraper-user-${user.id}`,
+        scopes: ["mcp:tools"],
+        extra: { user }
+      }
     });
-    const consoleBaseUrl = process.env.BROWSER_AGENT_CONSOLE_URL?.trim() || baseUrl;
-    const server = buildPaaExtractorMcpServer(executor, { savesReportsLocally: false, ownerId: hashOwnerId(callerKey) });
-    registerSerpIntelligenceCaptureTools(server, executor);
-    registerBrowserAgentMcpTools(server, { baseUrl, apiKey: callerKey, consoleBaseUrl, savesReportsLocally: false });
-    registerScheduledResultsMcpTools(server, new ScheduledResultsMcpExecutor(baseUrl, callerKey));
-    const memoryExecutor = new HybridMemoryToolExecutor(new MemoryMcpToolExecutor(baseUrl, callerKey), user);
-    registerMemoryMcpTools(server, memoryExecutor);
-    await server.connect(transport);
-    return transport.handleRequest(c.req.raw);
   } catch {
     return c.json({ error: "Internal Server Error" }, 500);
   }
 });
 
 // src/api/browser-agent-routes.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 import { Hono as Hono21 } from "hono";
 
 // src/api/browser-agent-db.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var _ready = false;
 var _migrationPromise = null;
 async function migrateBrowserAgent() {
@@ -22878,7 +23112,7 @@ async function runBrowserAgentMigration() {
 }
 async function createExtensionRow(input) {
   const db = getDb();
-  const id = `bext_${randomUUID9().replace(/-/g, "").slice(0, 20)}`;
+  const id = `bext_${randomUUID10().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_agent_extensions (id, user_id, name, backend_id, backend_name, source, source_url, size_bytes)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
@@ -22913,7 +23147,7 @@ async function deleteExtensionRow(userId, name) {
 }
 async function createAuthConnectionRow(input) {
   const db = getDb();
-  const connectionId = `authc_${randomUUID9().replace(/-/g, "").slice(0, 20)}`;
+  const connectionId = `authc_${randomUUID10().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_auth_connections (connection_id, domain, profile, account_email, note, status, browser_agent_session_id)
           VALUES (?, ?, ?, ?, ?, 'NEEDS_AUTH', ?)`,
@@ -22998,7 +23232,7 @@ async function deleteProfileLabel(userId, profile) {
 }
 async function createSessionRow(input) {
   const db = getDb();
-  const id = `bas_${randomUUID9().replace(/-/g, "").slice(0, 20)}`;
+  const id = `bas_${randomUUID10().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_agent_sessions (id, runtime_session_id, live_view_url, cdp_ws_url, status, label, user_id, concurrency_lock_id, last_action_at)
           VALUES (?, ?, ?, ?, 'open', ?, ?, ?, datetime('now'))`,
@@ -23067,7 +23301,7 @@ async function recordAction(input) {
     sql: `INSERT INTO browser_agent_actions (id, session_id, type, params_json, ok, error)
           VALUES (?, ?, ?, ?, ?, ?)`,
     args: [
-      `baa_${randomUUID9().replace(/-/g, "").slice(0, 20)}`,
+      `baa_${randomUUID10().replace(/-/g, "").slice(0, 20)}`,
       input.sessionId,
       input.type,
       input.params == null ? null : JSON.stringify(input.params),
@@ -24798,7 +25032,7 @@ function buildBrowserAgentRoutes() {
     }
     const existing = await getExtensionRow(user.id, name);
     if (existing) return c.json({ error: `an extension named "${name}" already exists \u2014 delete it first or pick another name` }, 409);
-    const backendName = `u${user.id}_${randomUUID10().replace(/-/g, "")}`;
+    const backendName = `u${user.id}_${randomUUID11().replace(/-/g, "")}`;
     try {
       const imported = await importExtensionFromStore(storeUrl, backendName);
       const row = await createExtensionRow({
@@ -25292,7 +25526,7 @@ async function resolveUser3(customerId, emailFallback) {
 // src/api/oauth-routes.ts
 import { Hono as Hono23 } from "hono";
 import { getCookie, setCookie } from "hono/cookie";
-import { createHash as createHash8, randomBytes as randomBytes2, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash8, randomBytes as randomBytes2, randomUUID as randomUUID12 } from "crypto";
 import { importPKCS8, exportJWK, SignJWT } from "jose";
 var ISSUER = "https://mcpscraper.dev";
 var RESOURCE = () => process.env.MCP_MEMORY_RESOURCE_URL ?? "https://memory.mcpscraper.dev/mcp";
@@ -25366,9 +25600,9 @@ function negotiateScope(requested, user, resource) {
   if (operator && !unique2.includes("memory.admin")) unique2.push("memory.admin");
   return unique2.join(" ");
 }
-async function sessionUser(token3) {
-  if (!token3) return null;
-  const userId = verifySession(token3);
+async function sessionUser(token4) {
+  if (!token4) return null;
+  const userId = verifySession(token4);
   if (!userId) return null;
   const user = await getUserById(userId);
   return user ?? null;
@@ -25640,7 +25874,7 @@ function pkceMatches(verifier, challenge) {
 }
 async function mintAccessToken(identity, scope, plan, audience) {
   const { privateKey, kid } = await getKeys();
-  return new SignJWT({ scope, plan }).setProtectedHeader({ alg: "RS256", kid }).setIssuer(ISSUER).setSubject(identity).setAudience(audience).setIssuedAt().setJti(randomUUID11()).setExpirationTime(`${ACCESS_TTL_SECONDS}s`).sign(privateKey);
+  return new SignJWT({ scope, plan }).setProtectedHeader({ alg: "RS256", kid }).setIssuer(ISSUER).setSubject(identity).setAudience(audience).setIssuedAt().setJti(randomUUID12()).setExpirationTime(`${ACCESS_TTL_SECONDS}s`).sign(privateKey);
 }
 function tokenErrorResponse(c, error, description, status) {
   return c.json({ error, error_description: description }, status);
@@ -25715,35 +25949,35 @@ oauthApp.post("/oauth/token", async (c) => {
 // src/api/chat-routes.ts
 import { Hono as Hono24 } from "hono";
 var chatApp = new Hono24();
-function tokenOk(token3) {
-  return !!token3 && token3.startsWith("mk_") && token3.length > 10;
+function tokenOk(token4) {
+  return !!token4 && token4.startsWith("mk_") && token4.length > 10;
 }
 function jsonError(message, status = 400) {
   return new Response(JSON.stringify({ ok: false, error: message }), { status, headers: { "content-type": "application/json" } });
 }
 chatApp.get("/api/channels", async (c) => {
-  const token3 = c.req.query("token");
-  if (!tokenOk(token3)) return jsonError("missing or malformed token", 401);
-  const r = await memoryCall("listVaultsTool", {}, token3);
+  const token4 = c.req.query("token");
+  if (!tokenOk(token4)) return jsonError("missing or malformed token", 401);
+  const r = await memoryCall("listVaultsTool", {}, token4);
   if (!r.ok) return c.json(r);
   const vaults = (r.vaults ?? []).filter((v) => v.kind === "channel");
   return c.json({ ok: true, channels: vaults });
 });
 chatApp.get("/api/messages", async (c) => {
-  const token3 = c.req.query("token");
-  if (!tokenOk(token3)) return jsonError("missing or malformed token", 401);
+  const token4 = c.req.query("token");
+  if (!tokenOk(token4)) return jsonError("missing or malformed token", 401);
   const vault = c.req.query("vault");
   if (!vault) return jsonError("vault is required");
   const parentMessageId = c.req.query("parentMessageId") || void 0;
-  const r = await memoryCall("listChannelMessagesTool", { vault, parentMessageId }, token3);
+  const r = await memoryCall("listChannelMessagesTool", { vault, parentMessageId }, token4);
   return c.json(r);
 });
 chatApp.get("/api/poll", async (c) => {
-  const token3 = c.req.query("token");
-  if (!tokenOk(token3)) return jsonError("missing or malformed token", 401);
+  const token4 = c.req.query("token");
+  if (!tokenOk(token4)) return jsonError("missing or malformed token", 401);
   const vault = c.req.query("vault");
   if (!vault) return jsonError("vault is required");
-  const r = await memoryCall("pollChannelTool", { vault }, token3);
+  const r = await memoryCall("pollChannelTool", { vault }, token4);
   return c.json(r);
 });
 function parseAttachNote(v) {
@@ -25768,12 +26002,12 @@ chatApp.post("/api/reply", async (c) => {
   return c.json(r);
 });
 chatApp.get("/api/notes-own", async (c) => {
-  const token3 = c.req.query("token");
-  if (!tokenOk(token3)) return jsonError("missing or malformed token", 401);
-  const vaultsRes = await memoryCall("listVaultsTool", {}, token3);
+  const token4 = c.req.query("token");
+  if (!tokenOk(token4)) return jsonError("missing or malformed token", 401);
+  const vaultsRes = await memoryCall("listVaultsTool", {}, token4);
   if (!vaultsRes.ok) return c.json(vaultsRes);
   const ownVaults = (vaultsRes.vaults ?? []).filter((v) => v.role === "owner" && v.kind === "notes");
-  const lists = await Promise.all(ownVaults.map((v) => memoryCall("listTool", { vault: v.handle }, token3)));
+  const lists = await Promise.all(ownVaults.map((v) => memoryCall("listTool", { vault: v.handle }, token4)));
   const notes = ownVaults.flatMap((v, i) => {
     const r = lists[i];
     return r.ok ? (r.notes ?? []).map((n) => ({ vault: v.handle, path: n.path, title: n.title })) : [];
@@ -25781,12 +26015,12 @@ chatApp.get("/api/notes-own", async (c) => {
   return c.json({ ok: true, notes });
 });
 chatApp.get("/api/message-note", async (c) => {
-  const token3 = c.req.query("token");
-  if (!tokenOk(token3)) return jsonError("missing or malformed token", 401);
+  const token4 = c.req.query("token");
+  if (!tokenOk(token4)) return jsonError("missing or malformed token", 401);
   const vault = c.req.query("vault");
   const messageId = c.req.query("messageId");
   if (!vault || !messageId) return jsonError("vault and messageId are required");
-  const r = await memoryCall("getMessageNoteTool", { vault, messageId }, token3);
+  const r = await memoryCall("getMessageNoteTool", { vault, messageId }, token4);
   return c.json(r);
 });
 chatApp.post("/api/react", async (c) => {
@@ -25797,17 +26031,17 @@ chatApp.post("/api/react", async (c) => {
   return c.json(r);
 });
 chatApp.get("/api/mentions", async (c) => {
-  const token3 = c.req.query("token");
-  if (!tokenOk(token3)) return jsonError("missing or malformed token", 401);
-  const r = await memoryCall("myMentionsTool", {}, token3);
+  const token4 = c.req.query("token");
+  if (!tokenOk(token4)) return jsonError("missing or malformed token", 401);
+  const r = await memoryCall("myMentionsTool", {}, token4);
   return c.json(r);
 });
 chatApp.get("/api/members", async (c) => {
-  const token3 = c.req.query("token");
-  if (!tokenOk(token3)) return jsonError("missing or malformed token", 401);
+  const token4 = c.req.query("token");
+  if (!tokenOk(token4)) return jsonError("missing or malformed token", 401);
   const vault = c.req.query("vault");
   if (!vault) return jsonError("vault is required");
-  const r = await memoryCall("listChannelMembersTool", { vault }, token3);
+  const r = await memoryCall("listChannelMembersTool", { vault }, token4);
   return c.json(r);
 });
 chatApp.post("/api/channel", async (c) => {
@@ -25843,13 +26077,13 @@ chatApp.post("/api/member-remove", async (c) => {
   return c.json(r);
 });
 chatApp.get("/:token", (c) => {
-  const token3 = c.req.param("token");
-  if (!tokenOk(token3)) {
+  const token4 = c.req.param("token");
+  if (!tokenOk(token4)) {
     return c.html(`<!doctype html><html><body style="font-family:system-ui;padding:40px;color:#3D3548"><h2>This chat link isn't valid.</h2><p>Ask the AI to run get-chat-link again, or revoke-chat-link then get-chat-link if you think it was compromised.</p></body></html>`, 401);
   }
-  return c.html(renderChatPage(token3));
+  return c.html(renderChatPage(token4));
 });
-function renderChatPage(token3) {
+function renderChatPage(token4) {
   return `<!doctype html>
 <html>
 <head>
@@ -26034,7 +26268,7 @@ function renderChatPage(token3) {
 </div>
 
