mcp-scraper 0.66.5 → 0.66.7

package/dist/bin/api-server.cjs

@@ -164,6 +164,20 @@ function publicErrorType(code) {
     case "site_export_read_failed":
     case "site_export_image_not_found":
       return "extraction";
+    case "image_url_invalid":
+    case "image_url_not_https":
+    case "image_host_unresolvable":
+    case "image_host_blocked":
+    case "image_redirect_invalid":
+    case "image_source_unavailable":
+    case "image_too_large":
+    case "image_redirect_limit":
+    case "image_base64_invalid":
+    case "image_source_missing":
+    case "image_format_unsupported":
+    case "image_storage_unconfigured":
+    case "featured_image_unhostable":
+      return "invalid_request";
     case "insufficient_balance":
       return "billing";
     case "vendor_unavailable":
@@ -237,6 +251,32 @@ function publicErrorMessage(code) {
       return "The stored site export could not be read or did not pass its integrity check.";
     case "site_export_image_not_found":
       return "The requested site-export image was not found, expired, or does not belong to this account.";
+    case "image_url_invalid":
+      return "The image source is not a valid URL. Use a stable public HTTPS URL or inline image bytes.";
+    case "image_url_not_https":
+      return "Commons image sources must use a public HTTPS URL or inline image bytes.";
+    case "image_host_unresolvable":
+      return "The image host could not be resolved. Use a different stable public URL or inline image bytes.";
+    case "image_host_blocked":
+      return "The image source resolves to a network address Commons cannot fetch safely.";
+    case "image_redirect_invalid":
+      return "The image source redirected to an invalid or unsafe destination.";
+    case "image_source_unavailable":
+      return "The image source could not be fetched. Host a different stable public URL or provide inline image bytes.";
+    case "image_too_large":
+      return "The image exceeds the Commons image size limit.";
+    case "image_redirect_limit":
+      return "The image source exceeded the Commons redirect limit.";
+    case "image_base64_invalid":
+      return "The supplied inline image bytes are invalid.";
+    case "image_source_missing":
+      return "Provide either a stable public image URL or inline image bytes.";
+    case "image_format_unsupported":
+      return "Commons accepts JPEG, PNG, GIF, or WebP image bytes.";
+    case "image_storage_unconfigured":
+      return "Commons image storage is temporarily unavailable.";
+    case "featured_image_unhostable":
+      return "The required featured image could not be hosted for Commons publication.";
     default:
       return PUBLIC_SERVICE_UNAVAILABLE_MESSAGE;
   }
@@ -299,7 +339,20 @@ var init_errors = __esm({
       "site_export_not_found",
       "site_export_format_unavailable",
       "site_export_read_failed",
-      "site_export_image_not_found"
+      "site_export_image_not_found",
+      "image_url_invalid",
+      "image_url_not_https",
+      "image_host_unresolvable",
+      "image_host_blocked",
+      "image_redirect_invalid",
+      "image_source_unavailable",
+      "image_too_large",
+      "image_redirect_limit",
+      "image_base64_invalid",
+      "image_source_missing",
+      "image_format_unsupported",
+      "image_storage_unconfigured",
+      "featured_image_unhostable"
     ];
     PUBLIC_ERROR_TYPES = [
       "request_aborted",
@@ -4495,6 +4548,20 @@ async function migrate(options = {}) {
       PRIMARY KEY (user_id, connection_id, period_start)
     )
   `);
+  await db.execute(`
+    CREATE TABLE IF NOT EXISTS connected_account_charge_transfers (
+      id                 INTEGER PRIMARY KEY AUTOINCREMENT,
+      user_id            INTEGER NOT NULL,
+      period_start       TEXT NOT NULL,
+      from_connection_id TEXT NOT NULL,
+      to_connection_id   TEXT NOT NULL,
+      provider_config_key TEXT NOT NULL,
+      transferred_at     TEXT NOT NULL DEFAULT (datetime('now')),
+      UNIQUE (user_id, period_start, from_connection_id),
+      CHECK (from_connection_id <> to_connection_id)
+    )
+  `);
+  await db.execute(`CREATE INDEX IF NOT EXISTS connected_account_charge_transfers_destination ON connected_account_charge_transfers(user_id, period_start, to_connection_id, transferred_at DESC)`);
   await db.execute(`
     CREATE TABLE IF NOT EXISTS billing_credits (
       idempotency_key TEXT PRIMARY KEY,
@@ -36288,6 +36355,357 @@ var init_subscription_status_policy = __esm({
   }
 });
 
+// src/api/service-connections.ts
+function ensureServiceConnectionsSchema() {
+  const currentDb = getDb();
+  if (schemaReady && schemaDb5 === currentDb) return schemaReady;
+  schemaDb5 = currentDb;
+  schemaReady = (async () => {
+    const db = currentDb;
+    await db.execute(`
+      CREATE TABLE IF NOT EXISTS service_connections (
+        id                         TEXT PRIMARY KEY,
+        user_id                    INTEGER NOT NULL REFERENCES users(id),
+        provider_config_key        TEXT NOT NULL,
+        provider                   TEXT,
+        transport                  TEXT NOT NULL,
+        upstream_connection_id     TEXT,
+        label                      TEXT,
+        user_label                 TEXT,
+        provider_account_id        TEXT,
+        provider_account_email     TEXT,
+        provider_account_name      TEXT,
