mcp-scraper 0.66.3 → 0.66.5

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ## [Unreleased]
 
+## [0.66.5] - 2026-08-25
+
+### Fixed
+
+- Local Sourcebook submissions now distinguish accepted processing from publication, tell MCP clients to keep checking until the run is terminal, and return a plain-language completion message with the exact live listing URL.
+
+## [0.66.4] - 2026-08-25
+
+### Added
+
+- Connected-service discovery now returns a tenant-owned `userLabel` plus verified provider account ID, email, name, and identity status so agents can select the intended account when one integration has multiple connections.
+- Managed OAuth connections now retain non-secret provider identity metadata and support owner-scoped account names through the dashboard API.
+
+### Fixed
+
+- Nango tenant tags are no longer presented as the external provider account, preventing the MCP Scraper login from being mistaken for the Google, Slack, GitHub, Zoom, or other authorized identity.
+
 ## [0.66.3] - 2026-08-25
 
 ### Changed
@@ -1098,7 +1115,8 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Write actions remain unavailable until the account owner explicitly enables them.
 - Provider-specific connection data is normalized into one agent-facing contract.
 
-[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.3...HEAD
+[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.4...HEAD
+[0.66.4]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.3...v0.66.4
 [0.66.3]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.2...v0.66.3
 [0.66.2]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.1...v0.66.2
 [0.66.1]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.0...v0.66.1

package/README.md

@@ -159,7 +159,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.66.3`, SHA-256 `353b034b878340971fc1e07ca2ccf11578d6fd2e2ff894c8da1fa7df2c2bbd2d`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.66.5`, SHA-256 `958313b3c6a41b73a725bac75770f5d429d6a4969966f3051c86d51087f76993`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 