 <script>
-const TOKEN = ${JSON.stringify(token3)};
+const TOKEN = ${JSON.stringify(token4)};
 const state = { channels: [], activeVault: null, activeName: null, members: [], threadParent: null, pollTimer: null, pendingAttach: null, threadPendingAttach: null, ownNotes: null, pickerTarget: 'main' };
 
 function api(path, opts) {
@@ -26404,8 +26638,8 @@ var MAX_VAULT_RECORDS = 200;
 var MAX_MEMORY_READ_CONCURRENCY = 4;
 var MAX_MEMORY_READ_ATTEMPTS = 3;
 var vaultApp = new Hono25();
-function validToken(token3) {
-  return !!token3 && token3.startsWith("mk_") && token3.length > 20 && token3.length < 256;
+function validToken(token4) {
+  return !!token4 && token4.startsWith("mk_") && token4.length > 20 && token4.length < 256;
 }
 function isVault(value) {
   return typeof value === "string" && VAULTS.includes(value);
@@ -26531,11 +26765,11 @@ function shouldRetryMemoryRead(error) {
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
-async function readMemory(tool, args, token3) {
-  let result = await memoryCall(tool, args, token3);
+async function readMemory(tool, args, token4) {
+  let result = await memoryCall(tool, args, token4);
   for (let attempt = 1; !result.ok && attempt < MAX_MEMORY_READ_ATTEMPTS && shouldRetryMemoryRead(result.error); attempt += 1) {
     await sleep(attempt * 150);
-    result = await memoryCall(tool, args, token3);
+    result = await memoryCall(tool, args, token4);
   }
   return result;
 }
@@ -26552,27 +26786,27 @@ async function mapWithConcurrency3(items, limit, map) {
   await Promise.all(Array.from({ length: Math.min(limit, items.length) }, () => worker()));
   return values;
 }
-async function readVault(vault, token3) {
-  const list = await readMemory("listTool", { vault }, token3);
+async function readVault(vault, token4) {
+  const list = await readMemory("listTool", { vault }, token4);
   if (!list.ok) throw new Error(list.error ?? `unable to read ${vault}`);
   const noteRefs = (list.notes ?? []).slice(0, MAX_VAULT_RECORDS);
   const notes = await mapWithConcurrency3(
     noteRefs,
     MAX_MEMORY_READ_CONCURRENCY,
-    ({ path: path5 }) => readMemory("getTool", { vault, path: path5 }, token3)
+    ({ path: path5 }) => readMemory("getTool", { vault, path: path5 }, token4)
   );
   const failed = notes.find((result) => !result.ok);
   if (failed && !failed.ok) throw new Error(failed.error ?? `unable to read ${vault} record`);
   return notes.filter((result) => result.ok && !!result.note).map((result) => workspaceRecord(vault, result.note));
 }
 vaultApp.get("/api/workspace", async (c) => {
-  const token3 = c.req.query("token");
-  if (!validToken(token3)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
+  const token4 = c.req.query("token");
+  if (!validToken(token4)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
   try {
     const requested = c.req.query("vault");
     const vaults = isVault(requested) ? [requested] : VAULTS;
     const results = [];
-    for (const vault of vaults) results.push(await readVault(vault, token3));
+    for (const vault of vaults) results.push(await readVault(vault, token4));
     const records = results.flat().sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
     return c.json({ ok: true, records, limited: results.some((result) => result.length >= 200) });
   } catch (error) {
@@ -26581,8 +26815,8 @@ vaultApp.get("/api/workspace", async (c) => {
 });
 vaultApp.post("/api/records", async (c) => {
   const body = await c.req.json().catch(() => ({}));
-  const token3 = typeof body.token === "string" ? body.token : void 0;
-  if (!validToken(token3)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
+  const token4 = typeof body.token === "string" ? body.token : void 0;
+  if (!validToken(token4)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
   const vault = body.vault;
   const path5 = stringValue(body.path, 320);
   const title = stringValue(body.title, 320);
@@ -26593,19 +26827,19 @@ vaultApp.post("/api/records", async (c) => {
   const validationError = validateNewRecord(vault, normalizedProps);
   if (validationError) return c.json({ ok: false, error: validationError }, 400);
   const baseRevision = typeof body.baseRevision === "number" && Number.isInteger(body.baseRevision) ? body.baseRevision : void 0;
-  const result = await memoryCall("putTool", { vault, path: path5, title, content: content || title, props: normalizedProps, ...baseRevision === void 0 ? {} : { baseRevision } }, token3);
+  const result = await memoryCall("putTool", { vault, path: path5, title, content: content || title, props: normalizedProps, ...baseRevision === void 0 ? {} : { baseRevision } }, token4);
   return c.json(result, result.ok ? 200 : result.conflict ? 409 : 502);
 });
 vaultApp.post("/api/records/transition", async (c) => {
   const body = await c.req.json().catch(() => ({}));
-  const token3 = typeof body.token === "string" ? body.token : void 0;
-  if (!validToken(token3)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
+  const token4 = typeof body.token === "string" ? body.token : void 0;
+  if (!validToken(token4)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
   const vault = typeof body.vault === "string" ? body.vault : "";
   const path5 = typeof body.path === "string" ? body.path : "";
   const status = stringValue(body.status, 80);
   const baseRevision = typeof body.baseRevision === "number" && Number.isInteger(body.baseRevision) ? body.baseRevision : void 0;
   if (!isVault(vault) || !path5 || !status) return c.json({ ok: false, error: "valid vault, path, and status are required" }, 400);
-  const current = await readMemory("getTool", { vault, path: path5 }, token3);
+  const current = await readMemory("getTool", { vault, path: path5 }, token4);
   if (!current.ok || !current.note) return c.json(current, current.ok ? 404 : 502);
   const result = await memoryCall("putTool", {
     vault,
@@ -26614,13 +26848,13 @@ vaultApp.post("/api/records/transition", async (c) => {
     content: current.note.content,
     props: { ...current.note.props ?? {}, status },
     baseRevision: baseRevision ?? current.note.revision
-  }, token3);
+  }, token4);
   return c.json(result, result.ok ? 200 : result.conflict ? 409 : 502);
 });
 vaultApp.post("/api/records/update", async (c) => {
   const body = await c.req.json().catch(() => ({}));
-  const token3 = typeof body.token === "string" ? body.token : void 0;
-  if (!validToken(token3)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
+  const token4 = typeof body.token === "string" ? body.token : void 0;
+  if (!validToken(token4)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
   const vault = body.vault;
   const path5 = stringValue(body.path, 320);
   const title = typeof body.title === "string" ? stringValue(body.title, 320) : void 0;
@@ -26630,7 +26864,7 @@ vaultApp.post("/api/records/update", async (c) => {
   if (!isVault(vault) || !path5 || body.title !== void 0 && !title || body.props !== void 0 && !props) {
     return c.json({ ok: false, error: "valid vault, path, and optional record fields are required" }, 400);
   }
-  const current = await readMemory("getTool", { vault, path: path5 }, token3);
+  const current = await readMemory("getTool", { vault, path: path5 }, token4);
   if (!current.ok || !current.note) return c.json(current, current.ok ? 404 : 502);
   const nextProps = normalizeRelationshipProps(vault, { ...current.note.props ?? {}, ...props ?? {} });
   const validationError = validateNewRecord(vault, nextProps);
@@ -26642,18 +26876,18 @@ vaultApp.post("/api/records/update", async (c) => {
     content: content ?? current.note.content,
     props: nextProps,
     baseRevision: baseRevision ?? current.note.revision
-  }, token3);
+  }, token4);
   return c.json(result, result.ok ? 200 : result.conflict ? 409 : 502);
 });
 vaultApp.delete("/api/records", async (c) => {
   const body = await c.req.json().catch(() => ({}));
-  const token3 = typeof body.token === "string" ? body.token : void 0;
-  if (!validToken(token3)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
+  const token4 = typeof body.token === "string" ? body.token : void 0;
+  if (!validToken(token4)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
   const vault = body.vault;
   const path5 = stringValue(body.path, 320);
   const baseRevision = typeof body.baseRevision === "number" && Number.isInteger(body.baseRevision) ? body.baseRevision : void 0;
   if (vault !== "Tasks" || !path5) return c.json({ ok: false, error: "only a valid task record can be deleted" }, 400);
-  const current = await readMemory("getTool", { vault, path: path5 }, token3);
+  const current = await readMemory("getTool", { vault, path: path5 }, token4);
   if (!current.ok || !current.note) return c.json(current, current.ok ? 404 : 502);
   if (!["task", "milestone"].includes(typeof current.note.props?.type === "string" ? current.note.props.type : defaultType("Tasks"))) {
     return c.json({ ok: false, error: "only task records can be deleted" }, 400);
@@ -26662,13 +26896,13 @@ vaultApp.delete("/api/records", async (c) => {
     vault,
     path: path5,
     baseRevision: baseRevision ?? current.note.revision
-  }, token3);
+  }, token4);
   return c.json(result, result.ok ? 200 : result.conflict ? 409 : 502);
 });
 vaultApp.post("/api/communications/review", async (c) => {
   const body = await c.req.json().catch(() => ({}));
-  const token3 = typeof body.token === "string" ? body.token : void 0;
-  if (!validToken(token3)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
+  const token4 = typeof body.token === "string" ? body.token : void 0;
+  if (!validToken(token4)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
   const path5 = stringValue(body.path, 320);
   const action = stringValue(body.action, 24);
   const title = typeof body.title === "string" ? stringValue(body.title, 320) : void 0;
@@ -26679,7 +26913,7 @@ vaultApp.post("/api/communications/review", async (c) => {
   if (!path5 || !normalizedAction || !["approve", "deny", "edit"].includes(normalizedAction) || body.title !== void 0 && !title) {
     return c.json({ ok: false, error: "valid path, action, and optional draft fields are required" }, 400);
   }
-  const current = await readMemory("getTool", { vault: "Communications", path: path5 }, token3);
+  const current = await readMemory("getTool", { vault: "Communications", path: path5 }, token4);
   if (!current.ok || !current.note) return c.json(current, current.ok ? 404 : 502);
   if (current.note.props?.type !== "email") return c.json({ ok: false, error: "only email communications can be reviewed" }, 400);
   const reviewed = normalizedAction === "approve" || normalizedAction === "deny";
@@ -26703,13 +26937,13 @@ vaultApp.post("/api/communications/review", async (c) => {
     content: content ?? current.note.content,
     props,
     baseRevision: baseRevision ?? current.note.revision
-  }, token3);
+  }, token4);
   return c.json(result, result.ok ? 200 : result.conflict ? 409 : 502);
 });
 vaultApp.post("/api/activity", async (c) => {
   const body = await c.req.json().catch(() => ({}));
-  const token3 = typeof body.token === "string" ? body.token : void 0;
-  if (!validToken(token3)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
+  const token4 = typeof body.token === "string" ? body.token : void 0;
+  if (!validToken(token4)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
   const title = stringValue(body.title, 320);
   const content = typeof body.content === "string" && body.content.length <= 2e4 ? body.content : "";
   const props = propsValue(body.props) ?? {};
@@ -26719,7 +26953,7 @@ vaultApp.post("/api/activity", async (c) => {
     return c.json({ ok: false, error: "Activities require at least one canonical People reference in person_refs" }, 400);
   }
   for (const ref of personRefs) {
-    const person = await readMemory("getTool", { vault: "People", path: ref.replace(/^People::/, "") }, token3);
+    const person = await readMemory("getTool", { vault: "People", path: ref.replace(/^People::/, "") }, token4);
     if (!person.ok || !person.note || !["person", "organization"].includes(String(person.note.props?.type ?? ""))) {
       return c.json({ ok: false, error: `Activity person reference is not a known People record: ${ref}` }, 400);
     }
@@ -26747,37 +26981,37 @@ vaultApp.post("/api/activity", async (c) => {
       ...props,
       person_refs: personRefs
     }
-  }, token3);
+  }, token4);
   return c.json(result, result.ok ? 200 : 502);
 });
 