+        provider_identity_checked_at TEXT,
+        provider_identity_source_updated_at TEXT,
+        lifecycle_status           TEXT NOT NULL DEFAULT 'pending',
+        operational_status         TEXT NOT NULL DEFAULT 'unknown',
+        reconnect_required         INTEGER NOT NULL DEFAULT 0,
+        actions_enabled            INTEGER NOT NULL DEFAULT 0,
+        read_tools_json            TEXT NOT NULL DEFAULT '[]',
+        action_tools_json          TEXT NOT NULL DEFAULT '[]',
+        tool_revision              TEXT,
+        last_checked_at            TEXT,
+        last_successful_call_at    TEXT,
+        last_failure_at            TEXT,
+        last_failure_code          TEXT,
+        last_failure_retryable     INTEGER,
+        consecutive_failures       INTEGER NOT NULL DEFAULT 0,
+        vault_name                 TEXT,
+        table_name                 TEXT,
+        legacy_owner_identity      TEXT,
+        created_at                 TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at                 TEXT NOT NULL DEFAULT (datetime('now')),
+        UNIQUE(user_id, provider_config_key, upstream_connection_id)
+      )
+    `);
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN user_label TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_id TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_email TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_name TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_checked_at TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_source_updated_at TEXT`);
+    } catch {
+    }
+    await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_user_updated ON service_connections(user_id, updated_at DESC)`);
+    await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_upstream ON service_connections(provider_config_key, upstream_connection_id)`);
+    await db.execute(`
+      CREATE TABLE IF NOT EXISTS service_connection_health_events (
+        id                    TEXT PRIMARY KEY,
+        connection_id         TEXT NOT NULL REFERENCES service_connections(id) ON DELETE CASCADE,
+        operational_status    TEXT NOT NULL,
+        failure_code          TEXT,
+        retryable             INTEGER,
+        evidence_source       TEXT NOT NULL,
+        created_at            TEXT NOT NULL DEFAULT (datetime('now'))
+      )
+    `);
+    await db.execute(`CREATE INDEX IF NOT EXISTS service_connection_health_events_connection ON service_connection_health_events(connection_id, created_at DESC)`);
+    await db.execute(`
+      CREATE TABLE IF NOT EXISTS service_connection_action_audit (
+        id                    TEXT PRIMARY KEY,
+        connection_id         TEXT NOT NULL REFERENCES service_connections(id) ON DELETE CASCADE,
+        user_id               INTEGER NOT NULL REFERENCES users(id),
+        tool                  TEXT NOT NULL,
+        request_id            TEXT NOT NULL,
+        status                TEXT NOT NULL,
+        error_code            TEXT,
+        created_at            TEXT NOT NULL DEFAULT (datetime('now')),
+        UNIQUE(user_id, request_id)
+      )
+    `);
+    try {
+      await db.execute(`ALTER TABLE service_connection_action_audit ADD COLUMN request_digest TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connection_action_audit ADD COLUMN result_json TEXT`);
+    } catch {
+    }
+  })().catch((error) => {
+    schemaReady = null;
+    schemaDb5 = null;
+    throw error;
+  });
+  return schemaReady;
+}
+function parseTools(value) {
+  if (typeof value !== "string") return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function rowToRecord(row) {
+  return {
+    id: String(row.id),
+    userId: Number(row.user_id),
+    providerConfigKey: String(row.provider_config_key),
+    provider: typeof row.provider === "string" ? row.provider : null,
+    transport: row.transport === "remote_mcp" ? "remote_mcp" : "nango",
+    upstreamConnectionId: typeof row.upstream_connection_id === "string" ? row.upstream_connection_id : null,
+    label: typeof row.label === "string" ? row.label : null,
+    userLabel: typeof row.user_label === "string" ? row.user_label : null,
+    providerAccountId: typeof row.provider_account_id === "string" ? row.provider_account_id : null,
+    providerAccountEmail: typeof row.provider_account_email === "string" ? row.provider_account_email : null,
+    providerAccountName: typeof row.provider_account_name === "string" ? row.provider_account_name : null,
+    providerIdentityCheckedAt: typeof row.provider_identity_checked_at === "string" ? row.provider_identity_checked_at : null,
+    providerIdentitySourceUpdatedAt: typeof row.provider_identity_source_updated_at === "string" ? row.provider_identity_source_updated_at : null,
+    lifecycleStatus: String(row.lifecycle_status),
+    operationalStatus: String(row.operational_status),
+    reconnectRequired: Number(row.reconnect_required) === 1,
+    actionsEnabled: Number(row.actions_enabled) === 1,
+    readTools: parseTools(row.read_tools_json),
+    actionTools: parseTools(row.action_tools_json),
+    toolRevision: typeof row.tool_revision === "string" ? row.tool_revision : null,
+    lastCheckedAt: typeof row.last_checked_at === "string" ? row.last_checked_at : null,
+    lastSuccessfulCallAt: typeof row.last_successful_call_at === "string" ? row.last_successful_call_at : null,