package/dist/bin/api-server.cjs

@@ -33148,12 +33148,39 @@ function localSourcebookPublicUrls(category, state, slug4) {
   };
 }
 function localSourcebookPublicationLinks(submission) {
+  const isLive = submission.publishedRevision !== null && submission.status !== "rejected" && submission.status !== "unpublished";
   return {
     ...localSourcebookPublicUrls(submission.category, submission.state, submission.slug),
     publicationStatus: submission.status,
-    isLive: submission.status === "published" && submission.publishedRevision !== null
+    isLive
   };
 }
+function localSourcebookPublicationMessage(submission) {
+  const { profileUrl } = localSourcebookPublicUrls(submission.category, submission.state, submission.slug);
+  if (submission.status === "published" && submission.publishedRevision !== null) {
+    return `Your Local Sourcebook listing is live: ${profileUrl}`;
+  }
+  if (submission.status === "failed") {
+    if (submission.publishedRevision !== null) {
+      return `We couldn't refresh this Local Sourcebook listing, but the previous version is still live: ${profileUrl}`;
+    }
+    return "We couldn't publish this Local Sourcebook listing because evidence collection failed. Review the reported issue before trying again.";
+  }
+  if (submission.status === "rejected") {
+    return "This Local Sourcebook listing was rejected and is not live.";
+  }
+  if (submission.status === "unpublished") {
+    return "This Local Sourcebook listing has been unpublished and is not live.";
+  }
+  if (submission.publishedRevision !== null) {
+    return `We are collecting and compiling refreshed evidence. The current Local Sourcebook listing remains live: ${profileUrl}`;
+  }
+  return "Submission received. We are collecting and compiling evidence, so this Local Sourcebook listing is not live yet. Check the submission status again in about 10 seconds.";
+}
+function localSourcebookStatusCheck(submission) {
+  const required = submission.status === "queued" || submission.status === "enriching" || submission.status === "needs_review";
+  return required ? { required: true, submissionId: submission.id, pollAfterSeconds: 10 } : { required: false, submissionId: submission.id };
+}
 var DEFAULT_ROOT_DOMAIN, CATEGORY_PUBLIC_SLUGS;
 var init_local_sourcebook_public_urls = __esm({
   "src/api/local-sourcebook-public-urls.ts"() {
@@ -45265,7 +45292,7 @@ var init_local_sourcebook_routes = __esm({
         persisted = true;
         await persistLocalSourcebookTags(submission.id, Number(user.id), validation.normalizedTags, parsed.data.tagDecisions);
         const dispatched = await dispatchLocalSourcebookAcquisition(submission.id).catch(() => false);
-        return c.json({ ok: true, valid: true, submission, publicUrls: localSourcebookPublicationLinks(submission), normalizedTags: validation.normalizedTags, acquisition: { queued: true, dispatched }, acquisitionPlan: acquisitionPlan(identity.websiteUrl), billing: publicListingWriteBilling(billing) }, 202);
+        return c.json({ ok: true, valid: true, message: localSourcebookPublicationMessage(submission), statusCheck: localSourcebookStatusCheck(submission), submission, publicUrls: localSourcebookPublicationLinks(submission), normalizedTags: validation.normalizedTags, acquisition: { queued: true, dispatched }, acquisitionPlan: acquisitionPlan(identity.websiteUrl), billing: publicListingWriteBilling(billing) }, 202);
       } catch (error) {
         if (billing && !persisted) await refundListingWrite(billing, "Local Sourcebook creation failed before persistence.").catch(() => null);
         const message = error instanceof Error ? error.message : String(error);
@@ -45314,7 +45341,7 @@ var init_local_sourcebook_routes = __esm({
         });
         persisted = true;
         const dispatched = await dispatchLocalSourcebookAcquisition(submission.id).catch(() => false);
-        return c.json({ ok: true, submission, publicUrls: localSourcebookPublicationLinks(submission), acquisition: { queued: true, dispatched }, acquisitionPlan: acquisitionPlan(input.websiteUrl), billing: publicListingWriteBilling(billing) }, 202);
+        return c.json({ ok: true, message: localSourcebookPublicationMessage(submission), statusCheck: localSourcebookStatusCheck(submission), submission, publicUrls: localSourcebookPublicationLinks(submission), acquisition: { queued: true, dispatched }, acquisitionPlan: acquisitionPlan(input.websiteUrl), billing: publicListingWriteBilling(billing) }, 202);