 // src/api/schedule-routes.ts
 import { Hono as Hono26 } from "hono";
 var scheduleApp = new Hono26();
-function tokenOk2(token3) {
-  return !!token3 && token3.startsWith("mk_") && token3.length > 10;
+function tokenOk2(token4) {
+  return !!token4 && token4.startsWith("mk_") && token4.length > 10;
 }
 function jsonError2(message, status = 400) {
   return new Response(JSON.stringify({ ok: false, error: message }), { status, headers: { "content-type": "application/json" } });
 }
 scheduleApp.get("/api/status", async (c) => {
-  const token3 = c.req.query("token");
-  if (!tokenOk2(token3)) return jsonError2("missing or malformed token", 401);
-  const r = await memoryCall("getScheduleStatusTool", {}, token3);
+  const token4 = c.req.query("token");
+  if (!tokenOk2(token4)) return jsonError2("missing or malformed token", 401);
+  const r = await memoryCall("getScheduleStatusTool", {}, token4);
   return c.json(r);
 });
 scheduleApp.get("/api/vaults", async (c) => {
-  const token3 = c.req.query("token");
-  if (!tokenOk2(token3)) return jsonError2("missing or malformed token", 401);
-  const r = await memoryCall("listVaultsTool", {}, token3);
+  const token4 = c.req.query("token");
+  if (!tokenOk2(token4)) return jsonError2("missing or malformed token", 401);
+  const r = await memoryCall("listVaultsTool", {}, token4);
   if (!r.ok) return c.json(r);
   const vaults = (r.vaults ?? []).filter((v) => v.kind !== "channel");
   return c.json({ ok: true, vaults });
 });
 scheduleApp.get("/api/actions", async (c) => {
-  const token3 = c.req.query("token");
-  if (!tokenOk2(token3)) return jsonError2("missing or malformed token", 401);
-  const r = await memoryCall("listScheduledActionsTool", {}, token3);
+  const token4 = c.req.query("token");
+  if (!tokenOk2(token4)) return jsonError2("missing or malformed token", 401);
+  const r = await memoryCall("listScheduledActionsTool", {}, token4);
   return c.json(r);
 });
 scheduleApp.post("/api/propose", async (c) => {
@@ -26813,13 +27047,13 @@ scheduleApp.post("/api/actions/:id/delete", async (c) => {
   return c.json(r);
 });
 scheduleApp.get("/:token", (c) => {
-  const token3 = c.req.param("token");
-  if (!tokenOk2(token3)) {
+  const token4 = c.req.param("token");
+  if (!tokenOk2(token4)) {
     return c.html(`<!doctype html><html><body style="font-family:system-ui;padding:40px;color:#3D3548"><h2>This automations link isn't valid.</h2><p>Ask the AI to run get-schedule-link again, or revoke-schedule-link then get-schedule-link if you think it was compromised.</p></body></html>`, 401);
   }
-  return c.html(renderSchedulePage(token3));
+  return c.html(renderSchedulePage(token4));
 });
-function renderSchedulePage(token3) {
+function renderSchedulePage(token4) {
   return `<!doctype html>
 <html>
 <head>
@@ -26917,7 +27151,7 @@ function renderSchedulePage(token3) {
 </div>
 
 <script>
-const TOKEN = ${JSON.stringify(token3)};
+const TOKEN = ${JSON.stringify(token4)};
 const state = { actions: [], vaults: [] };
 
 function api(path, opts) { return fetch('/schedule' + path, opts).then(r => r.json()); }
@@ -27160,8 +27394,8 @@ function supportThreadToken(customerEmail, normalizedSubject) {
   return shortHash(`${customerEmail.trim().toLowerCase()}
 ${normalizeSupportSubject(normalizedSubject).toLowerCase()}`);
 }
-function supportThreadAddress(token3, receivingDomain) {
-  const safeToken = token3.toLowerCase().replace(/[^a-f0-9]/g, "").slice(0, 24);
+function supportThreadAddress(token4, receivingDomain) {
+  const safeToken = token4.toLowerCase().replace(/[^a-f0-9]/g, "").slice(0, 24);
   const domain = receivingDomain.trim().toLowerCase();
   if (!safeToken || !/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(domain)) throw new Error("invalid support thread address");
   return `support+${safeToken}@${domain}`;
@@ -27188,8 +27422,8 @@ function personPath(identity) {
   const local = identity.email.split("@")[0];
   return `contacts/${safePathPart(identity.name === identity.email ? local : identity.name)}-${shortHash(identity.email, 12)}`;
 }
-function issuePath(token3) {
-  return `support/threads/${token3}`;
+function issuePath(token4) {
+  return `support/threads/${token4}`;
 }
 function communicationPath(email) {
   const date = cleanLine(email.created_at, (/* @__PURE__ */ new Date()).toISOString()).slice(0, 10).replace(/[^0-9-]/g, "");
@@ -27373,8 +27607,8 @@ function buildIssueContent(email, customer, personPathValue, threadAddressValue)
     `- Person: ${noteRef("People", personPathValue)}`
   ].join("\n");
 }
-async function findOrCreateIssue(memoryKey, email, customer, personPathValue, token3, threadAddressValue) {
-  const path5 = issuePath(token3);
+async function findOrCreateIssue(memoryKey, email, customer, personPathValue, token4, threadAddressValue) {
+  const path5 = issuePath(token4);
   const existing = await getNote(memoryKey, "Issues", path5);
   if (existing) return existing;
   const subject = normalizeSupportSubject(email.subject);
@@ -27384,7 +27618,7 @@ async function findOrCreateIssue(memoryKey, email, customer, personPathValue, to
     path: path5,
     title: `Support thread \u2014 ${subject} \u2014 ${customer.email}`.slice(0, 240),
     content: buildIssueContent(email, customer, personPathValue, threadAddressValue),
-    source: `resend:thread:${token3}`,
+    source: `resend:thread:${token4}`,
     type: "user_friction",
     tagCandidates: ISSUE_TAGS,
     props: {
@@ -27393,7 +27627,7 @@ async function findOrCreateIssue(memoryKey, email, customer, personPathValue, to
       summary,
       pinned: false,
       source_type: "thread",
-      source_ref: `resend:thread:${token3}`,
+      source_ref: `resend:thread:${token4}`,
       related: [],
       related_vault_notes: [noteRef("People", personPathValue)],
       embed: true,
@@ -27408,7 +27642,7 @@ async function findOrCreateIssue(memoryKey, email, customer, personPathValue, to
       customer_email: customer.email,
       customer_name: customer.name,
       normalized_subject: subject,
-      thread_token: token3,
+      thread_token: token4,
       thread_address: threadAddressValue,
       communication_refs: [],
       message_count: 0,
@@ -27451,7 +27685,7 @@ function buildCommunicationContent(email, customer, direction, personPathValue,
     ...parentPath ? [`- Previous message: [[${parentPath}]]`] : []
   ].join("\n");
 }
-async function captureCommunication(memoryKey, email, customer, direction, personPathValue, issuePathValue, token3, parentPath) {
+async function captureCommunication(memoryKey, email, customer, direction, personPathValue, issuePathValue, token4, parentPath) {
   const path5 = communicationPath(email);
   const existing = await getNote(memoryKey, "Communication", path5);
   if (existing) return existing;
@@ -27490,8 +27724,8 @@ async function captureCommunication(memoryKey, email, customer, direction, perso
       provider: "resend",
       provider_connection_ref: "resend:updates.mcpscraper.dev",
       provider_message_ref: providerMessageRef,
-      provider_thread_ref: token3,
-      thread_ref: token3,
+      provider_thread_ref: token4,
+      thread_ref: token4,
       issue_ref: issuePathValue,
       sender_email: supportSender(email)?.email ?? email.from,
       recipient_emails: email.to ?? [],
@@ -27551,8 +27785,8 @@ async function updateIssueThread(memoryKey, issuePathValue, email, communication
     if (!result.conflict || attempt === 1) throw new Error(result.error ?? "support thread issue update failed");
   }
 }
-async function getSupportThreadByToken(memoryKey, token3) {
-  const safeToken = token3.toLowerCase().replace(/[^a-f0-9]/g, "").slice(0, 24);
+async function getSupportThreadByToken(memoryKey, token4) {
+  const safeToken = token4.toLowerCase().replace(/[^a-f0-9]/g, "").slice(0, 24);
   if (safeToken.length !== 24) return null;
   const path5 = issuePath(safeToken);
   const issue = await getNote(memoryKey, "Issues", path5);
@@ -27580,8 +27814,8 @@ async function captureSupportMessage(memoryKey, email, options) {
   const customer = options.customer ?? supportSender(email);
   if (!customer) throw new Error("support sender does not contain a usable email address");
   const normalizedSubject = options.existingThread?.normalizedSubject ?? normalizeSupportSubject(email.subject);
-  const token3 = options.existingThread?.threadToken ?? supportThreadToken(customer.email, normalizedSubject);
-  const threadAddressValue = options.existingThread?.threadAddress ?? supportThreadAddress(token3, options.receivingDomain);
+  const token4 = options.existingThread?.threadToken ?? supportThreadToken(customer.email, normalizedSubject);
+  const threadAddressValue = options.existingThread?.threadAddress ?? supportThreadAddress(token4, options.receivingDomain);
   const person = options.existingThread ? await getNote(memoryKey, "People", options.existingThread.personPath) : await findOrCreatePerson(memoryKey, customer, email.created_at);
   if (!person) throw new Error("support person could not be resolved");
   const issue = options.existingThread?.issue ?? await findOrCreateIssue(
@@ -27589,7 +27823,7 @@ async function captureSupportMessage(memoryKey, email, options) {
     email,
     customer,
     person.path,
-    token3,
+    token4,
     threadAddressValue
   );
   const parentPath = typeof issue.props?.last_communication_ref === "string" ? issue.props.last_communication_ref : void 0;
@@ -27600,7 +27834,7 @@ async function captureSupportMessage(memoryKey, email, options) {
     options.direction,
     person.path,
     issue.path,
-    token3,
+    token4,
     parentPath
   );
   await updateIssueThread(memoryKey, issue.path, email, communication.path, options.direction, person.path);
@@ -27609,7 +27843,7 @@ async function captureSupportMessage(memoryKey, email, options) {
     communicationPath: communication.path,
     personPath: person.path,
     parentCommunicationPath: parentPath,
-    threadToken: token3,
+    threadToken: token4,
     threadAddress: threadAddressValue,
     customerEmail: customer.email,
     normalizedSubject,
@@ -27782,8 +28016,8 @@ resendInboundApp.post("/webhooks", async (c) => {
         threadAddress: captured.threadAddress
       });
     }
-    const token3 = extractSupportThreadToken(receivedEvent.data.to ?? [], ...domains);
-    const thread = token3 ? await getSupportThreadByToken(memoryKey, token3) : null;
+    const token4 = extractSupportThreadToken(receivedEvent.data.to ?? [], ...domains);
+    const thread = token4 ? await getSupportThreadByToken(memoryKey, token4) : null;
     if (!thread) return c.json({ ok: true, route, ignored: true, reason: "unknown-support-thread" });
     const operator = parseMailbox(destination);
     if (operator && sender.email === operator.email) {
@@ -28090,7 +28324,7 @@ function renderWorkshopFieldNotesBody() {
 }
 
 // src/api/workshop-registration-repository.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 function rowToRegistration(row) {
   return {
     id: String(row.id),
@@ -28159,7 +28393,7 @@ async function claimWorkshopRegistration(input) {
       ) < ?
     `,
     args: [
-      randomUUID12(),
+      randomUUID13(),
       input.eventSlug,
       input.email,
       input.firstName,
@@ -28176,7 +28410,7 @@ async function claimWorkshopRegistration(input) {
         id, event_slug, email, first_name, last_name, status
       ) VALUES (?, ?, ?, ?, ?, 'waitlisted')
     `,
-    args: [randomUUID12(), input.eventSlug, input.email, input.firstName, input.lastName || null]
+    args: [randomUUID13(), input.eventSlug, input.email, input.firstName, input.lastName || null]
   });
   const waitlisted = await getWorkshopRegistration(input.eventSlug, input.email);
   if (!waitlisted) throw new Error("workshop registration could not be claimed");
@@ -28191,7 +28425,7 @@ async function registerWorkshopInterest(input) {
         id, event_slug, email, first_name, last_name, status
       ) VALUES (?, ?, ?, ?, ?, 'interested')
     `,
-    args: [randomUUID12(), input.eventSlug, input.email, input.firstName, input.lastName || null]
+    args: [randomUUID13(), input.eventSlug, input.email, input.firstName, input.lastName || null]
   });
   const registration = await getWorkshopRegistration(input.eventSlug, input.email);
   if (!registration) throw new Error("workshop interest could not be recorded");
@@ -28629,16 +28863,16 @@ import { z as z29 } from "zod";
 // src/editorial-reading-room/render.ts
 import { createHash as createHash10 } from "crypto";
 import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, join as join5, resolve } from "path";
+import { dirname as dirname3, join as join6, resolve } from "path";
 import { Marked, Renderer } from "marked";
-var runtimeEntryDir = dirname2(resolve(process.argv[1] || process.cwd()));
+var runtimeEntryDir = dirname3(resolve(process.argv[1] || process.cwd()));
 var assetCache = /* @__PURE__ */ new Map();
 function assetPath(name) {
   const candidates = [
-    join5(runtimeEntryDir, "editorial-reading-room", "assets", name),
-    join5(runtimeEntryDir, "..", "editorial-reading-room", "assets", name),
-    join5(process.cwd(), "src", "editorial-reading-room", "assets", name),
-    join5(process.cwd(), "dist", "editorial-reading-room", "assets", name)
+    join6(runtimeEntryDir, "editorial-reading-room", "assets", name),
+    join6(runtimeEntryDir, "..", "editorial-reading-room", "assets", name),
+    join6(process.cwd(), "src", "editorial-reading-room", "assets", name),
+    join6(process.cwd(), "dist", "editorial-reading-room", "assets", name)
   ];
   for (const candidate of candidates) {
     try {
@@ -28650,8 +28884,8 @@ function assetPath(name) {
   throw new Error(`Editorial reading-room template asset is missing: ${name}`);
 }
 function readAsset(name) {
-  const cached = assetCache.get(name);
-  if (cached !== void 0) return cached;
+  const cached2 = assetCache.get(name);
+  if (cached2 !== void 0) return cached2;
   const value = readFileSync3(assetPath(name), "utf8");
   assetCache.set(name, value);
   return value;
@@ -28851,20 +29085,20 @@ ${provenance}`;
 var EDITORIAL_READING_ROOM_ARTIFACT_PREFIX = "editorial-reading-rooms/";
 var EDITORIAL_READING_ROOM_ARTIFACT_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var EDITORIAL_READING_ROOM_DOWNLOAD_TTL_MS = 15 * 60 * 1e3;
-function token() {
+function token2() {
   return process.env.EDITORIAL_READING_ROOM_ARTIFACT_READ_WRITE_TOKEN?.trim() || process.env.PRIVATE_ARTIFACT_READ_WRITE_TOKEN?.trim() || process.env.CONNECTED_DATA_READ_WRITE_TOKEN?.trim() || process.env.CONNECTED_DATA_BLOB_READ_WRITE_TOKEN?.trim() || null;
 }
-function policy() {
+function policy2() {
   return {
     prefix: EDITORIAL_READING_ROOM_ARTIFACT_PREFIX,
     artifactTtlMs: EDITORIAL_READING_ROOM_ARTIFACT_TTL_MS,
     downloadTtlMs: EDITORIAL_READING_ROOM_DOWNLOAD_TTL_MS,
-    token: token()
+    token: token2()
   };
 }
 function createEditorialReadingRoomArtifact(args) {
   return createPrivateArtifact({
-    policy: policy(),
+    policy: policy2(),
     ownerId: args.ownerId,
     artifactKey: `${args.rendered.sha256.slice(0, 12)}-${args.rendered.filename}`,
     createdAt: args.rendered.generatedAt,
@@ -28875,7 +29109,7 @@ function createEditorialReadingRoomArtifact(args) {
 }
 function renewEditorialReadingRoomArtifactDownload(args) {
   return renewPrivateArtifactDownload({
-    policy: policy(),
+    policy: policy2(),
     ownerId: args.ownerId,
     artifactId: args.artifactId
   });
@@ -28972,7 +29206,7 @@ function scheduledArtifactOwnerIdForApiKey(apiKey) {
 }
 