+    lastFailureAt: typeof row.last_failure_at === "string" ? row.last_failure_at : null,
+    lastFailureCode: typeof row.last_failure_code === "string" ? row.last_failure_code : null,
+    lastFailureRetryable: row.last_failure_retryable === null || row.last_failure_retryable === void 0 ? null : Number(row.last_failure_retryable) === 1,
+    consecutiveFailures: Number(row.consecutive_failures ?? 0),
+    vaultName: typeof row.vault_name === "string" ? row.vault_name : null,
+    tableName: typeof row.table_name === "string" ? row.table_name : null,
+    createdAt: String(row.created_at),
+    updatedAt: String(row.updated_at)
+  };
+}
+async function userIdForIdentity(identity) {
+  const user = await getUserByEmail(identity.normalize("NFKC").trim().toLowerCase());
+  if (!user) throw new Error("service_connection_user_not_found");
+  return Number(user.id);
+}
+async function reconcileDiscoveredNangoConnections(identity, discovered) {
+  await ensureServiceConnectionsSchema();
+  const db = getDb();
+  const userId = await userIdForIdentity(identity);
+  for (const connection of discovered) {
+    await db.execute({
+      sql: `
+        INSERT INTO service_connections (
+          id, user_id, provider_config_key, provider, transport, upstream_connection_id,
+          label, lifecycle_status, reconnect_required, actions_enabled, legacy_owner_identity, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, 'nango', ?, ?, ?, ?, 1, ?, COALESCE(?, datetime('now')), COALESCE(?, datetime('now')))
+        ON CONFLICT(user_id, provider_config_key, upstream_connection_id) DO UPDATE SET
+          provider = excluded.provider,
+          label = COALESCE(excluded.label, service_connections.label),
+          lifecycle_status = excluded.lifecycle_status,
+          reconnect_required = excluded.reconnect_required,
+          updated_at = excluded.updated_at
+      `,
+      args: [
+        (0, import_node_crypto21.randomUUID)(),
+        userId,
+        connection.providerConfigKey,
+        connection.provider,
+        connection.upstreamConnectionId,
+        connection.label,
+        connection.lifecycleStatus,
+        connection.reconnectRequired ? 1 : 0,
+        identity,
+        connection.createdAt,
+        connection.updatedAt
+      ]
+    });
+  }
+  return listServiceConnections(identity, "nango");
+}
+async function listServiceConnections(identity, transport) {
+  await ensureServiceConnectionsSchema();
+  const userId = await userIdForIdentity(identity);
+  const result = await getDb().execute({
+    sql: `SELECT * FROM service_connections WHERE user_id = ?${transport ? " AND transport = ?" : ""} AND lifecycle_status <> 'disconnected' ORDER BY updated_at DESC`,
+    args: transport ? [userId, transport] : [userId]
+  });
+  return result.rows.map((row) => rowToRecord(row));
+}
+async function getOwnedServiceConnection(identity, connectionId) {
+  await ensureServiceConnectionsSchema();
+  const userId = await userIdForIdentity(identity);
+  const result = await getDb().execute({
+    sql: "SELECT * FROM service_connections WHERE id = ? AND user_id = ? LIMIT 1",
+    args: [connectionId, userId]
+  });
+  const row = result.rows[0];
+  return row ? rowToRecord(row) : null;
+}
+async function updateServiceConnectionTools(connectionId, readTools, actionTools, toolRevision) {
+  await ensureServiceConnectionsSchema();
+  await getDb().execute({
+    sql: `UPDATE service_connections SET read_tools_json = ?, action_tools_json = ?, tool_revision = ?, updated_at = datetime('now') WHERE id = ?`,
+    args: [JSON.stringify(readTools), JSON.stringify(actionTools), toolRevision, connectionId]
+  });
+}
+async function setServiceConnectionProviderIdentity(args) {
+  await ensureServiceConnectionsSchema();
+  await getDb().execute({
+    sql: `
+      UPDATE service_connections SET
+        provider_account_id = ?, provider_account_email = ?, provider_account_name = ?,
+        provider_identity_checked_at = datetime('now'), provider_identity_source_updated_at = ?,
+        updated_at = datetime('now')
+      WHERE id = ?
+    `,
+    args: [
+      args.providerAccountId ?? null,
+      args.providerAccountEmail?.toLowerCase() ?? null,
+      args.providerAccountName ?? null,
+      args.sourceUpdatedAt,
+      args.connectionId
+    ]
+  });
+}
+async function setServiceConnectionUserLabel(identity, connectionId, userLabel) {
+  const connection = await getOwnedServiceConnection(identity, connectionId);
+  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connections SET user_label = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
+    args: [userLabel, connectionId, connection.userId]
+  });
+  return userLabel;
+}
+async function recordServiceConnectionHealth(args) {
+  await ensureServiceConnectionsSchema();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  await getDb().execute({
+    sql: `
+      UPDATE service_connections SET
+        operational_status = ?, last_checked_at = ?,
+        last_successful_call_at = CASE WHEN ? = 'available' THEN ? ELSE last_successful_call_at END,
+        last_failure_at = CASE WHEN ? IN ('degraded', 'unavailable') THEN ? ELSE NULL END,
+        last_failure_code = ?, last_failure_retryable = ?,
+        consecutive_failures = CASE WHEN ? = 'available' THEN 0 ELSE consecutive_failures + 1 END,
+        updated_at = datetime('now')
+      WHERE id = ?