       } catch (error) {
         if (billing && !persisted) await refundListingWrite(billing, "Local Sourcebook creation failed before persistence.").catch(() => null);
         return c.json({ error: "submission_conflict", message: error instanceof Error ? error.message : String(error) }, 409);
@@ -45324,7 +45351,7 @@ var init_local_sourcebook_routes = __esm({
       const userId = Number(c.get("user").id);
       const submission = await getLocalSourcebookSubmission(c.req.param("id"), userId);
       if (!submission) return c.json({ error: "not_found" }, 404);
-      return c.json({ ok: true, submission, publicUrls: localSourcebookPublicationLinks(submission), draft: await getLocalSourcebookDraft(submission.id, userId) });
+      return c.json({ ok: true, message: localSourcebookPublicationMessage(submission), statusCheck: localSourcebookStatusCheck(submission), submission, publicUrls: localSourcebookPublicationLinks(submission), draft: await getLocalSourcebookDraft(submission.id, userId) });
     });
     localSourcebookApp.on(["PATCH", "POST"], "/submissions/:id/draft", createApiKeyAuth(), (c) => c.json({
       error: "evidence_refresh_required",
@@ -45359,7 +45386,7 @@ var init_local_sourcebook_routes = __esm({
           return c.json({ error: "not_found" }, 404);
         }
         const dispatched = await dispatchLocalSourcebookAcquisition(submission.id).catch(() => false);
-        return c.json({ ok: true, submission, publicUrls: localSourcebookPublicationLinks(submission), acquisition: { queued: true, dispatched }, acquisitionPlan: acquisitionPlan(submission.websiteUrl), billing: publicListingWriteBilling(billing) }, 202);
+        return c.json({ ok: true, message: localSourcebookPublicationMessage(submission), statusCheck: localSourcebookStatusCheck(submission), submission, publicUrls: localSourcebookPublicationLinks(submission), acquisition: { queued: true, dispatched }, acquisitionPlan: acquisitionPlan(submission.websiteUrl), billing: publicListingWriteBilling(billing) }, 202);
       } catch (error) {
         if (billing) await refundListingWrite(billing, "Local Sourcebook refresh failed before persistence.").catch(() => null);
         return c.json({ error: "moderated_listing", message: error instanceof Error ? error.message : String(error) }, 409);
@@ -49679,7 +49706,7 @@ var PACKAGE_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    PACKAGE_VERSION = "0.66.3";
+    PACKAGE_VERSION = "0.66.5";
   }
 });
 
@@ -49910,11 +49937,16 @@ Multi-step orchestrations \u2014 prefer these over hand-chaining primitives when
 - A new capture costs 10 Credits total and includes broad website, exact Maps place, maximum-accessible review,
   service-area, staff, and genuine-media acquisition. When compilation succeeds, that exact system-authored evidence revision
   publishes automatically. Never supply owner-authored services, reviews, images, or other public claims.
+- An accepted capture is still processing, not complete. While its returned \`statusCheck.required\` is true,
+  wait the suggested interval and call **local_sourcebook_submission_status** again before giving the user a
+  final completion answer. When it publishes, say that the listing is live and include the exact clickable
+  \`publicUrls.profileUrl\`; when it fails, report the returned failure message and cause.
 - Read progress and the compiled record with **local_sourcebook_submission_status**. Use
   **local_sourcebook_refresh** only when the owner intentionally wants to pay 2 Credits for a new acquisition pass.
   Contract, tag, preparation, validation, and status tools are free; idempotent retries are not charged twice.
-- Capture and status responses return \`publicUrls.profileUrl\` and \`publicUrls.reviewsUrl\`. Always give those
-  exact links to the user; do not report a listing as live without including its clickable profile URL.
+- Capture and status responses return a plain-language \`message\`, a \`statusCheck\`, and exact public URLs. Do not
+  describe a queued or enriching listing as complete, and do not report a listing as live without including its
+  clickable \`publicUrls.profileUrl\`.
 - The last published revision remains public during refresh. Administrators can reject or unpublish an
   exceptional record, but routine subscriber publication does not require administrator review.
 