 // src/api/scheduled-run-view-links.ts
-import { createHash as createHash12, randomBytes as randomBytes3, randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash12, randomBytes as randomBytes3, randomUUID as randomUUID14 } from "crypto";
 var schemaReady2 = false;
 async function ensureScheduledRunViewLinksSchema() {
   if (schemaReady2) return;
@@ -29002,8 +29236,8 @@ async function ensureScheduledRunViewLinksSchema() {
   `);
   schemaReady2 = true;
 }
-function tokenHash2(token3) {
-  return createHash12("sha256").update(token3).digest("hex");
+function tokenHash2(token4) {
+  return createHash12("sha256").update(token4).digest("hex");
 }
 function mapRow(row) {
   return {
@@ -29023,16 +29257,16 @@ function mapRow(row) {
 async function createScheduledRunViewLink(input) {
   await ensureScheduledRunViewLinksSchema();
   const now = input.now ?? /* @__PURE__ */ new Date();
-  const token3 = randomBytes3(32).toString("base64url");
+  const token4 = randomBytes3(32).toString("base64url");
   const record = {
-    shareId: randomUUID13(),
+    shareId: randomUUID14(),
     ownerId: input.ownerId,
     runId: input.runId,
     artifactId: input.artifactId,
     title: input.title.slice(0, 300),
     summary: input.summary.slice(0, 2e3),
     rendererKey: input.rendererKey,
-    tokenHash: tokenHash2(token3),
+    tokenHash: tokenHash2(token4),
     expiresAt: new Date(now.getTime() + input.expiresInDays * 24 * 60 * 60 * 1e3).toISOString(),
     revokedAt: null,
     createdAt: now.toISOString()
@@ -29057,9 +29291,9 @@ async function createScheduledRunViewLink(input) {
       record.createdAt
     ]
   });
-  return { record, token: token3 };
+  return { record, token: token4 };
 }
-async function resolveScheduledRunViewLink(token3, now = /* @__PURE__ */ new Date()) {
+async function resolveScheduledRunViewLink(token4, now = /* @__PURE__ */ new Date()) {
   await ensureScheduledRunViewLinksSchema();
   const result = await getDb().execute({
     sql: `
@@ -29071,7 +29305,7 @@ async function resolveScheduledRunViewLink(token3, now = /* @__PURE__ */ new Dat
         AND expires_at > ?
       LIMIT 1
     `,
-    args: [tokenHash2(token3), now.toISOString()]
+    args: [tokenHash2(token4), now.toISOString()]
   });
   const row = result.rows[0];
   return row ? mapRow(row) : null;
@@ -29225,7 +29459,7 @@ scheduledResultApp.post("/schedule-runs/:runId/view-links", async (c) => {
   const artifact = result.data.run.artifactOutputs.find((output) => output.artifactId === body.data.artifactId);
   if (!artifact) return c.json(apiError("The scheduled result artifact was not found.", "not_found"), 404);
   const ownerId = scheduledArtifactOwnerIdForApiKey(user.api_key);
-  const { record, token: token3 } = await createScheduledRunViewLink({
+  const { record, token: token4 } = await createScheduledRunViewLink({
     ownerId,
     runId: result.data.run.runId,
     artifactId: artifact.artifactId,
@@ -29240,7 +29474,7 @@ scheduledResultApp.post("/schedule-runs/:runId/view-links", async (c) => {
     shareId: record.shareId,
     runId: record.runId,
     artifactId: record.artifactId,
-    url: `${origin.replace(/\/$/, "")}/view/scheduled-run/${token3}`,
+    url: `${origin.replace(/\/$/, "")}/view/scheduled-run/${token4}`,
     expiresAt: record.expiresAt,
     createdAt: record.createdAt
   }, 201);
@@ -29266,15 +29500,15 @@ import { createHash as createHash13 } from "crypto";
 var SCHEDULED_RUN_ARTIFACT_PREFIX = "scheduled-run-artifacts/";
 var SCHEDULED_RUN_ARTIFACT_DOWNLOAD_TTL_MS = 15 * 60 * 1e3;
 var SCHEDULED_RUN_ARTIFACT_MAX_BYTES = 2e6;
-function token2() {
+function token3() {
   return process.env.SCHEDULED_ARTIFACT_READ_WRITE_TOKEN?.trim() || process.env.PRIVATE_ARTIFACT_READ_WRITE_TOKEN?.trim() || process.env.CONNECTED_DATA_READ_WRITE_TOKEN?.trim() || process.env.CONNECTED_DATA_BLOB_READ_WRITE_TOKEN?.trim() || null;
 }
-function policy2() {
+function policy3() {
   return {
     prefix: SCHEDULED_RUN_ARTIFACT_PREFIX,
     artifactTtlMs: null,
     downloadTtlMs: SCHEDULED_RUN_ARTIFACT_DOWNLOAD_TTL_MS,
-    token: token2()
+    token: token3()
   };
 }
 function runStorageSegment(runId) {
@@ -29285,7 +29519,7 @@ async function createScheduledRunArtifact(args) {
     throw new Error("Scheduled artifact HTML must be 2,000,000 bytes or fewer.");
   }
   const stored = await createPrivateArtifact({
-    policy: policy2(),
+    policy: policy3(),
     ownerId: args.request.ownerId,
     scopeSegments: [runStorageSegment(args.request.runId)],
     artifactKey: `${args.rendered.sha256.slice(0, 16)}-${args.rendered.filename}`,
@@ -29311,7 +29545,7 @@ async function createScheduledRunArtifact(args) {
 async function readScheduledRunArtifact(args) {
   if (!args.artifactId.startsWith(`${SCHEDULED_RUN_ARTIFACT_PREFIX}${args.ownerId}/`)) return null;
   const window2 = await readPrivateArtifactWindow({
-    policy: policy2(),
+    policy: policy3(),
     artifactId: args.artifactId,
     offset: 0,
     maxBytes: SCHEDULED_RUN_ARTIFACT_MAX_BYTES + 1
@@ -29388,7 +29622,7 @@ import { Hono as Hono32 } from "hono";
 import { createHash as createHash14, createHmac as createHmac4, timingSafeEqual as timingSafeEqual3 } from "crypto";
 
 // src/api/service-connections.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 var schemaReady3 = null;
 var schemaDb2 = null;
 function ensureServiceConnectionsSchema() {
@@ -29454,6 +29688,14 @@ function ensureServiceConnectionsSchema() {
         UNIQUE(user_id, request_id)
       )
     `);
+    try {
+      await db.execute(`ALTER TABLE service_connection_action_audit ADD COLUMN request_digest TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connection_action_audit ADD COLUMN result_json TEXT`);
+    } catch {
+    }
   })().catch((error) => {
     schemaReady3 = null;
     schemaDb2 = null;
@@ -29522,7 +29764,7 @@ async function reconcileDiscoveredNangoConnections(identity, discovered) {
           updated_at = excluded.updated_at
       `,
       args: [
-        randomUUID14(),
+        randomUUID15(),
         userId,
         connection.providerConfigKey,
         connection.provider,
@@ -29593,7 +29835,7 @@ async function recordServiceConnectionHealth(args) {
   });
   await getDb().execute({
     sql: `INSERT INTO service_connection_health_events (id, connection_id, operational_status, failure_code, retryable, evidence_source) VALUES (?, ?, ?, ?, ?, ?)`,
-    args: [randomUUID14(), args.connectionId, args.operationalStatus, args.failureCode ?? null, args.retryable == null ? null : args.retryable ? 1 : 0, args.evidenceSource]
+    args: [randomUUID15(), args.connectionId, args.operationalStatus, args.failureCode ?? null, args.retryable == null ? null : args.retryable ? 1 : 0, args.evidenceSource]
   });
 }
 async function setServiceConnectionActions(identity, connectionId, enabled) {
@@ -29623,8 +29865,8 @@ async function recordServiceConnectionAction(args) {
   const connection = await getOwnedServiceConnection(args.identity, args.connectionId);
   if (!connection) throw new Error("service_connection_not_found");
   await getDb().execute({
-    sql: `UPDATE service_connection_action_audit SET status = ?, error_code = ? WHERE user_id = ? AND request_id = ? AND connection_id = ?`,
-    args: [args.status, args.errorCode ?? null, connection.userId, args.requestId, connection.id]
+    sql: `UPDATE service_connection_action_audit SET status = ?, error_code = ?, result_json = ? WHERE user_id = ? AND request_id = ? AND connection_id = ?`,
+    args: [args.status, args.errorCode ?? null, args.result === void 0 ? null : JSON.stringify(args.result), connection.userId, args.requestId, connection.id]
   });
 }
 async function claimServiceConnectionAction(args) {
@@ -29632,18 +29874,30 @@ async function claimServiceConnectionAction(args) {
   const connection = await getOwnedServiceConnection(args.identity, args.connectionId);
   if (!connection) throw new Error("service_connection_not_found");
   const inserted = await getDb().execute({
-    sql: `INSERT OR IGNORE INTO service_connection_action_audit (id, connection_id, user_id, tool, request_id, status) VALUES (?, ?, ?, ?, ?, 'started')`,
-    args: [randomUUID14(), connection.id, connection.userId, args.tool, args.requestId]
+    sql: `INSERT OR IGNORE INTO service_connection_action_audit (id, connection_id, user_id, tool, request_id, status, request_digest) VALUES (?, ?, ?, ?, ?, 'started', ?)`,
+    args: [randomUUID15(), connection.id, connection.userId, args.tool, args.requestId, args.requestDigest]
   });
   if (Number(inserted.rowsAffected ?? 0) === 1) return { claimed: true };
   const existing = await getDb().execute({
-    sql: `SELECT status, error_code FROM service_connection_action_audit WHERE user_id = ? AND request_id = ? LIMIT 1`,
+    sql: `SELECT connection_id, tool, status, error_code, request_digest, result_json FROM service_connection_action_audit WHERE user_id = ? AND request_id = ? LIMIT 1`,
     args: [connection.userId, args.requestId]
   });
+  const row = existing.rows[0];
+  const conflict = String(row?.connection_id ?? "") !== connection.id || String(row?.tool ?? "") !== args.tool || String(row?.request_digest ?? "") !== args.requestDigest;
+  let result = void 0;
+  if (!conflict && typeof row?.result_json === "string") {
+    try {
+      result = JSON.parse(row.result_json);
+    } catch {
+      result = void 0;
+    }
+  }
   return {
     claimed: false,
-    status: String(existing.rows[0]?.status ?? "unknown"),
-    errorCode: typeof existing.rows[0]?.error_code === "string" ? existing.rows[0].error_code : null
+    status: String(row?.status ?? "unknown"),
+    errorCode: typeof row?.error_code === "string" ? row.error_code : null,
+    conflict,
+    ...result !== void 0 ? { result } : {}
   };
 }
 