+    `,
+    args: [
+      args.operationalStatus,
+      now,
+      args.operationalStatus,
+      now,
+      args.operationalStatus,
+      now,
+      args.failureCode ?? null,
+      args.retryable == null ? null : args.retryable ? 1 : 0,
+      args.operationalStatus,
+      args.connectionId
+    ]
+  });
+  await getDb().execute({
+    sql: `INSERT INTO service_connection_health_events (id, connection_id, operational_status, failure_code, retryable, evidence_source) VALUES (?, ?, ?, ?, ?, ?)`,
+    args: [(0, import_node_crypto21.randomUUID)(), args.connectionId, args.operationalStatus, args.failureCode ?? null, args.retryable == null ? null : args.retryable ? 1 : 0, args.evidenceSource]
+  });
+}
+async function setServiceConnectionActions(identity, connectionId, enabled) {
+  const connection = await getOwnedServiceConnection(identity, connectionId);
+  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connections SET actions_enabled = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
+    args: [enabled ? 1 : 0, connectionId, connection.userId]
+  });
+  return enabled;
+}
+async function markServiceConnectionDisconnected(identity, connectionId) {
+  const connection = await getOwnedServiceConnection(identity, connectionId);
+  if (!connection) throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connections SET lifecycle_status = 'disconnected', operational_status = 'unknown', reconnect_required = 0, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
+    args: [connectionId, connection.userId]
+  });
+  const remaining = await getDb().execute({
+    sql: `SELECT COUNT(*) AS count FROM service_connections WHERE user_id = ? AND transport = 'nango' AND lifecycle_status = 'connected'`,
+    args: [connection.userId]
+  });
+  return Number(remaining.rows[0]?.count ?? 0);
+}
+async function recordServiceConnectionAction(args) {
+  await ensureServiceConnectionsSchema();
+  const connection = await getOwnedServiceConnection(args.identity, args.connectionId);
+  if (!connection) throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connection_action_audit SET status = ?, error_code = ?, result_json = ? WHERE user_id = ? AND request_id = ? AND connection_id = ?`,
+    args: [args.status, args.errorCode ?? null, args.result === void 0 ? null : JSON.stringify(args.result), connection.userId, args.requestId, connection.id]
+  });
+}
+async function claimServiceConnectionAction(args) {
+  await ensureServiceConnectionsSchema();
+  const connection = await getOwnedServiceConnection(args.identity, args.connectionId);
+  if (!connection) throw new Error("service_connection_not_found");
+  const inserted = await getDb().execute({
+    sql: `INSERT OR IGNORE INTO service_connection_action_audit (id, connection_id, user_id, tool, request_id, status, request_digest) VALUES (?, ?, ?, ?, ?, 'started', ?)`,
+    args: [(0, import_node_crypto21.randomUUID)(), connection.id, connection.userId, args.tool, args.requestId, args.requestDigest]
+  });
+  if (Number(inserted.rowsAffected ?? 0) === 1) return { claimed: true };
+  const existing = await getDb().execute({
+    sql: `SELECT connection_id, tool, status, error_code, request_digest, result_json FROM service_connection_action_audit WHERE user_id = ? AND request_id = ? LIMIT 1`,
+    args: [connection.userId, args.requestId]
+  });
+  const row = existing.rows[0];
+  const conflict = String(row?.connection_id ?? "") !== connection.id || String(row?.tool ?? "") !== args.tool || String(row?.request_digest ?? "") !== args.requestDigest;
+  let result = void 0;
+  if (!conflict && typeof row?.result_json === "string") {
+    try {
+      result = JSON.parse(row.result_json);
+    } catch {
+      result = void 0;
+    }
+  }
+  return {
+    claimed: false,
+    status: String(row?.status ?? "unknown"),
+    errorCode: typeof row?.error_code === "string" ? row.error_code : null,
+    conflict,
+    ...result !== void 0 ? { result } : {}
+  };
+}
+var import_node_crypto21, schemaReady, schemaDb5;
+var init_service_connections = __esm({
+  "src/api/service-connections.ts"() {
+    "use strict";
+    import_node_crypto21 = require("crypto");
+    init_db();
+    schemaReady = null;
+    schemaDb5 = null;
+  }
+});
+
 // src/api/connected-account-billing.ts
 function connectedBillingPeriodStart(now = /* @__PURE__ */ new Date()) {
   return `${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
@@ -36302,6 +36720,87 @@ async function chargedConnectionIds(userId, periodStart) {
   });
   return new Set(result.rows.map((row) => String(row.connection_id)));
 }
+async function inheritDisconnectedConnectionCharge(userId, connectionId, periodStart) {
+  await ensureServiceConnectionsSchema();
+  const normalizedUserId = Number(userId);
+  const db = getDb();
+  await db.batch([
+    {
+      sql: `
+        INSERT OR IGNORE INTO connected_account_charge_transfers (
+          user_id, period_start, from_connection_id, to_connection_id, provider_config_key
+        )
+        SELECT ?, ?, previous.id, replacement.id, replacement.provider_config_key
+        FROM service_connections AS replacement
+        JOIN service_connections AS previous
+          ON previous.user_id = replacement.user_id
+         AND previous.transport = 'nango'
+         AND previous.provider_config_key = replacement.provider_config_key
+         AND previous.lifecycle_status = 'disconnected'
+        JOIN connected_account_charges AS charge
+          ON charge.user_id = previous.user_id
+         AND charge.connection_id = previous.id
+         AND charge.period_start = ?