@@ -49940,10 +49972,10 @@ Multi-step orchestrations \u2014 prefer these over hand-chaining primitives when
   artifact, call \`report_artifact_read\` with the returned artifactId and follow nextOffset until null. This
   works through the authenticated MCP connection even when the client cannot open the signed download URL;
   do not try curl or web_fetch. Use \`archive_read\` for ZIP archives.
-- Before using a connected account, call \`list_service_connections\` and match the intended provider-side
-  identity from \`providerAccountEmail\` or \`providerAccountName\`, not the MCP Scraper login. If
-  \`providerIdentityStatus\` is \`unavailable\`, ask the person to refresh that connection before assuming
-  which external account it represents.
+- Before using a connected account, call \`list_service_connections\`. Match an explicit \`userLabel\` first,
+  then verified provider-side \`providerAccountEmail\`, \`providerAccountName\`, or \`providerAccountId\`; never
+  treat the MCP Scraper login as external-provider identity. If identity is pending or unavailable and no
+  distinct user label exists, ask the person which connection they mean instead of assuming.
 - For Google Search Console, use \`export_connected_service_data\` with
   \`dataset:"search_console_performance"\` when the person asks for a fresh JSONL download. When they
   ask to schedule ingestion or repeatedly filter historical rows, create a \`connection_sync\` schedule,
@@ -53853,7 +53885,12 @@ var init_mcp_tool_schemas = __esm({
         connectionId: import_zod45.z.string(),
         providerConfigKey: import_zod45.z.string(),
         provider: import_zod45.z.string().nullable().optional(),
-        label: import_zod45.z.string(),
+        label: import_zod45.z.string().describe("Best available human-facing account label: a userLabel when set, otherwise verified provider identity, then a stable fallback."),
+        userLabel: import_zod45.z.string().nullable().optional().describe("Optional tenant-owned name set in the dashboard to distinguish this connection. This is not asserted provider identity."),
+        providerAccountId: import_zod45.z.string().nullable().optional().describe("Stable provider-side account, user, workspace, channel, or tenant identifier when the provider exposes one."),
+        providerAccountEmail: import_zod45.z.string().email().nullable().optional().describe("Verified provider-side email when the provider exposes one. This is never inferred from the MCP Scraper login."),
+        providerAccountName: import_zod45.z.string().nullable().optional().describe("Provider-side account, user, workspace, channel, or tenant name when the provider exposes one."),
+        providerIdentityStatus: import_zod45.z.enum(["pending", "verified", "unavailable"]).optional().describe("Whether provider identity discovery is pending, returned at least one verified provider identifier, or completed without one."),
         status: import_zod45.z.string(),
         lifecycleStatus: import_zod45.z.enum(["pending", "connected", "needs_reauth", "disconnecting", "disconnected"]).optional().describe("Credential lifecycle. This is separate from current provider availability."),
         operationalStatus: import_zod45.z.enum(["unknown", "available", "degraded", "unavailable"]).optional().describe("Last observed provider transport availability. Unavailable does not imply reconnect is required."),
@@ -56205,14 +56242,14 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => executor.validateLocalSourcebookWrite(input));
   server.registerTool("local-sourcebook-capture", {
     title: "Capture Governed Local Sourcebook Listing",
-    description: "Strict owner-scoped LocalBusiness write path after list, contract, prepare, and validate. Creating a listing costs 10 Credits total, including website, exact-place, review, service-area, staff, genuine-media, and structured-data compilation; preparation and validation are free, and idempotent retries are not charged twice. Capture registers canonical tags and the accepted Schema.org LocalBusiness subtype, returns the exact LocalSourcebook.com profile and reviews URLs, and queues acquisition. MCP Scraper generates the final JSON-LD from source-backed evidence. A successful system-compiled evidence revision publishes automatically; owner-authored public claims and arbitrary JSON-LD are not accepted.",
+    description: "Strict owner-scoped LocalBusiness write path after list, contract, prepare, and validate. Creating a listing costs 10 Credits total, including website, exact-place, review, service-area, staff, genuine-media, and structured-data compilation; preparation and validation are free, and idempotent retries are not charged twice. Capture registers canonical tags and the accepted Schema.org LocalBusiness subtype, then queues acquisition; an accepted capture is not yet live. Poll local_sourcebook_submission_status using statusCheck until it is terminal. When published, tell the user the returned message and exact publicUrls.profileUrl. MCP Scraper generates the final JSON-LD from source-backed evidence and publishes a successful system-compiled revision automatically; owner-authored public claims and arbitrary JSON-LD are not accepted.",
     inputSchema: LocalSourcebookCaptureInputSchema,
     outputSchema: recordOutputSchema("local-sourcebook-capture", LocalSourcebookOutputSchema),
     annotations: liveWebToolAnnotations("Capture Governed Local Sourcebook Listing")
   }, async (input) => executor.localSourcebookCapture(input));
   server.registerTool("local_sourcebook_submission_status", {
     title: "Local Sourcebook Submission Status",
-    description: "Read the caller\u2019s listing draft, enrichment coverage, revision number, publication state, and live LocalSourcebook.com profile and reviews URLs. When status is failed, acquisitionError says why \u2014 read it before retrying, since a refresh repeats the same acquisition. Coverage counters are written only on success, so zeroed counters on a failed listing do not mean the crawl never ran.",