@@ -30066,6 +30320,53 @@ async function persistScrapeBody(user, opts) {
   return { ...deposit, ...fallback };
 }
 
+// src/api/scrape-image-sink.ts
+import { createHash as createHash16 } from "crypto";
+var MAX_IMAGES_PER_SCRAPE = 25;
+function idempotencyKey2(userId, vault, input) {
+  return `scrape-image-${createHash16("sha256").update(`${userId}\0${vault}\0${input.sourceKind}\0${input.sourceUrl}\0${input.imageUrl ?? ""}\0${input.imageBase64 ?? ""}`).digest("hex")}`;
+}
+async function persistScrapeImagesToMemory(user, inputs, vault) {
+  const selected = inputs.slice(0, MAX_IMAGES_PER_SCRAPE);
+  if (selected.length === 0) return { requested: 0, saved: 0, skipped: 0, assets: [] };
+  const { key, error } = await getOrCreateUserMemoryKey(user);
+  if (!key) {
+    return { requested: selected.length, saved: 0, skipped: inputs.length - selected.length, assets: [], error: error ?? "memory unavailable" };
+  }
+  const targetVault = vault?.trim() || "Library";
+  const assets = [];
+  for (const input of selected) {
+    const result = await memoryCall(
+      "image_asset_save",
+      {
+        vault: targetVault,
+        ...input.imageBase64 ? { imageBase64: input.imageBase64 } : { sourceUrl: input.imageUrl },
+        title: input.title.slice(0, 240),
+        sourceRef: {
+          sourceUrl: input.sourceUrl,
+          sourceKind: input.sourceKind,
+          ...input.sourceRef ?? {}
+        },
+        idempotencyKey: idempotencyKey2(user.id, targetVault, input)
+      },
+      key
+    );
+    assets.push({
+      sourceUrl: input.imageUrl ?? input.sourceUrl,
+      sourceKind: input.sourceKind,
+      saved: result.ok,
+      ...result.asset?.assetId ? { assetId: result.asset.assetId } : {},
+      ...!result.ok ? { error: result.error ?? "image save failed" } : {}
+    });
+  }
+  return {
+    requested: selected.length,
+    saved: assets.filter((asset) => asset.saved).length,
+    skipped: inputs.length - selected.length,
+    assets
+  };
+}
+
 // src/api/archive-reader.ts
 import { basename, extname } from "path";
 import yauzl from "yauzl";
@@ -30156,6 +30457,10 @@ function openZip(buffer) {
       strictFileNames: true
     }, (error, zip) => {
       if (error || !zip) {
+        if (error && /invalid relative path|absolute path|backslash/i.test(error.message)) {
+          reject(new ArchiveReadError("archive_unsafe_path", "ZIP archive contains an unsafe entry path."));
+          return;
+        }
         reject(new ArchiveReadError("archive_invalid_zip", "The downloaded file is not a valid ZIP archive."));
         return;
       }
@@ -30163,6 +30468,13 @@ function openZip(buffer) {
     });
   });
 }
+function normalizedZipError(error, fallbackCode, fallbackMessage) {
+  if (error instanceof ArchiveReadError) return error;
+  if (error instanceof Error && /invalid relative path|absolute path|backslash/i.test(error.message)) {
+    return new ArchiveReadError("archive_unsafe_path", "ZIP archive contains an unsafe entry path.");
+  }
+  return new ArchiveReadError(fallbackCode, error instanceof Error ? error.message : fallbackMessage);
+}
 async function scanZip(buffer, visibleEntryLimit) {
   const zip = await openZip(buffer);
   return new Promise((resolve2, reject) => {
@@ -30177,7 +30489,7 @@ async function scanZip(buffer, visibleEntryLimit) {
         zip.close();
       } catch {
       }
-      reject(error instanceof ArchiveReadError ? error : new ArchiveReadError("archive_invalid_zip", error instanceof Error ? error.message : "Failed to read ZIP archive."));
+      reject(normalizedZipError(error, "archive_invalid_zip", "Failed to read ZIP archive."));
     };
     zip.on("error", fail2);
     zip.on("entry", (entry) => {
@@ -30271,7 +30583,7 @@ async function extractEntry(buffer, requestedPath) {
         zip.close();
       } catch {
       }
-      reject(error instanceof ArchiveReadError ? error : new ArchiveReadError("archive_entry_read_failed", error instanceof Error ? error.message : "Failed to read ZIP entry."));
+      reject(normalizedZipError(error, "archive_entry_read_failed", "Failed to read ZIP entry."));
     };
     zip.on("error", fail2);
     zip.on("entry", (entry) => {
@@ -30386,6 +30698,9 @@ async function downloadPublicZip(rawUrl) {
 }
 async function listZipArchive(rawUrl, maxEntries) {
   const { archiveUrl, buffer } = await downloadPublicZip(rawUrl);
+  return listZipArchiveBuffer(buffer, archiveUrl, maxEntries);
+}
+async function listZipArchiveBuffer(buffer, archiveUrl, maxEntries) {
   const scanned = await scanZip(buffer, maxEntries);
   return {
     archiveUrl,
@@ -30426,8 +30741,11 @@ function utf8Window(content, path5, offset, maxBytes) {
   };
 }
 async function readZipArchiveFile(rawUrl, rawPath, offset, maxBytes) {
-  const requestedPath = safeEntryPath(rawPath);
   const { archiveUrl, buffer } = await downloadPublicZip(rawUrl);
+  return readZipArchiveBuffer(buffer, archiveUrl, rawPath, offset, maxBytes);
+}
+async function readZipArchiveBuffer(buffer, archiveUrl, rawPath, offset, maxBytes) {
+  const requestedPath = safeEntryPath(rawPath);
   const scanned = await scanZip(buffer, 0);
   const info = scanned.allEntries.find((entry) => entry.path === requestedPath);
   if (!info) throw new ArchiveReadError("archive_entry_not_found", `ZIP entry was not found: ${requestedPath}`, 404);
@@ -30457,6 +30775,9 @@ async function readZipArchiveFile(rawUrl, rawPath, offset, maxBytes) {
   };
 }
 function archiveLibrarySource(archiveUrl, path5) {
+  if (!/^https?:\/\//i.test(archiveUrl)) {
+    return `mcp-artifact:${encodeURIComponent(archiveUrl)}#entry=${encodeURIComponent(path5)}`;
+  }
   const source = new URL(archiveUrl);
   source.username = "";
   source.password = "";
@@ -30475,7 +30796,7 @@ function inferredWaybackCapturedAt(content) {
 }
 
 // src/api/connection-memory-import.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 var CONNECTION_MEMORY_IMPORT_MAX_ARGS_BYTES = 64 * 1024;
 var CONNECTION_MEMORY_IMPORT_MAX_RESULT_BYTES = 1e6;
 var CONNECTION_MEMORY_IMPORT_MAX_STRING_CHARS = 256e3;
@@ -30505,7 +30826,7 @@ function canonicalJson(value) {
   return JSON.stringify(value);
 }
 function sha2562(value) {
-  return createHash16("sha256").update(value).digest("hex");
+  return createHash17("sha256").update(value).digest("hex");
 }
 function sensitiveKey(key) {
   const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
@@ -30723,17 +31044,17 @@ async function importServiceConnectionToMemory(identity, input, dependencies) {
 
 // src/api/scrape-blob-cleanup.ts
 import { readdir, stat, unlink } from "fs/promises";
-import { homedir } from "os";
-import { join as join6 } from "path";
-async function cleanupVercel(token3, cutoff) {
+import { homedir as homedir2 } from "os";
+import { join as join7 } from "path";
+async function cleanupVercel(token4, cutoff) {
   const { list, del } = await import("@vercel/blob");
   let cursor;
   let deleted = 0;
   do {
-    const res = await list({ prefix: SCRAPE_FALLBACK_PREFIX, cursor, token: token3 });
+    const res = await list({ prefix: SCRAPE_FALLBACK_PREFIX, cursor, token: token4 });
     const expired = res.blobs.filter((b) => new Date(b.uploadedAt).getTime() < cutoff);
     if (expired.length) {
-      await del(expired.map((b) => b.url), { token: token3 });
+      await del(expired.map((b) => b.url), { token: token4 });
       deleted += expired.length;
     }
     cursor = res.hasMore ? res.cursor : void 0;
@@ -30741,8 +31062,8 @@ async function cleanupVercel(token3, cutoff) {
   return { deleted, store: "vercel-blob" };
 }
 async function cleanupLocal(cutoff) {
-  const baseDir = process.env.MCP_SCRAPER_OUTPUT_DIR?.trim() || join6(homedir(), "Downloads", "mcp-scraper");
-  const dir = join6(baseDir, "blobs", SCRAPE_FALLBACK_PREFIX.replace(/\/$/, ""));
+  const baseDir = process.env.MCP_SCRAPER_OUTPUT_DIR?.trim() || join7(homedir2(), "Downloads", "mcp-scraper");
+  const dir = join7(baseDir, "blobs", SCRAPE_FALLBACK_PREFIX.replace(/\/$/, ""));
   let deleted = 0;
   let entries;
   try {
@@ -30751,7 +31072,7 @@ async function cleanupLocal(cutoff) {
     return { deleted: 0, store: "local" };
   }
   for (const name of entries) {
-    const path5 = join6(dir, name);
+    const path5 = join7(dir, name);
     try {
       const s = await stat(path5);
       if (s.isFile() && s.mtimeMs < cutoff) {
@@ -30766,15 +31087,15 @@ async function cleanupLocal(cutoff) {
 async function cleanupExpiredScrapeBlobs(maxAgeMs = SCRAPE_BLOB_TTL_MS) {
   const cutoff = Date.now() - maxAgeMs;
   try {
-    const token3 = process.env.BLOB_READ_WRITE_TOKEN;
-    return token3 ? await cleanupVercel(token3, cutoff) : await cleanupLocal(cutoff);
+    const token4 = process.env.BLOB_READ_WRITE_TOKEN;
+    return token4 ? await cleanupVercel(token4, cutoff) : await cleanupLocal(cutoff);
   } catch {
     return { deleted: 0, store: "none" };
   }
 }
 
 // src/api/connected-data-export.ts
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 var CONNECTED_DATA_INLINE_BUDGET_BYTES = Number(
   process.env.MCP_SCRAPER_CONNECTED_DATA_INLINE_BUDGET_BYTES ?? 5e4
 );
@@ -30945,7 +31266,7 @@ function finitePositive(value, fallback) {
   return Number.isFinite(value) && value > 0 ? value : fallback;
 }
 async function collectConnectedDataExport(args) {
-  const exportId = randomUUID15();
+  const exportId = randomUUID16();
   const now = args.now ?? Date.now;
   const startedAt = now();
   const budgetMs = finitePositive(CONNECTED_DATA_EXPORT_BUDGET_MS, 24e4);
@@ -31061,7 +31382,7 @@ ${lines.length ? `${lines.join("\n")}
 }
 
 // src/api/search-console-table-export.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 var SEARCH_CONSOLE_TABLE_EXPORT_MAX_ROWS = 5e4;
 var SEARCH_CONSOLE_TABLE_EXPORT_PAGE_SIZE = 2e3;
 var SEARCH_CONSOLE_TABLE_EXPORT_MAX_BYTES = 50 * 1024 * 1024;
@@ -31161,7 +31482,7 @@ async function exportSearchConsoleTableData(args) {
     offset += rows.length;
     if (stoppedForBytes || rows.length < limit || offset >= matchedRows) break;
   }
-  const exportId = randomUUID16();
+  const exportId = randomUUID17();
   const artifact = await args.writeArtifact({
     ownerId: args.ownerId,
     exportId,
@@ -31516,7 +31837,7 @@ async function dbUsage(identity, plan) {
 }
 
 // src/api/nango-control.ts
-import { createHash as createHash18, randomUUID as randomUUID18 } from "crypto";
+import { createHash as createHash19, randomUUID as randomUUID19 } from "crypto";
 
 // src/api/slack-archive-analysis.ts
 function isRecord2(value) {
@@ -31890,9 +32211,55 @@ async function exportSlackChannelPage(input, dependencies) {
 }
 