+        WHERE replacement.id = ?
+          AND replacement.user_id = ?
+          AND replacement.transport = 'nango'
+          AND replacement.lifecycle_status IN ('connected', 'needs_reauth')
+          AND NOT EXISTS (
+            SELECT 1 FROM connected_account_charges AS existing
+            WHERE existing.user_id = replacement.user_id
+              AND existing.connection_id = replacement.id
+              AND existing.period_start = ?
+          )
+        ORDER BY previous.updated_at DESC, previous.id ASC
+        LIMIT 1
+      `,
+      args: [normalizedUserId, periodStart, periodStart, connectionId, normalizedUserId, periodStart]
+    },
+    {
+      sql: `
+        UPDATE connected_account_charges
+        SET connection_id = ?
+        WHERE user_id = ?
+          AND period_start = ?
+          AND connection_id = (
+            SELECT transfer.from_connection_id
+            FROM connected_account_charge_transfers AS transfer
+            JOIN connected_account_charges AS current_charge
+              ON current_charge.user_id = transfer.user_id
+             AND current_charge.period_start = transfer.period_start
+             AND current_charge.connection_id = transfer.from_connection_id
+            WHERE transfer.user_id = ?
+              AND transfer.period_start = ?
+              AND transfer.to_connection_id = ?
+            ORDER BY transfer.transferred_at DESC, transfer.id DESC
+            LIMIT 1
+          )
+          AND NOT EXISTS (
+            SELECT 1 FROM connected_account_charges AS existing
+            WHERE existing.user_id = ?
+              AND existing.connection_id = ?
+              AND existing.period_start = ?
+          )
+      `,
+      args: [
+        connectionId,
+        normalizedUserId,
+        periodStart,
+        normalizedUserId,
+        periodStart,
+        connectionId,
+        normalizedUserId,
+        connectionId,
+        periodStart
+      ]
+    }
+  ], "write");
+  const inherited = await db.execute({
+    sql: "SELECT 1 FROM connected_account_charges WHERE user_id = ? AND connection_id = ? AND period_start = ? LIMIT 1",
+    args: [normalizedUserId, connectionId, periodStart]
+  });
+  return inherited.rows.length > 0;
+}
 async function getConnectedAccountBillingState2(userId) {
   const result = await getDb().execute({
     sql: "SELECT * FROM connected_account_billing WHERE user_id = ? LIMIT 1",
@@ -36430,6 +36929,7 @@ async function reconcileConnectedAccountBilling(user, connections) {
     const alreadyCharged = await chargedConnectionIds(user.id, periodStart);
     const unpaid = billableConnectionIds.filter((id) => !alreadyCharged.has(id));
     for (const connectionId of unpaid) {
+      if (await inheritDisconnectedConnectionCharge(user.id, connectionId, periodStart)) continue;
       const feeMc = CONNECTED_ACTIVE_CONNECTION_MONTHLY_MC;
       const debit = await debitMcIdempotent(
         user.id,
@@ -36491,6 +36991,7 @@ var init_connected_account_billing = __esm({
     init_db();
     init_rates();
     init_connected_cost_telemetry();
+    init_service_connections();
     DEFAULT_CONNECTED_ACCOUNT_PRICE_ID = "price_1TtYPAS8aAcsk3TGHOgrDZiQ";
     BILLABLE_LIFECYCLE = /* @__PURE__ */ new Set(["connected", "needs_reauth"]);
     ConnectedAccountBillingError = class extends Error {
@@ -40059,7 +40560,7 @@ async function applyAdjustment(input) {
   const credits = validateCredits(input.credits, input.confirmLarge === true);
   const reason = validateReason(input.reason);
   const actor = validateActor(input.actor);
-  const reference = input.reference?.trim() || `adj_${(0, import_node_crypto21.randomUUID)()}`;
+  const reference = input.reference?.trim() || `adj_${(0, import_node_crypto22.randomUUID)()}`;
   if (reference.length > 120) throw new AdminCreditError(400, "reference must be at most 120 characters");
   const db = getDb();
   const existing = await db.execute({
@@ -40204,11 +40705,11 @@ async function lookupAccount(target, limit = 20) {
     }))
   };
 }
-var import_node_crypto21, MIN_ADJUSTMENT_CREDITS, LARGE_ADJUSTMENT_CREDITS, MAX_ADJUSTMENT_CREDITS, MIN_REASON_LENGTH, MAX_REASON_LENGTH, MAX_ACTOR_LENGTH, AdminCreditError;
+var import_node_crypto22, MIN_ADJUSTMENT_CREDITS, LARGE_ADJUSTMENT_CREDITS, MAX_ADJUSTMENT_CREDITS, MIN_REASON_LENGTH, MAX_REASON_LENGTH, MAX_ACTOR_LENGTH, AdminCreditError;
 var init_admin_credits = __esm({