+    description: "Read the caller\u2019s listing draft, enrichment coverage, revision number, publication state, and LocalSourcebook.com profile and reviews URLs. While statusCheck.required is true, wait the returned interval and check again before giving the user a final completion answer. When published, present the returned message and exact clickable publicUrls.profileUrl. When failed, present the failure message and read acquisitionError before retrying, since a refresh repeats the same acquisition. Coverage counters are written only on success, so zeroed counters on a failed listing do not mean the crawl never ran.",
     inputSchema: LocalSourcebookSubmissionStatusInputSchema,
     outputSchema: recordOutputSchema("local_sourcebook_submission_status", LocalSourcebookOutputSchema),
     annotations: localPlanningToolAnnotations("Local Sourcebook Submission Status")
@@ -56357,7 +56394,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => formatCreditsInfo(await executor.creditsInfo(input), input));
   server.registerTool("list_service_connections", {
     title: "List Connected Services",
-    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId, credential transport, exact live readTools and gated actionTools, permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers, permanently blocked administrative tools, and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
+    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId; a tenant-owned userLabel; verified provider-side account ID, email, or name when available; credential transport; exact live readTools and gated actionTools; permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers; permanently blocked administrative tools; and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
     inputSchema: ListServiceConnectionsInputSchema,
     outputSchema: recordOutputSchema("list_service_connections", ListServiceConnectionsOutputSchema),
     annotations: { title: "List Connected Services", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
@@ -81169,6 +81206,12 @@ function ensureServiceConnectionsSchema() {
         transport                  TEXT NOT NULL,
         upstream_connection_id     TEXT,
         label                      TEXT,
+        user_label                 TEXT,
+        provider_account_id        TEXT,
+        provider_account_email     TEXT,
+        provider_account_name      TEXT,
+        provider_identity_checked_at TEXT,
+        provider_identity_source_updated_at TEXT,
         lifecycle_status           TEXT NOT NULL DEFAULT 'pending',
         operational_status         TEXT NOT NULL DEFAULT 'unknown',
         reconnect_required         INTEGER NOT NULL DEFAULT 0,
@@ -81190,6 +81233,30 @@ function ensureServiceConnectionsSchema() {
         UNIQUE(user_id, provider_config_key, upstream_connection_id)
       )
     `);
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN user_label TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_id TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_email TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_name TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_checked_at TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_source_updated_at TEXT`);
+    } catch {
+    }
     await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_user_updated ON service_connections(user_id, updated_at DESC)`);
     await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_upstream ON service_connections(provider_config_key, upstream_connection_id)`);
     await db.execute(`
@@ -81250,6 +81317,12 @@ function rowToRecord(row) {
     transport: row.transport === "remote_mcp" ? "remote_mcp" : "nango",
     upstreamConnectionId: typeof row.upstream_connection_id === "string" ? row.upstream_connection_id : null,
     label: typeof row.label === "string" ? row.label : null,
+    userLabel: typeof row.user_label === "string" ? row.user_label : null,
+    providerAccountId: typeof row.provider_account_id === "string" ? row.provider_account_id : null,
+    providerAccountEmail: typeof row.provider_account_email === "string" ? row.provider_account_email : null,
+    providerAccountName: typeof row.provider_account_name === "string" ? row.provider_account_name : null,
+    providerIdentityCheckedAt: typeof row.provider_identity_checked_at === "string" ? row.provider_identity_checked_at : null,
+    providerIdentitySourceUpdatedAt: typeof row.provider_identity_source_updated_at === "string" ? row.provider_identity_source_updated_at : null,
     lifecycleStatus: String(row.lifecycle_status),
     operationalStatus: String(row.operational_status),
     reconnectRequired: Number(row.reconnect_required) === 1,
@@ -81335,6 +81408,34 @@ async function updateServiceConnectionTools(connectionId, readTools, actionTools
     args: [JSON.stringify(readTools), JSON.stringify(actionTools), toolRevision, connectionId]
   });
 }
+async function setServiceConnectionProviderIdentity(args) {
+  await ensureServiceConnectionsSchema();
+  await getDb().execute({
+    sql: `
+      UPDATE service_connections SET
+        provider_account_id = ?, provider_account_email = ?, provider_account_name = ?,
+        provider_identity_checked_at = datetime('now'), provider_identity_source_updated_at = ?,
+        updated_at = datetime('now')
+      WHERE id = ?
+    `,
+    args: [
+      args.providerAccountId ?? null,
+      args.providerAccountEmail?.toLowerCase() ?? null,
+      args.providerAccountName ?? null,
+      args.sourceUpdatedAt,
+      args.connectionId
+    ]
+  });
+}
+async function setServiceConnectionUserLabel(identity, connectionId, userLabel) {