 // src/api/main-nango-transport.ts
-import { createHash as createHash17, randomUUID as randomUUID17 } from "crypto";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { createHash as createHash18, randomUUID as randomUUID18 } from "crypto";
+import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
+
+// src/api/connected-tool-policy.ts
+function classifyConnectedTool(tool) {
+  if (tool.annotations?.readOnlyHint === true) return "read";
+  if (tool.annotations?.readOnlyHint === false) return "action";
+  return /^(get|list|search|query|read|download|fetch|find|lookup|inspect|describe|check)-/i.test(tool.name) ? "read" : "action";
+}
+function normalizedPolicyMap(value) {
+  return new Map(Object.entries(value ?? {}).map(([name, entries]) => [
+    name,
+    [...new Set(entries.map((entry) => entry.trim()).filter(Boolean))].sort()
+  ]));
+}
+function buildConnectedToolPolicyRegistry(args) {
+  const permissionPolicies = normalizedPolicyMap(args.requiredPermissionsByTool);
+  const featurePolicies = normalizedPolicyMap(args.requiredFeaturesByTool);
+  const granted = new Set(args.grantedPermissions ?? []);
+  const enabled = new Set(args.enabledFeatures ?? []);
+  const adminBlocked = new Set(args.adminBlockedTools ?? []);
+  const policies = /* @__PURE__ */ new Map();
+  for (const tool of args.tools) {
+    const classification = classifyConnectedTool(tool);
+    const requiredPermissions = permissionPolicies.get(tool.name) ?? [];
+    const requiredFeatures = featurePolicies.get(tool.name) ?? [];
+    const missingPermissions = requiredPermissions.filter((permission) => !granted.has(permission));
+    const missingFeatures = requiredFeatures.filter((feature) => !enabled.has(feature));
+    const blockedReason = !args.connectionActive ? "inactive_connection" : adminBlocked.has(tool.name) ? "admin_blocked" : classification === "action" && !args.actionsEnabled ? "actions_disabled" : requiredPermissions.length > 0 && args.permissionVerification === "unavailable" ? "permission_verification_unavailable" : missingPermissions.length > 0 ? "missing_permission" : missingFeatures.length > 0 ? "missing_app_feature" : null;
+    policies.set(tool.name, {
+      name: tool.name,
+      classification,
+      requiredPermissions,
+      requiredFeatures,
+      available: blockedReason === null,
+      blockedReason,
+      missingPermissions,
+      missingFeatures
+    });
+  }
+  return policies;
+}
+function connectedToolPolicyOrThrow(registry, toolName) {
+  const policy4 = registry.get(toolName);
+  if (!policy4) throw new Error("connected_tool_policy_missing");
+  return policy4;
+}
+
+// src/api/main-nango-transport.ts
 var DEFAULT_NANGO_MCP_URL = "https://api.nango.dev/mcp";
 var NANGO_TIMEOUT_MS = 2e4;
 var NANGO_CONNECTION_PAGE_SIZE = 100;
@@ -32169,11 +32536,6 @@ async function requireOwnedActiveConnection(identity, connectionId, allowNeedsRe
   }
   return connection;
 }
-function classifyTool(tool) {
-  if (tool.annotations?.readOnlyHint === true) return "read";
-  if (tool.annotations?.readOnlyHint === false) return "action";
-  return /^(get|list|search|query|read|download|fetch|find|lookup|inspect|describe|check)-/i.test(tool.name) ? "read" : "action";
-}
 async function withNangoClient(connection, run) {
   const transport = new StreamableHTTPClientTransport(nangoMcpUrl(), {
     requestInit: {
@@ -32235,9 +32597,14 @@ async function listNangoToolsDirect(identity, connectionId) {
       ...asRecord(raw.annotations) ? { annotations: asRecord(raw.annotations) } : {}
     }];
   });
-  const readTools = tools.filter((tool) => classifyTool(tool) === "read").map((tool) => tool.name);
-  const actionTools = tools.filter((tool) => classifyTool(tool) === "action").map((tool) => tool.name);
-  const revision = createHash17("sha256").update(JSON.stringify(tools.map((tool) => ({ name: tool.name, inputSchema: tool.inputSchema })))).digest("hex");
+  const policies = buildConnectedToolPolicyRegistry({
+    tools,
+    connectionActive: connection.lifecycleStatus === "connected",
+    actionsEnabled: connection.actionsEnabled
+  });
+  const readTools = [...policies.values()].filter((policy4) => policy4.classification === "read").map((policy4) => policy4.name);
+  const actionTools = [...policies.values()].filter((policy4) => policy4.classification === "action").map((policy4) => policy4.name);
+  const revision = createHash18("sha256").update(JSON.stringify(tools.map((tool) => ({ name: tool.name, inputSchema: tool.inputSchema })))).digest("hex");
   await updateServiceConnectionTools(connection.id, readTools, actionTools, revision);
   const refreshed = await getOwnedServiceConnection(identity, connection.id);
   return { connection: refreshed ?? { ...connection, readTools, actionTools, toolRevision: revision }, tools };
@@ -32246,19 +32613,26 @@ async function callNangoToolDirect(args) {
   const { connection, tools } = await listNangoToolsDirect(args.identity, args.connectionId);
   const selected = tools.find((tool) => tool.name === args.tool);
   if (!selected) throw new MainNangoTransportError("The requested provider tool is unavailable.", 404, "live_tool_missing", false);
-  const actualClassification = classifyTool(selected);
-  if (actualClassification !== args.classification) {
+  const policy4 = connectedToolPolicyOrThrow(buildConnectedToolPolicyRegistry({
+    tools,
+    connectionActive: connection.lifecycleStatus === "connected",
+    actionsEnabled: connection.actionsEnabled
+  }), selected.name);
+  if (policy4.classification !== args.classification) {
     throw new MainNangoTransportError("The provider tool classification does not match this operation.", 403, "tool_not_allowed", false);
   }
-  if (actualClassification === "action" && !connection.actionsEnabled) {
+  if (!policy4.available && policy4.blockedReason === "actions_disabled") {
     throw new MainNangoTransportError("Actions are disabled for this service connection.", 403, "actions_disabled", false);
   }
+  if (!policy4.available) {
+    throw new MainNangoTransportError("The provider tool is not authorized for this connection.", 403, "tool_not_allowed", false);
+  }
   await preflightConnectedUsage({
     identity: args.identity,
     ratePolicyVersion: CONNECTED_USAGE_RATE_POLICY_VERSION
   });
-  const requestId = args.requestId?.trim() || randomUUID17();
-  const idempotencyKey2 = `main-nango:${createHash17("sha256").update(args.identity.toLowerCase()).update("\0").update(connection.id).update("\0").update(args.tool).update("\0").update(requestId).digest("hex")}`;
+  const requestId = args.requestId?.trim() || randomUUID18();
+  const idempotencyKey3 = `main-nango:${createHash18("sha256").update(args.identity.toLowerCase()).update("\0").update(connection.id).update("\0").update(args.tool).update("\0").update(requestId).digest("hex")}`;
   const startedAt = /* @__PURE__ */ new Date();
   const started = performance.now();
   let result;
@@ -32271,7 +32645,7 @@ async function callNangoToolDirect(args) {
   const completedAt = /* @__PURE__ */ new Date();
   await settleConnectedUsage({
     identity: args.identity,
-    idempotencyKey: idempotencyKey2,
+    idempotencyKey: idempotencyKey3,
     ratePolicyVersion: CONNECTED_USAGE_RATE_POLICY_VERSION,
     connectionId: connection.id,
     providerConfigKey: connection.providerConfigKey,
@@ -32283,7 +32657,7 @@ async function callNangoToolDirect(args) {
       toolName: args.tool,
       operationKind: args.operationKind ?? args.classification,
       outcome: providerError ? "error" : "partial",
-      requestId: requestId.length <= 200 ? requestId : createHash17("sha256").update(requestId).digest("hex"),
+      requestId: requestId.length <= 200 ? requestId : createHash18("sha256").update(requestId).digest("hex"),
       startedAt: startedAt.toISOString(),
       completedAt: completedAt.toISOString()
     }
@@ -32295,8 +32669,13 @@ async function describeNangoToolDirect(identity, connectionId, toolName) {
   const { connection, tools } = await listNangoToolsDirect(identity, connectionId);
   const tool = tools.find((candidate) => candidate.name === toolName);
   if (!tool) throw new MainNangoTransportError("The requested provider tool is unavailable.", 404, "live_tool_missing", false);
-  const classification = classifyTool(tool);
-  const callable = classification === "read" || connection.actionsEnabled;
+  const policy4 = connectedToolPolicyOrThrow(buildConnectedToolPolicyRegistry({
+    tools,
+    connectionActive: connection.lifecycleStatus === "connected",
+    actionsEnabled: connection.actionsEnabled
+  }), tool.name);
+  const classification = classifyConnectedTool(tool);
+  const callable = policy4.available;
   const projected = {
     name: tool.name,
     ...tool.title ? { title: tool.title } : {},
@@ -32309,18 +32688,18 @@ async function describeNangoToolDirect(identity, connectionId, toolName) {
     ...projected,
     classification,
     callable,
-    blockedReason: callable ? null : "actions_disabled",
-    requiredPermissions: [],
-    missingPermissions: [],
-    requiredFeatures: [],
-    missingFeatures: [],
+    blockedReason: policy4.blockedReason,
+    requiredPermissions: policy4.requiredPermissions,
+    missingPermissions: policy4.missingPermissions,
+    requiredFeatures: policy4.requiredFeatures,
+    missingFeatures: policy4.missingFeatures,
     transport: "nango",
     providerConfigKey: connection.providerConfigKey,
     providerContractVersion: MAIN_INTEGRATION_CONTRACT_VERSION,
     providerContractHash: MAIN_INTEGRATION_CONTRACT_HASH,
     protocolVersion: null,
     schemaSource: "live_tools_list",
-    schemaHash: createHash17("sha256").update(JSON.stringify(projected)).digest("hex"),
+    schemaHash: createHash18("sha256").update(JSON.stringify(projected)).digest("hex"),
     fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
@@ -32776,8 +33155,8 @@ async function getNangoConnections(identity, options = {}) {
             classification: "read",
             requiredPermissions: [],
             requiredFeatures: [],
-            available: connection.operationalStatus !== "unavailable",
-            blockedReason: null,
+            available: connection.lifecycleStatus === "connected" && connection.operationalStatus !== "unavailable",
+            blockedReason: connection.lifecycleStatus !== "connected" || connection.operationalStatus === "unavailable" ? "inactive_connection" : null,
             missingPermissions: [],
             missingFeatures: []
           })),
@@ -32786,8 +33165,8 @@ async function getNangoConnections(identity, options = {}) {
             classification: "action",
             requiredPermissions: [],
             requiredFeatures: [],
-            available: connection.operationalStatus !== "unavailable",
-            blockedReason: null,
+            available: connection.lifecycleStatus === "connected" && connection.operationalStatus !== "unavailable" && connection.actionsEnabled,
+            blockedReason: connection.lifecycleStatus !== "connected" || connection.operationalStatus === "unavailable" ? "inactive_connection" : connection.actionsEnabled ? null : "actions_disabled",
             missingPermissions: [],
             missingFeatures: []
           }))
@@ -32841,7 +33220,7 @@ async function getNangoConnections(identity, options = {}) {
         const name = cleanString3(value.name, 200);
         const classification = value.classification;
         const blockedValue = Object.prototype.hasOwnProperty.call(value, "blockedReason") ? value.blockedReason : value.blocked_reason;
-        const blockedReason = blockedValue === null ? null : blockedValue === "missing_permission" || blockedValue === "permission_policy_missing" || blockedValue === "permission_verification_unavailable" || blockedValue === "missing_app_feature" ? blockedValue : void 0;
+        const blockedReason = blockedValue === null ? null : blockedValue === "missing_permission" || blockedValue === "permission_policy_missing" || blockedValue === "permission_verification_unavailable" || blockedValue === "missing_app_feature" || blockedValue === "inactive_connection" || blockedValue === "actions_disabled" || blockedValue === "admin_blocked" ? blockedValue : void 0;
         if (!name || classification !== "read" && classification !== "action" || typeof value.available !== "boolean" || blockedReason === void 0) continue;
         toolCapabilities.push({
           name,
@@ -33043,14 +33422,24 @@ async function setScheduleConnectionActionsEnabled(identity, connectionId, enabl
   if (!isRecord4(data) || !isRecord4(data.connection)) return enabled;
   return data.connection.actionsEnabled === true;
 }
-async function callScheduleConnectionAction(identity, connectionId, input, tool, idempotencyKey2) {
-  const requestId = `main-connected-action:${createHash18("sha256").update(identity).update("\0").update(idempotencyKey2?.trim() || randomUUID18()).digest("hex")}`;
+async function callScheduleConnectionAction(identity, connectionId, input, tool, idempotencyKey3) {
+  const requestId = `main-connected-action:${createHash19("sha256").update(identity).update("\0").update(idempotencyKey3?.trim() || randomUUID19()).digest("hex")}`;
+  const requestDigest = createHash19("sha256").update(connectionId).update("\0").update(tool?.trim() ?? "").update("\0").update(canonicalJson2(input)).digest("hex");
   if (mainOwnsIntegrations()) {
     const selectedTool = tool?.trim();
     if (!selectedTool) throw new NangoControlError("An action tool is required.", 400, "invalid_request", false);
     try {
-      const claim = await claimServiceConnectionAction({ identity, connectionId, tool: selectedTool, requestId });
+      const claim = await claimServiceConnectionAction({ identity, connectionId, tool: selectedTool, requestId, requestDigest });
       if (!claim.claimed) {
+        if (claim.conflict) {
+          throw new NangoControlError(
+            "This Idempotency-Key was already used for different connected-action arguments.",
+            409,
+            "idempotency_conflict",
+            false
+          );
+        }
+        if (claim.status === "succeeded" && "result" in claim) return claim.result;
         throw new NangoControlError(
           "The previous connected action may have completed, so it was not run again.",
           409,
@@ -33067,7 +33456,7 @@ async function callScheduleConnectionAction(identity, connectionId, input, tool,
         requestId,
         operationKind: "action"
       });
-      await recordServiceConnectionAction({ identity, connectionId, tool: selectedTool, requestId, status: "succeeded" });
+      await recordServiceConnectionAction({ identity, connectionId, tool: selectedTool, requestId, status: "succeeded", result });
       return result;
     } catch (error) {
       const normalized = asNangoControlError(error);
@@ -33092,7 +33481,7 @@ async function callScheduleConnectionAction(identity, connectionId, input, tool,
   const data = unwrapData(body);
   return isRecord4(data) ? data.result ?? data : data;
 }
-async function callScheduleConnectionRead(identity, connectionId, tool, args, idempotencyKey2) {
+async function callScheduleConnectionRead(identity, connectionId, tool, args, idempotencyKey3) {
   if (mainOwnsIntegrations()) {
     try {
       return await callNangoToolDirect({
@@ -33101,7 +33490,7 @@ async function callScheduleConnectionRead(identity, connectionId, tool, args, id
         tool,
         input: args ?? {},
         classification: "read",
-        requestId: idempotencyKey2,
+        requestId: idempotencyKey3,
         operationKind: "read"
       });
     } catch (error) {
@@ -33186,7 +33575,7 @@ function canonicalJson2(value) {
   return JSON.stringify(value);
 }
 function projectedToolSchemaHash(tool) {
-  return createHash18("sha256").update(canonicalJson2(tool)).digest("hex");
+  return createHash19("sha256").update(canonicalJson2(tool)).digest("hex");
 }
 async function describeNangoTool(identity, connectionId, tool, fresh) {
   if (mainOwnsIntegrations()) {
@@ -33465,6 +33854,7 @@ async function callMainOwnedExportPage(identity, input) {
 }
 