   "src/api/admin-credits.ts"() {
     "use strict";
-    import_node_crypto21 = require("crypto");
+    import_node_crypto22 = require("crypto");
     init_db();
     init_rates();
     MIN_ADJUSTMENT_CREDITS = 1;
@@ -42173,7 +42674,7 @@ async function packageMapsMedia(args) {
   files.push({ path: "summary.json", content: Buffer.from(JSON.stringify(summary, null, 2)) });
   files.push({ path: "images.jsonl", content: Buffer.from(cleanImages.map((image) => JSON.stringify(image)).join("\n") + "\n") });
   const archive = await zipBuffer(files);
-  const id = (0, import_node_crypto22.randomBytes)(6).toString("hex");
+  const id = (0, import_node_crypto23.randomBytes)(6).toString("hex");
   const pointer = await createPrivateArtifact({
     policy: policy3(),
     ownerId: args.ownerId,
@@ -42186,13 +42687,13 @@ async function packageMapsMedia(args) {
   const localPath = token() ? null : (0, import_node_path13.join)(process.env.MCP_SCRAPER_OUTPUT_DIR?.trim() || (0, import_node_path13.join)((0, import_node_os9.homedir)(), "Downloads", "mcp-scraper"), "blobs", pointer.artifactId);
   return { media: args.media, artifact: { ...pointer, localPath } };
 }
-var import_node_os9, import_node_path13, import_node_crypto22, import_yazl2, import_p_limit5, MAPS_MEDIA_ARTIFACT_PREFIX, MAPS_MEDIA_ARTIFACT_TTL_MS, MAPS_MEDIA_DOWNLOAD_TTL_MS, MAX_IMAGE_BYTES2, MAX_ARCHIVE_IMAGE_BYTES, MAX_INLINE_IMAGE_BYTES, MAX_INLINE_TOTAL_BYTES, DOWNLOAD_CONCURRENCY, MAX_REDIRECTS;
+var import_node_os9, import_node_path13, import_node_crypto23, import_yazl2, import_p_limit5, MAPS_MEDIA_ARTIFACT_PREFIX, MAPS_MEDIA_ARTIFACT_TTL_MS, MAPS_MEDIA_DOWNLOAD_TTL_MS, MAX_IMAGE_BYTES2, MAX_ARCHIVE_IMAGE_BYTES, MAX_INLINE_IMAGE_BYTES, MAX_INLINE_TOTAL_BYTES, DOWNLOAD_CONCURRENCY, MAX_REDIRECTS;
 var init_maps_media_artifacts = __esm({
   "src/api/maps-media-artifacts.ts"() {
     "use strict";
     import_node_os9 = require("os");
     import_node_path13 = require("path");
-    import_node_crypto22 = require("crypto");
+    import_node_crypto23 = require("crypto");
     import_yazl2 = require("yazl");
     import_p_limit5 = __toESM(require("p-limit"), 1);
     init_private_artifacts();
@@ -42816,7 +43317,7 @@ function retryDelaySeconds(attempts) {
 }
 async function dispatchPendingDirectoryWorkflows(limit = 25) {
   const rows = await claimDirectoryWorkflowOutbox({
-    workerId: `directory-dispatch-${process.pid}-${(0, import_node_crypto23.randomUUID)().slice(0, 8)}`,
+    workerId: `directory-dispatch-${process.pid}-${(0, import_node_crypto24.randomUUID)().slice(0, 8)}`,
     limit
   });
   const result = { claimed: rows.length, dispatched: 0, failed: 0 };
@@ -42838,11 +43339,11 @@ async function dispatchPendingDirectoryWorkflows(limit = 25) {
   }
   return result;
 }
-var import_node_crypto23;
+var import_node_crypto24;
 var init_directory_workflow_dispatch = __esm({
   "src/api/directory-workflow-dispatch.ts"() {
     "use strict";
-    import_node_crypto23 = require("crypto");
+    import_node_crypto24 = require("crypto");
     init_client();
     init_directory_workflow_repository();
   }
@@ -42854,7 +43355,7 @@ function safeOptions(options) {
   return safe2;
 }
 function requestFingerprint(options) {
-  return (0, import_node_crypto24.createHash)("sha256").update(JSON.stringify(safeOptions(options))).digest("hex");
+  return (0, import_node_crypto25.createHash)("sha256").update(JSON.stringify(safeOptions(options))).digest("hex");
 }
 function idempotencyKey(raw) {
   if (raw !== void 0) {
@@ -42863,14 +43364,14 @@ function idempotencyKey(raw) {
     if (trimmed.length > 500) return { ok: false, message: "Idempotency-Key must be 500 characters or fewer." };
     return { ok: true, key: trimmed };
   }
-  return { ok: true, key: `directory-${(0, import_node_crypto24.randomUUID)()}` };
+  return { ok: true, key: `directory-${(0, import_node_crypto25.randomUUID)()}` };
 }
 function debitKeyFor(userId, responseKey) {
-  const digest2 = (0, import_node_crypto24.createHash)("sha256").update(String(userId)).update("\0").update(responseKey).digest("hex");
+  const digest2 = (0, import_node_crypto25.createHash)("sha256").update(String(userId)).update("\0").update(responseKey).digest("hex");
   return `directory-workflow:${userId}:${digest2}`;
 }
 function jobId() {
-  return `dir_${(0, import_node_crypto24.randomUUID)().replace(/-/g, "")}`;