+  const connection = await getOwnedServiceConnection(identity, connectionId);
+  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connections SET user_label = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
+    args: [userLabel, connectionId, connection.userId]
+  });
+  return userLabel;
+}
 async function recordServiceConnectionHealth(args) {
   await ensureServiceConnectionsSchema();
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -84411,7 +84512,8 @@ async function nangoRequest(path6, options = {}) {
       headers: {
         authorization: `Bearer ${nangoSecret()}`,
         accept: "application/json",
-        ...options.body ? { "content-type": "application/json" } : {}
+        ...options.body ? { "content-type": "application/json" } : {},
+        ...options.headers
       },
       body: options.body ? JSON.stringify(options.body) : void 0,
       signal: AbortSignal.timeout(NANGO_TIMEOUT_MS)
@@ -84459,22 +84561,126 @@ function discoveredConnection(value) {
   const upstreamConnectionId = text(row?.connection_id);
   const providerConfigKey = text(row?.provider_config_key);
   if (!upstreamConnectionId || !providerConfigKey) return null;
-  const tags = asRecord2(row?.tags);
-  const endUser = asRecord2(row?.end_user);
   const errors = Array.isArray(row?.errors) ? row.errors : [];
   const authError = errors.some((error) => text(asRecord2(error)?.type) === "auth");
   return {
     upstreamConnectionId,
     providerConfigKey,
     provider: text(row?.provider) ?? providerConfigKey,
-    label: text(tags?.end_user_display_name) ?? text(endUser?.display_name) ?? text(tags?.end_user_email) ?? text(endUser?.email),
+    // Nango's end-user fields identify the MCP Scraper tenant, not the
+    // provider-side principal that authorized this connection.
+    label: null,
     lifecycleStatus: authError ? "needs_reauth" : "connected",
     reconnectRequired: authError,
     createdAt: text(row?.created_at) ?? text(row?.created),
     updatedAt: text(row?.updated_at)
   };
 }
-async function discoverOwnedNangoConnections(identity) {
+function scalarId(value) {
+  const valueText = text(value);
+  if (valueText) return valueText;
+  return typeof value === "number" && Number.isFinite(value) ? String(value) : null;
+}
+function providerEmail(value) {
+  const email = text(value)?.toLowerCase() ?? null;
+  return email && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) ? email : null;
+}
+function compactProviderIdentity(identity) {
+  return identity.id || identity.email || identity.name ? identity : null;
+}
+async function providerProxyJson(args) {
+  return nangoRequest(`/proxy${args.path}`, {
+    query: args.query,
+    headers: {
+      "connection-id": args.upstreamConnectionId,
+      "provider-config-key": args.providerConfigKey,
+      ...args.baseUrlOverride ? { "base-url-override": args.baseUrlOverride } : {}
+    }
+  });
+}
+async function googleProviderAccountIdentity(args) {
+  const request = (path6, query, baseUrlOverride) => providerProxyJson({ ...args, path: path6, query, baseUrlOverride });
+  try {
+    if (args.providerConfigKey === "google-mail") {
+      const payload = asRecord2(await request("/gmail/v1/users/me/profile", void 0, "https://gmail.googleapis.com"));
+      const email = providerEmail(payload?.emailAddress);
+      return compactProviderIdentity({ id: email, email, name: null });
+    }
+    if (args.providerConfigKey === "google-drive") {
+      const payload = asRecord2(await request("/drive/v3/about", { fields: "user(permissionId,displayName,emailAddress)" }, "https://www.googleapis.com"));
+      const user = asRecord2(payload?.user);
+      return compactProviderIdentity({
+        id: text(user?.permissionId),
+        email: providerEmail(user?.emailAddress),
+        name: text(user?.displayName)
+      });
+    }
+    if (args.providerConfigKey === "google-calendar") {
+      const payload = asRecord2(await request("/calendar/v3/calendars/primary", void 0, "https://www.googleapis.com"));
+      const id = text(payload?.id);
+      return compactProviderIdentity({ id, email: providerEmail(id), name: text(payload?.summary) });
+    }
+    if (args.providerConfigKey === "youtube") {
+      const payload = asRecord2(await request("/youtube/v3/channels", { part: "snippet", mine: "true", maxResults: 1 }, "https://www.googleapis.com"));
+      const first = Array.isArray(payload?.items) ? asRecord2(payload.items[0]) : null;
+      return compactProviderIdentity({ id: text(first?.id), email: null, name: text(asRecord2(first?.snippet)?.title) });
+    }
+  } catch {
+  }
+  try {
+    const payload = asRecord2(await request("/v1/userinfo", void 0, "https://openidconnect.googleapis.com"));
+    return compactProviderIdentity({
+      id: text(payload?.sub),
+      email: payload?.email_verified === false ? null : providerEmail(payload?.email),
+      name: text(payload?.name)
+    });
+  } catch {
+    return null;
+  }
+}
+async function getNangoProviderAccountIdentity(args) {
+  if (!IDENTITY_SUPPORTED_PROVIDERS.has(args.providerConfigKey)) return null;
+  if (args.providerConfigKey.startsWith("google-") || args.providerConfigKey === "youtube") {
+    return googleProviderAccountIdentity(args);
+  }
+  try {
+    if (args.providerConfigKey === "github-getting-started") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/user" }));
+      return compactProviderIdentity({ id: scalarId(payload?.id), email: providerEmail(payload?.email), name: text(payload?.name) ?? text(payload?.login) });
+    }
+    if (args.providerConfigKey === "slack") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/api/auth.test" }));
+      return compactProviderIdentity({ id: text(payload?.user_id), email: null, name: [text(payload?.user), text(payload?.team)].filter(Boolean).join(" \xB7 ") || null });
+    }