 // src/api/resend-control.ts
+import { createHash as createHash20 } from "crypto";
 var DEFAULT_CONNECTION_CONTROL_URL = "https://mcp-scraper-scheduler.vercel.app";
 var RESEND_PROVIDER_CONFIG_KEY = "resend";
 var RESEND_LOGO_URL = "https://cdn.resend.com/brand/resend-icon-black.svg";
@@ -33722,9 +34112,11 @@ async function callResendRead(identity, connectionId, tool, args) {
   const data = unwrapData2(body);
   return isRecord5(data) ? data.result ?? data : data;
 }
-async function callResendAction(identity, connectionId, tool, input) {
+async function callResendAction(identity, connectionId, tool, input, idempotencyKey3) {
+  const requestId = `main-resend-action:${createHash20("sha256").update(identity).update("\0").update(idempotencyKey3.trim()).digest("hex")}`;
   const body = await controlRequest2("/api/internal/resend/actions/call", {
     method: "POST",
+    headers: { "x-request-id": requestId },
     body: JSON.stringify({ identity, connectionId, tool, input })
   });
   const data = unwrapData2(body);
@@ -33848,9 +34240,9 @@ var auth2 = createMiddleware4(async (c, next) => {
   return next();
 });
 var sessionAuth = createMiddleware4(async (c, next) => {
-  const token3 = getCookie2(c, "session");
-  if (!token3) return c.json({ error: "Not authenticated" }, 401);
-  const userId = verifySession(token3);
+  const token4 = getCookie2(c, "session");
+  if (!token4) return c.json({ error: "Not authenticated" }, 401);
+  const userId = verifySession(token4);
   if (!userId) return c.json({ error: "Session expired" }, 401);
   const user = await getUserById(userId);
   if (!user) return c.json({ error: "User not found" }, 401);
@@ -33876,7 +34268,11 @@ var requirePaidSchedulingTier = createMiddleware4(async (c, next) => {
   return next();
 });
 var app = new Hono33();
+var deploymentProfile = resolveDeploymentProfile();
 var STRIPE_API_VERSION = "2026-02-25.clover";
+function permitsLocalApiRequest(request) {
+  return (deploymentProfile === "development" || deploymentProfile === "test" || process.env.MCP_SCRAPER_ALLOW_PRIVATE_NETWORK === "1") && request.headers.get("x-mcp-scraper-local-network") === "1" && isLoopbackBaseUrl(request.url);
+}
 function requireStripeSecret() {
   const secret2 = process.env.STRIPE_SECRET_KEY?.trim();
   if (secret2) return secret2;
@@ -33992,8 +34388,8 @@ app.post("/auth/register", requireAllowedOrigin, async (c) => {
         console.warn("[auth/register] memory provision failed (will retry on first write):", err instanceof Error ? err.message : String(err));
       }
     })();
-    const token3 = signSession(user.id);
-    setCookie2(c, "session", token3, sessionCookieOptions2);
+    const token4 = signSession(user.id);
+    setCookie2(c, "session", token4, sessionCookieOptions2);
     return c.json({ email: user.email, api_key: newKey }, 201);
   } catch (err) {
     const msg = err instanceof Error ? err.message : "";
@@ -34011,8 +34407,8 @@ app.post("/auth/login", requireAllowedOrigin, async (c) => {
   if (!user || !user.password_hash || !verifyPassword(password, user.password_hash)) {
     return c.json({ error: "Invalid email or password" }, 401);
   }
-  const token3 = signSession(user.id);
-  setCookie2(c, "session", token3, sessionCookieOptions2);
+  const token4 = signSession(user.id);
+  setCookie2(c, "session", token4, sessionCookieOptions2);
   return c.json({ email: user.email, api_key: user.key_active ? user.api_key : null });
 });
 app.post("/auth/logout", requireAllowedOrigin, (c) => {
@@ -34067,9 +34463,9 @@ app.post("/auth/forgot-password", requireAllowedOrigin, async (c) => {
   if (emailLimited) return emailLimited;
   const user = await getUserByEmail(normalizedEmail);
   if (!user) return c.json({ ok: true });
-  const token3 = await createPasswordResetToken(user.id);
+  const token4 = await createPasswordResetToken(user.id);
   const appUrl = process.env.APP_URL ?? "https://mcpscraper.dev";
-  const resetUrl = `${appUrl}/reset-password?token=${token3}`;
+  const resetUrl = `${appUrl}/reset-password?token=${token4}`;
   if (process.env.RESEND_API_KEY) {
     try {
       const resend = new Resend3(process.env.RESEND_API_KEY);
@@ -34089,12 +34485,12 @@ app.post("/auth/forgot-password", requireAllowedOrigin, async (c) => {
   return c.json({ ok: true });
 });
 app.post("/auth/reset-password", requireAllowedOrigin, async (c) => {
-  const { token: token3, password } = await c.req.json();
-  if (!token3 || !password) return c.json({ error: "Token and password required" }, 400);
+  const { token: token4, password } = await c.req.json();
+  if (!token4 || !password) return c.json({ error: "Token and password required" }, 400);
   if (password.length < 8) return c.json({ error: "Password must be at least 8 characters" }, 400);
   const limited = await enforceRateLimit(c, "auth_reset", rateLimitKey(c), 10, 60 * 60);
   if (limited) return limited;
-  const userId = await consumePasswordResetToken(token3);
+  const userId = await consumePasswordResetToken(token4);
   if (!userId) return c.json({ error: "Invalid or expired reset link" }, 400);
   await setPassword(userId, password);
   return c.json({ ok: true });
@@ -34131,9 +34527,9 @@ function sessionBootstrapPayload(user) {
 }
 app.get("/me", async (c) => {
   c.header("Cache-Control", "no-store");
-  const token3 = getCookie2(c, "session");
-  if (!token3) return c.json({ authenticated: false });
-  const userId = verifySession(token3);
+  const token4 = getCookie2(c, "session");
+  if (!token4) return c.json({ authenticated: false });
+  const userId = verifySession(token4);
   if (!userId) {
     deleteCookie(c, "session", { path: "/", secure: secureCookies2, sameSite: "Strict" });
     return c.json({ authenticated: false });
@@ -34470,7 +34866,11 @@ function scheduleConnectionError(c, err, fallback) {
   return c.json({ ok: false, error: fallback }, 502);
 }
 function connectedActionIdempotencyKey(c) {
-  return c.req.header("idempotency-key") ?? c.req.header("x-idempotency-key");
+  const key = (c.req.header("idempotency-key") ?? c.req.header("x-idempotency-key"))?.trim();
+  if (!key || key.length < 8 || key.length > 200) {
+    throw new ScheduleConnectionValidationError("Idempotency-Key is required and must contain 8-200 characters for external actions.");
+  }
+  return key;
 }
 function connectionMemoryImportError(c, err) {
   return c.json({
@@ -35197,12 +35597,13 @@ app.post("/schedule-connections/actions/call", auth2, requireIntegrationsTier, a
     return c.json({ ok: false, error: "connectionId, tool, and an args object are required." }, 400);
   }
   try {
-    const result = await isResendConnection(user.email, connectionId, providerConfigKey) ? await callResendAction(user.email, connectionId, tool, body.args) : await callScheduleConnectionAction(
+    const idempotencyKey3 = connectedActionIdempotencyKey(c);
+    const result = await isResendConnection(user.email, connectionId, providerConfigKey) ? await callResendAction(user.email, connectionId, tool, body.args, idempotencyKey3) : await callScheduleConnectionAction(
       user.email,
       connectionId,
       body.args,
       tool,
-      connectedActionIdempotencyKey(c)
+      idempotencyKey3
     );
     return c.json({ ok: true, result });
   } catch (err) {
@@ -35547,7 +35948,7 @@ app.post("/harvest", auth2, async (c) => {
     if (!harvestOk) return c.json(insufficientBalanceResponse(harvestBal, harvestCost), 402);
     jobId2 = await createJob(user.id, options.query, { ...options, billingHoldMc: harvestCost }, body.callback_url);
   } else {
-    jobId2 = randomUUID19();
+    jobId2 = randomUUID20();
     const billingDebitKey = `paa-harvest:${jobId2}:hold`;
     const description = `PAA harvest: ${options.query}`.slice(0, 500);
     const hold = await debitMcIdempotent(
@@ -35740,9 +36141,20 @@ app.post("/admin/backfill-signup-credits", adminAuth, async (c) => {
 });
 app.post("/extract-url", auth2, async (c) => {
   const raw = await c.req.json().catch(() => ({}));
-  const bodyResult = ExtractUrlBodySchema.safeParse(raw);
+  const allowLocalRequest = permitsLocalApiRequest(c.req.raw);
+  const bodyResult = (allowLocalRequest ? ExtractUrlLocalBodySchema : ExtractUrlBodySchema).safeParse(raw);
   if (!bodyResult.success) return c.json({ error: bodyResult.error.issues[0]?.message ?? "Invalid request" }, 400);
-  const { url, screenshot: screenshot2, screenshotDevice, extractBranding: extractBranding2, includeFeaturedImage, downloadMedia, mediaTypes, allowLocal } = bodyResult.data;
+  const { url, screenshot: screenshot2, screenshotDevice, extractBranding: extractBranding2, includeFeaturedImage, mediaTypes } = bodyResult.data;
+  const allowLocal = allowLocalRequest && "allowLocal" in bodyResult.data && bodyResult.data.allowLocal === true;
+  const requestedDelivery = bodyResult.data.delivery ?? "auto";
+  if (bodyResult.data.depositToVault && !["auto", "memory"].includes(requestedDelivery)) {
+    return c.json({ error: 'depositToVault conflicts with the requested delivery; use delivery:"memory" instead.' }, 400);
+  }
+  if (bodyResult.data.preserveMedia !== void 0 && bodyResult.data.downloadMedia !== void 0 && bodyResult.data.preserveMedia !== bodyResult.data.downloadMedia) {
+    return c.json({ error: "preserveMedia conflicts with deprecated downloadMedia." }, 400);
+  }
+  const effectiveDelivery = bodyResult.data.depositToVault ? "memory" : requestedDelivery;
+  const preserveMedia = bodyResult.data.preserveMedia ?? bodyResult.data.downloadMedia ?? false;
   if (!allowLocal) {
     const checked = await validatePublicHttpUrl(url, { field: "URL" });
     if (checked.error || !checked.parsed) return c.json({ error: checked.error ?? "Invalid URL" }, 400);
@@ -35788,19 +36200,47 @@ app.post("/extract-url", auth2, async (c) => {
     if (screenshotBuf) {
       screenshotMeta = { base64: screenshotBuf.toString("base64"), sizeBytes: screenshotBuf.length, device };
     }
-    const mediaMeta = downloadMedia ? await harvestPageMedia(result.bodyHtml, waybackReplay?.originalUrl ?? canonicalUrl, { types: mediaTypes ?? ["image", "video", "audio"], outputDir: null }) : null;
+    const mediaMeta = preserveMedia ? await harvestPageMedia(result.bodyHtml, waybackReplay?.originalUrl ?? canonicalUrl, { types: mediaTypes ?? ["image", "video", "audio"], outputDir: null }) : null;
     const featuredImage = includeFeaturedImage ? resolveFeaturedImage({
       html: result.bodyHtml,
       meta: result.meta,
       schema: result.schema,
       pageUrl: waybackReplay?.rawReplayUrl ?? canonicalUrl
     }) : null;
-    const memory = bodyResult.data.depositToVault ? await persistScrapeBody(user, {
+    const memory = effectiveDelivery === "memory" ? await persistScrapeBody(user, {
       title: result.title ?? canonicalUrl,
       content: result.bodyMarkdown ?? "",
       source: canonicalUrl,