+  return `dir_${(0, import_node_crypto25.randomUUID)().replace(/-/g, "")}`;
 }
 function publicStatus(job, result) {
   if (job.status === "failed") return "failed";
@@ -42979,7 +43480,7 @@ async function runSynchronously(c, user, options, plan, responseKey) {
         const csv = renderDirectoryWorkflowCsv(result);
         const artifact = await createDirectoryCsvArtifact({
           ownerId: String(user.id),
-          jobId: (0, import_node_crypto24.createHash)("sha256").update(debitKey2).digest("hex").slice(0, 32),
+          jobId: (0, import_node_crypto25.createHash)("sha256").update(debitKey2).digest("hex").slice(0, 32),
           createdAt: result.extractedAt,
           filename: `${options.state}-${options.query}-directory.csv`,
           csv,
@@ -43035,11 +43536,11 @@ async function runSynchronously(c, user, options, plan, responseKey) {
     await releaseConcurrencyGate(gate.lockId);
   }
 }
-var import_node_crypto24, import_hono16, directoryApp;
+var import_node_crypto25, import_hono16, directoryApp;
 var init_directory_routes = __esm({
   "src/api/directory-routes.ts"() {
     "use strict";
-    import_node_crypto24 = require("crypto");
+    import_node_crypto25 = require("crypto");
     import_hono16 = require("hono");
     init_api_auth();
     init_db();
@@ -43257,15 +43758,15 @@ function bounded(value, field, min, max) {
   return normalized;
 }
 function newLeadListUploadId() {
-  return `upl_${(0, import_node_crypto25.randomUUID)().replace(/-/g, "")}`;
+  return `upl_${(0, import_node_crypto26.randomUUID)().replace(/-/g, "")}`;
 }
 function newImportedLeadListId() {
-  return `lst_${(0, import_node_crypto25.randomUUID)().replace(/-/g, "")}`;
+  return `lst_${(0, import_node_crypto26.randomUUID)().replace(/-/g, "")}`;
 }
 async function ensureLeadListImportRepositorySchema() {
   const db = getDb();
-  if (schemaDb5 !== db) {
-    schemaDb5 = db;
+  if (schemaDb6 !== db) {
+    schemaDb6 = db;
     schemaPromise5 = null;
   }
   if (!schemaPromise5) {
@@ -43460,13 +43961,13 @@ async function deleteExpiredLeadListInputRecords(now = /* @__PURE__ */ new Date(
   ], "write");
   return { uploads: Number(uploads.rowsAffected ?? 0), lists: Number(lists.rowsAffected ?? 0) };
 }
-var import_node_crypto25, schemaDb5, schemaPromise5;
+var import_node_crypto26, schemaDb6, schemaPromise5;
 var init_lead_list_import_repository = __esm({
   "src/api/lead-list-import-repository.ts"() {
     "use strict";
-    import_node_crypto25 = require("crypto");
+    import_node_crypto26 = require("crypto");
     init_db();
-    schemaDb5 = null;
+    schemaDb6 = null;
     schemaPromise5 = null;
   }
 });
@@ -43506,7 +44007,7 @@ function safeFilenameHint(value) {
   return cleaned || null;
 }
 function requestFingerprint2(filenameHint) {
-  return (0, import_node_crypto26.createHash)("sha256").update(JSON.stringify({ filenameHint })).digest("hex");
+  return (0, import_node_crypto27.createHash)("sha256").update(JSON.stringify({ filenameHint })).digest("hex");
 }
 function publicBaseUrl() {
   const configured = process.env.MCP_SCRAPER_PUBLIC_BASE_URL?.trim() || process.env.PUBLIC_BASE_URL?.trim() || (process.env.VERCEL_PROJECT_PRODUCTION_URL ? `https://${process.env.VERCEL_PROJECT_PRODUCTION_URL}` : "") || "https://mcpscraper.dev";
@@ -43662,7 +44163,7 @@ async function inspectLeadListUpload(uploadId, ownerId2) {
     maxBytes: LEAD_LIST_UPLOAD_MAX_BYTES
   });
   if (!buffer) return null;
-  const sha2565 = (0, import_node_crypto26.createHash)("sha256").update(buffer).digest("hex");
+  const sha2565 = (0, import_node_crypto27.createHash)("sha256").update(buffer).digest("hex");
   const completed = await completeLeadListUpload({
     id: record.id,
     ownerId: record.ownerId,
@@ -43786,11 +44287,11 @@ async function cleanupExpiredLeadListInputs(args = {}) {
   const records = await deleteExpiredLeadListInputRecords(now);
   return { deletedBlobs, deletedUploadRecords: records.uploads, deletedListRecords: records.lists };
 }
-var import_node_crypto26, import_promises11, import_node_os10, import_node_path14, LEAD_LIST_UPLOAD_PREFIX, LEAD_LIST_NORMALIZED_PREFIX, LEAD_LIST_UPLOAD_MAX_BYTES, LEAD_LIST_UPLOAD_URL_TTL_MS, LEAD_LIST_UPLOAD_SOURCE_TTL_MS, LEAD_LIST_NORMALIZED_TTL_MS, LEAD_LIST_DOWNLOAD_TTL_MS, LEAD_LIST_UPLOAD_MIME_TYPES;