+    if (args.providerConfigKey === "zoom") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/v2/users/me" }));
+      const fullName = [text(payload?.first_name), text(payload?.last_name)].filter(Boolean).join(" ");
+      return compactProviderIdentity({ id: text(payload?.id), email: providerEmail(payload?.email), name: text(payload?.display_name) ?? (fullName || null) });
+    }
+    if (args.providerConfigKey === "linkedin") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/v2/userinfo" }));
+      return compactProviderIdentity({ id: text(payload?.sub), email: payload?.email_verified === false ? null : providerEmail(payload?.email), name: text(payload?.name) });
+    }
+    if (args.providerConfigKey === "meta-marketing-api" || args.providerConfigKey === "facebook") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/me", query: { fields: "id,name,email" } }));
+      return compactProviderIdentity({ id: text(payload?.id), email: providerEmail(payload?.email), name: text(payload?.name) });
+    }
+    if (args.providerConfigKey === "twitter-v2") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/2/users/me", query: { "user.fields": "id,name,username" } }));
+      const data = asRecord2(payload?.data);
+      return compactProviderIdentity({ id: text(data?.id), email: null, name: text(data?.username) ?? text(data?.name) });
+    }
+    if (args.providerConfigKey === "xero") {
+      const payload = await providerProxyJson({ ...args, path: "/connections" });
+      const first = Array.isArray(payload) ? asRecord2(payload[0]) : null;
+      return compactProviderIdentity({ id: text(first?.tenantId), email: null, name: text(first?.tenantName) });
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+async function discoverOwnedNangoConnections(identity, options = {}) {
   const rows = [];
   for (let page = 0; page < NANGO_CONNECTION_MAX_PAGES; page += 1) {
     const payload = await nangoRequest("/connections", {
@@ -84485,6 +84691,35 @@ async function discoverOwnedNangoConnections(identity) {
     if (pageRows.length < NANGO_CONNECTION_PAGE_SIZE) break;
   }
   const discovered = rows.filter((row) => connectionIdentityMatches(row, identity)).map(discoveredConnection).filter((connection) => connection !== null);
+  const reconciled = await reconcileDiscoveredNangoConnections(identity, discovered);
+  if (options.resolveProviderIdentity === false) return reconciled;
+  const remoteByKey = new Map(discovered.map((connection) => [
+    `${connection.providerConfigKey}\0${connection.upstreamConnectionId}`,
+    connection
+  ]));
+  await Promise.all(reconciled.map(async (connection) => {
+    if (connection.lifecycleStatus !== "connected" || !connection.upstreamConnectionId) return;
+    const remote = remoteByKey.get(`${connection.providerConfigKey}\0${connection.upstreamConnectionId}`);
+    if (!remote) return;
+    const sourceUpdatedAt = remote.updatedAt ?? remote.createdAt ?? connection.lifecycleStatus;
+    const hasProviderIdentity = Boolean(
+      connection.providerAccountId || connection.providerAccountEmail || connection.providerAccountName
+    );
+    const checkedAt = connection.providerIdentityCheckedAt ? Date.parse(`${connection.providerIdentityCheckedAt.replace(" ", "T")}Z`) : Number.NaN;
+    const unavailableIdentityIsFresh = !hasProviderIdentity && Number.isFinite(checkedAt) && Date.now() - checkedAt < PROVIDER_IDENTITY_RETRY_MS;
+    if (connection.providerIdentitySourceUpdatedAt === sourceUpdatedAt && (hasProviderIdentity || unavailableIdentityIsFresh)) return;
+    const providerIdentity = await getNangoProviderAccountIdentity({
+      upstreamConnectionId: connection.upstreamConnectionId,
+      providerConfigKey: connection.providerConfigKey
+    });
+    await setServiceConnectionProviderIdentity({
+      connectionId: connection.id,
+      providerAccountId: providerIdentity?.id,
+      providerAccountEmail: providerIdentity?.email,
+      providerAccountName: providerIdentity?.name,
+      sourceUpdatedAt
+    });
+  }));
   return reconcileDiscoveredNangoConnections(identity, discovered);
 }
 async function listNangoCatalogDirect() {
@@ -84747,7 +84982,7 @@ async function describeNangoToolDirect(identity, connectionId, toolName) {
     fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-var import_node_crypto68, import_client13, DEFAULT_NANGO_MCP_URL, NANGO_TIMEOUT_MS, NANGO_CONNECTION_PAGE_SIZE, NANGO_CONNECTION_MAX_PAGES, MAIN_INTEGRATION_CONTRACT_VERSION, MAIN_INTEGRATION_CONTRACT_HASH, MainNangoTransportError;
+var import_node_crypto68, import_client13, DEFAULT_NANGO_MCP_URL, NANGO_TIMEOUT_MS, NANGO_CONNECTION_PAGE_SIZE, NANGO_CONNECTION_MAX_PAGES, PROVIDER_IDENTITY_RETRY_MS, MAIN_INTEGRATION_CONTRACT_VERSION, MAIN_INTEGRATION_CONTRACT_HASH, MainNangoTransportError, IDENTITY_SUPPORTED_PROVIDERS;
 var init_main_nango_transport = __esm({
   "src/api/main-nango-transport.ts"() {
     "use strict";
@@ -84761,6 +84996,7 @@ var init_main_nango_transport = __esm({
     NANGO_TIMEOUT_MS = 2e4;
     NANGO_CONNECTION_PAGE_SIZE = 100;
     NANGO_CONNECTION_MAX_PAGES = 20;
+    PROVIDER_IDENTITY_RETRY_MS = 6 * 60 * 60 * 1e3;
     MAIN_INTEGRATION_CONTRACT_VERSION = "2026-07-16.1";
     MAIN_INTEGRATION_CONTRACT_HASH = "f037859ec80c2ea2fac6e4a67c1a59f3200dd22d3642c97789b9bb3236723d3e";
     MainNangoTransportError = class extends Error {
@@ -84777,6 +85013,22 @@ var init_main_nango_transport = __esm({
         this.retryAfterMs = retryAfterMs;
       }
     };
+    IDENTITY_SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set([
+      "facebook",
+      "github-getting-started",
+      "google-analytics",
+      "google-calendar",
+      "google-drive",
+      "google-mail",
+      "google-search-console",
+      "linkedin",
+      "meta-marketing-api",
+      "slack",
+      "twitter-v2",
+      "xero",
+      "youtube",
+      "zoom"
+    ]);
   }
 });
 