       vault: bodyResult.data.vaultName
     }) : void 0;
+    const imageInputs = [];
+    if (preserveMedia && screenshotMeta?.base64) {
+      imageInputs.push({
+        title: `${result.title ?? canonicalUrl} screenshot`,
+        sourceUrl: canonicalUrl,
+        imageBase64: screenshotMeta.base64,
+        sourceKind: "screenshot",
+        sourceRef: { device }
+      });
+    }
+    if (preserveMedia && mediaMeta) {
+      for (const asset of mediaMeta.assets) {
+        if (asset.type !== "image" || !asset.url.startsWith("https://")) continue;
+        imageInputs.push({
+          title: asset.filename || `${result.title ?? canonicalUrl} image`,
+          sourceUrl: canonicalUrl,
+          imageUrl: asset.url,
+          sourceKind: "page_image"
+        });
+      }
+    }
+    const memoryImages = effectiveDelivery === "memory" && preserveMedia ? await persistScrapeImagesToMemory(user, imageInputs, bodyResult.data.vaultName) : void 0;
+    const screenshotArtifact = preserveMedia && screenshotBuf ? await createImageSourceArtifact({
+      ownerId: String(user.id),
+      content: screenshotBuf,
+      contentType: "image/png",
+      filename: `${new URL(canonicalUrl).hostname}-screenshot.png`
+    }) : void 0;
     const archive = waybackReplay ? {
       timestamp: waybackReplay.timestamp,
       originalUrl: waybackReplay.originalUrl,
@@ -35816,7 +36256,15 @@ app.post("/extract-url", auth2, async (c) => {
       screenshot: screenshotMeta,
       branding: brandingData,
       media: mediaMeta,
-      memory
+      memory,
+      memoryImages,
+      screenshotArtifact,
+      delivery: {
+        requested: requestedDelivery,
+        effective: effectiveDelivery === "auto" ? "inline" : effectiveDelivery,
+        retained: effectiveDelivery === "memory" ? memory?.deposited === true : effectiveDelivery === "artifact",
+        nextAction: effectiveDelivery === "memory" ? "Use Memory search or read tools with the returned note identifiers." : effectiveDelivery === "artifact" ? "Use report_artifact_read with the returned artifactId." : null
+      }
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -35829,9 +36277,11 @@ app.post("/extract-url", auth2, async (c) => {
 });
 app.post("/diff-page", auth2, async (c) => {
   const raw = await c.req.json().catch(() => ({}));
-  const bodyResult = DiffPageBodySchema.safeParse(raw);
+  const allowLocalRequest = permitsLocalApiRequest(c.req.raw);
+  const bodyResult = (allowLocalRequest ? DiffPageLocalBodySchema : DiffPageBodySchema).safeParse(raw);
   if (!bodyResult.success) return c.json({ error: bodyResult.error.issues[0]?.message ?? "Invalid request" }, 400);
-  const { url, allowLocal, resetBaseline } = bodyResult.data;
+  const { url, resetBaseline } = bodyResult.data;
+  const allowLocal = allowLocalRequest && "allowLocal" in bodyResult.data && bodyResult.data.allowLocal === true;
   if (!allowLocal) {
     const checked = await validatePublicHttpUrl(url, { field: "URL" });
     if (checked.error || !checked.parsed) return c.json({ error: checked.error ?? "Invalid URL" }, 400);
@@ -35923,19 +36373,31 @@ app.post("/archive/read", auth2, async (c) => {
       message: bodyResult.error.issues[0]?.message ?? "Invalid request"
     }, 400);
   }
-  const { url, path: path5, depositToLibrary } = bodyResult.data;
+  const { artifactId, url, path: path5, depositToLibrary } = bodyResult.data;
   const user = c.get("user");
   const gate = await acquireConcurrencyGate(user, "archive_read", {
     reuseLockId: c.req.header("x-mcp-scraper-concurrency-lock"),
-    metadata: { url }
+    metadata: artifactId ? { artifactId } : { url }
   });
   if (!gate.ok) return c.json(concurrencyLimitExceededResponse(gate), 429, { "Retry-After": String(gate.retryAfterSeconds) });
   try {
+    let ownedArchive = null;
+    if (artifactId) {
+      const buffer = await readOwnedSiteExtractArtifactBuffer({ artifactId, ownerId: String(user.id) });
+      if (!buffer) throw new ArchiveReadError("archive_not_found", "Archive artifact was not found or has expired.", 404);
+      ownedArchive = { buffer, ref: artifactId };
+    }
     if (!path5) {
-      const inventory = await listZipArchive(url, bodyResult.data.maxEntries ?? 200);
-      return c.json({ mode: "list", ...inventory });
+      const inventory = ownedArchive ? await listZipArchiveBuffer(ownedArchive.buffer, ownedArchive.ref, bodyResult.data.maxEntries ?? 200) : await listZipArchive(url, bodyResult.data.maxEntries ?? 200);
+      return c.json({ mode: "list", ...inventory, ...artifactId ? { artifactId } : {} });
     }
-    const file = await readZipArchiveFile(
+    const file = ownedArchive ? await readZipArchiveBuffer(
+      ownedArchive.buffer,
+      ownedArchive.ref,
+      path5,
+      bodyResult.data.offset ?? 0,
+      bodyResult.data.maxBytes ?? 5e4
+    ) : await readZipArchiveFile(
       url,
       path5,
       bodyResult.data.offset ?? 0,
@@ -35957,7 +36419,7 @@ app.post("/archive/read", auth2, async (c) => {
       summary: `Source file \`${file.path}\` preserved from ZIP archive ${librarySource.split("#")[0]}.`
     }) : void 0;
     const { fullContent: _fullContent, ...responseFile } = file;
-    return c.json({ mode: "read", ...responseFile, memory });
+    return c.json({ mode: "read", ...responseFile, ...artifactId ? { artifactId } : {}, memory });
   } catch (error) {
     const known = error instanceof ArchiveReadError ? error : new ArchiveReadError(
       "archive_read_failed",
@@ -36099,6 +36561,9 @@ app.post("/extract-site", auth2, async (c) => {
   const bodyResult = ExtractSiteBodySchema.safeParse(raw);
   if (!bodyResult.success) return c.json({ error: bodyResult.error.issues[0]?.message ?? "Invalid request" }, 400);
   const body = bodyResult.data;
+  if (body.preserveMedia !== void 0 && body.downloadImages !== void 0 && body.preserveMedia !== body.downloadImages) {
+    return c.json({ error: "preserveMedia conflicts with deprecated downloadImages." }, 400);
+  }
   const checked = await validatePublicHttpUrl(body.url, { field: "URL" });
   if (checked.error || !checked.parsed) return c.json({ error: checked.error ?? "Invalid URL" }, 400);
   const parsed = checked.parsed;
@@ -36122,7 +36587,7 @@ app.post("/extract-site", auth2, async (c) => {
     waybackMonths.length * Math.min(maxPagesPerSnapshot, body.wayback.urls?.length ?? maxPagesPerSnapshot)
   ) : requestedSiteMaxPages(body.maxPages);
   const crawlStartUrl = body.wayback ? waybackRootUrl : waybackReplay?.rawReplayUrl ?? parsed.href;
-  const downloadImages = body.downloadImages === true;
+  const downloadImages = body.preserveMedia ?? body.downloadImages ?? false;
   const shouldRunInBackground = Boolean(body.wayback) || shouldRunSiteExtractInBackground(body);
   if (shouldRunInBackground) {
     const suppliedIdempotencyKey = c.req.header("idempotency-key") ?? c.req.header("x-idempotency-key");
@@ -36136,9 +36601,9 @@ app.post("/extract-site", auth2, async (c) => {
     if (!suppliedIdempotencyKey.trim() || suppliedIdempotencyKey.length > 500) {
       return c.json({ error: "Idempotency-Key must contain 1-500 characters.", errorCode: "invalid_idempotency_key", retryable: false }, 400);
     }
-    const idempotencyKey2 = suppliedIdempotencyKey.trim();
-    c.header("Idempotency-Key", idempotencyKey2);
-    const jobId2 = `ext_${sha256Hex(`${user.id}\0${idempotencyKey2}`).slice(0, 24)}`;
+    const idempotencyKey3 = suppliedIdempotencyKey.trim();
+    c.header("Idempotency-Key", idempotencyKey3);
+    const jobId2 = `ext_${sha256Hex(`${user.id}\0${idempotencyKey3}`).slice(0, 24)}`;
     const requestFingerprint2 = sha256Hex(JSON.stringify({
       url: parsed.href,
       waybackTimestamp: waybackReplay?.timestamp ?? null,
@@ -36157,7 +36622,7 @@ app.post("/extract-site", auth2, async (c) => {
       balanceMc: user.balance_mc,
       startUrl: crawlStartUrl,
       requestedMaxPages,
-      idempotencyKey: idempotencyKey2,
+      idempotencyKey: idempotencyKey3,
       requestFingerprint: requestFingerprint2,
       concurrency: concurrencyLimitForUser(user),
       urlsPerBrowser: body.rotateProxyEvery ?? 10,
@@ -36701,7 +37166,7 @@ app.get("/cron/tick", async (c) => {
   if (!process.env.CRON_SECRET || secret2 !== `Bearer ${process.env.CRON_SECRET}`) {
     return c.json({ error: "Unauthorized" }, 401);
   }
-  const { drainQueue } = await import("./worker-4R3UWQZS.js");
+  const { drainQueue } = await import("./worker-E6MIVF33.js");
   const budget = { maxJobs: 10, deadlineMs: Date.now() + 28e4 };
   const workflowDispatchResult = await dispatchDueWorkflowSchedules(`${new URL(c.req.url).protocol}//${new URL(c.req.url).host}`);
   const [results, sweepResult, reapResult, expiredResult, blobCleanup, connectedDataArtifactCleanup, connectedAccountBilling, directoryWorkflowDispatch, directoryWorkflowReconciliation, directoryArtifactCleanup, siteExtractArtifactCleanup, siteExtractRedispatch, siteExtractReconciliation, paaHarvestRedispatch, paaHarvestReconciliation] = await Promise.all([
@@ -36754,8 +37219,8 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
     finishExtractJob: finishExtractJob2,
     terminalExtractJobStatus: terminalExtractJobStatus2,
     extractJobLimitInfo: extractJobLimitInfo2
-  } = await import("./site-extract-repository-B42SIGAZ.js");
-  const { assembleExtractArtifacts } = await import("./extract-bundle-DMZ63HZU.js");
+  } = await import("./site-extract-repository-XNI4ZK2M.js");
+  const { assembleExtractArtifacts } = await import("./extract-bundle-IOM45SFL.js");
   const existing = await getExtractJob2(jobId2);
   if (!existing) return c.json({ error: "job not found" }, 404);
   if (existing.status !== "failed") {
@@ -36782,7 +37247,7 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
   if (!updated) return c.json({ error: "job state changed during re-finalization" }, 409);
   let settlement = "already_settled_or_refunded";
   if (job.billedMc == null && job.userId != null) {
-    const { settleExtractJob: settleExtractJob3, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-B42SIGAZ.js");
+    const { settleExtractJob: settleExtractJob3, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-XNI4ZK2M.js");
     const heldMc = Number(job.options.heldMc ?? 0);
     const successful = await countSuccessfulPages2(jobId2);
     const usedMc = Math.min(successful * MC_COSTS.page_scrape, heldMc);
@@ -36858,7 +37323,7 @@ app.route("/", oauthApp);
 if (!process.env.INNGEST_EVENT_KEY) {
   startSiteAuditWorker();
 }
-app.get("/font-test", (c) => {
+if (process.env.NODE_ENV !== "production") app.get("/font-test", (c) => {
   return c.html(`<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -36961,4 +37426,4 @@ app.get("/blog/:slug/", (c) => {
 export {
   app
 };
-//# sourceMappingURL=server-2S7KQTPC.js.map
+//# sourceMappingURL=server-WAB6Z47N.js.map