@@ -85067,7 +85319,7 @@ async function getNangoConnections(identity, options = {}) {
   if (mainOwnsIntegrations()) {
     let connections;
     try {
-      connections = await discoverOwnedNangoConnections(identity);
+      connections = await discoverOwnedNangoConnections(identity, { resolveProviderIdentity: !options.summaryOnly });
     } catch (error) {
       try {
         connections = await listServiceConnections(identity, "nango");
@@ -85088,11 +85340,12 @@ async function getNangoConnections(identity, options = {}) {
         connectionId: connection.id,
         providerConfigKey: connection.providerConfigKey,
         provider: connection.provider,
-        label: connection.label || connection.providerConfigKey,
-        providerAccountId: null,
-        providerAccountEmail: null,
-        providerAccountName: null,
-        providerIdentityStatus: "unavailable",
+        label: connection.userLabel || connection.providerAccountEmail || connection.providerAccountName || (connection.label && connection.label.toLowerCase() !== identity.trim().toLowerCase() ? connection.label : null) || connection.providerConfigKey,
+        userLabel: connection.userLabel,
+        providerAccountId: connection.providerAccountId,
+        providerAccountEmail: connection.providerAccountEmail,
+        providerAccountName: connection.providerAccountName,
+        providerIdentityStatus: connection.providerIdentityCheckedAt ? connection.providerAccountId || connection.providerAccountEmail || connection.providerAccountName ? "verified" : "unavailable" : "pending",
         status: connection.reconnectRequired ? "needs_reauth" : "connected",
         lifecycleStatus: connection.lifecycleStatus,
         operationalStatus: connection.operationalStatus,
@@ -85193,6 +85446,7 @@ async function getNangoConnections(identity, options = {}) {
       providerConfigKey,
       provider,
       label,
+      userLabel: null,
       providerAccountId,
       providerAccountEmail,
       providerAccountName,
@@ -86968,6 +87222,7 @@ var init_server = __esm({
     init_scheduling_access();
     init_memory_db();
     init_nango_control();
+    init_service_connections();
     init_resend_control();
     init_scheduler_integration_auth();
     init_connected_account_billing();
@@ -87559,6 +87814,26 @@ var init_server = __esm({
         return scheduleConnectionError(c, err, "Unable to load service connections.");
       }
     });
+    app.patch("/schedule-connections/:id/label", auth4, async (c) => {
+      const user = c.get("user");
+      const body = await c.req.json().catch(() => ({}));
+      if (body.label !== null && typeof body.label !== "string") {
+        return c.json({ ok: false, error: "label must be a string or null." }, 400);
+      }
+      const label = typeof body.label === "string" ? body.label.normalize("NFKC").trim().replace(/\s+/g, " ") : null;
+      if (label && label.length > 80) {
+        return c.json({ ok: false, error: "label must contain at most 80 characters." }, 400);
+      }
+      try {
+        const userLabel = await setServiceConnectionUserLabel(user.email, c.req.param("id"), label || null);
+        return c.json({ ok: true, userLabel });
+      } catch (err) {
+        if (err instanceof Error && err.message === "service_connection_not_found") {
+          return c.json({ ok: false, error: "Service connection not found." }, 404);
+        }
+        return scheduleConnectionError(c, err, "Unable to rename this service connection.");
+      }
+    });
     app.post("/schedule-connections/billing/reconcile", auth4, requireIntegrationsTier, async (c) => {
       const user = c.get("user");
       try {
@@ -88117,6 +88392,7 @@ var init_server = __esm({
     app.post("/integrations/:id/reconnect-session", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/reconnect-session`));
     app.post("/integrations/:id/enable-actions", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/enable-actions`));
     app.post("/integrations/:id/test", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/test`));
+    app.patch("/integrations/:id/label", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/label`));
     app.delete("/integrations/:id", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}`));
     app.post("/integrations/actions/read", (c) => forwardIntegrationAlias(c, "/schedule-connections/actions/read"));
     app.post("/integrations/actions/describe", (c) => forwardIntegrationAlias(c, "/schedule-connections/actions/describe"));

package/dist/bin/api-server.js

@@ -17,7 +17,7 @@ loadDotEnv();
 async function main() {
   const [{ serve }, { app }, { startWorker }, { migrate }] = await Promise.all([
     import("@hono/node-server"),
-    import("../server-D47PNEXR.js"),
+    import("../server-LESUYFDI.js"),
     import("../worker-UTBUWEXQ.js"),
     import("../db-4RVZ3NYZ.js")
   ]);

package/dist/bin/mcp-scraper-cli.cjs

@@ -30,7 +30,7 @@ var import_promises5 = require("fs/promises");
 var import_node_path3 = require("path");
 
 // src/version.ts
-var PACKAGE_VERSION = "0.66.3";
+var PACKAGE_VERSION = "0.66.5";
 
 // src/cli/agent-config.ts
 function apiKeyValue(options) {

package/dist/bin/mcp-scraper-cli.js

@@ -13,7 +13,7 @@ import "../chunk-VXLU74YZ.js";
 import "../chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-JBFLOJGM.js";
+} from "../chunk-RSFMR7O7.js";
 
 // src/cli/human-cli.ts
 import { Command } from "commander";