+var import_node_crypto27, import_promises11, import_node_os10, import_node_path14, LEAD_LIST_UPLOAD_PREFIX, LEAD_LIST_NORMALIZED_PREFIX, LEAD_LIST_UPLOAD_MAX_BYTES, LEAD_LIST_UPLOAD_URL_TTL_MS, LEAD_LIST_UPLOAD_SOURCE_TTL_MS, LEAD_LIST_NORMALIZED_TTL_MS, LEAD_LIST_DOWNLOAD_TTL_MS, LEAD_LIST_UPLOAD_MIME_TYPES;
 var init_lead_list_input_artifacts = __esm({
   "src/api/lead-list-input-artifacts.ts"() {
     "use strict";
-    import_node_crypto26 = require("crypto");
+    import_node_crypto27 = require("crypto");
     import_promises11 = require("fs/promises");
     import_node_os10 = require("os");
     import_node_path14 = require("path");
@@ -44173,7 +44674,7 @@ function canonicalize(value) {
   return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalize(object[key])}`).join(",")}}`;
 }
 function fingerprint(value) {
-  return (0, import_node_crypto27.createHash)("sha256").update(canonicalize(value)).digest("hex");
+  return (0, import_node_crypto28.createHash)("sha256").update(canonicalize(value)).digest("hex");
 }
 async function safeJson(c) {
   try {
@@ -44250,11 +44751,11 @@ function textDelimiter(raw, text2, observedMime) {
   if (observedMime === "text/tab-separated-values") return "	";
   return detectLeadListTextDelimiter(text2);
 }
-var import_node_crypto27, import_hono17, leadListInputApp;
+var import_node_crypto28, import_hono17, leadListInputApp;
 var init_lead_list_input_routes = __esm({
   "src/api/lead-list-input-routes.ts"() {
     "use strict";
-    import_node_crypto27 = require("crypto");
+    import_node_crypto28 = require("crypto");
     import_hono17 = require("hono");
     init_api_auth();
     init_lead_list_input_artifacts();
@@ -44446,7 +44947,7 @@ function retryDelaySeconds2(attempts) {
   return Math.min(3600, Math.max(15, 15 * 2 ** Math.min(8, Math.max(0, attempts - 1))));
 }
 async function dispatchPendingLeadListEnrichments(limit = 25) {
-  const rows = await claimLeadListEnrichmentOutbox({ workerId: `lead-list-dispatch-${process.pid}-${(0, import_node_crypto28.randomUUID)().slice(0, 8)}`, limit });
+  const rows = await claimLeadListEnrichmentOutbox({ workerId: `lead-list-dispatch-${process.pid}-${(0, import_node_crypto29.randomUUID)().slice(0, 8)}`, limit });
   const result = { claimed: rows.length, dispatched: 0, failed: 0 };
   for (const row of rows) {
     if (!row.claimToken) continue;
@@ -44465,11 +44966,11 @@ async function dispatchPendingLeadListEnrichments(limit = 25) {
   }
   return result;
 }
-var import_node_crypto28;
+var import_node_crypto29;
 var init_lead_list_enrichment_dispatch = __esm({
   "src/api/lead-list-enrichment-dispatch.ts"() {
     "use strict";
-    import_node_crypto28 = require("crypto");
+    import_node_crypto29 = require("crypto");
     init_client();
     init_lead_list_enrichment_repository();
   }
@@ -44485,15 +44986,15 @@ function idempotencyKey2(raw) {
   return { ok: true, value };
 }
 function newJobId() {
-  return `lle_${(0, import_node_crypto29.randomUUID)().replace(/-/g, "")}`;
+  return `lle_${(0, import_node_crypto30.randomUUID)().replace(/-/g, "")}`;
 }
 function debitKeyFor2(userId, key) {
-  const digest2 = (0, import_node_crypto29.createHash)("sha256").update(String(userId)).update("\0").update(key).digest("hex");
+  const digest2 = (0, import_node_crypto30.createHash)("sha256").update(String(userId)).update("\0").update(key).digest("hex");
   return `lead-list-enrichment:${userId}:${digest2}`;
 }
 function inlineSourceDigest(headers, rows) {
   const values = rows.map((row) => headers.map((header) => row[header] ?? null));
-  return (0, import_node_crypto29.createHash)("sha256").update(stableCanonicalJson({ headers, values })).digest("hex");
+  return (0, import_node_crypto30.createHash)("sha256").update(stableCanonicalJson({ headers, values })).digest("hex");
 }
 function issueMessage(error) {
   const issue = error.issues[0];
@@ -44691,11 +45192,11 @@ async function resolveInput(ownerId2, parsed) {
     sourceDigest: sourceDigest ?? inlineSourceDigest(normalized.headers, rows)
   };
 }
-var import_node_crypto29, import_hono18, import_zod31, SourceSchema, StartSchema, TERMINAL, leadListEnrichmentApp;
+var import_node_crypto30, import_hono18, import_zod31, SourceSchema, StartSchema, TERMINAL, leadListEnrichmentApp;
 var init_lead_list_enrichment_routes = __esm({
   "src/api/lead-list-enrichment-routes.ts"() {
     "use strict";
-    import_node_crypto29 = require("crypto");
+    import_node_crypto30 = require("crypto");
     import_hono18 = require("hono");
     import_zod31 = require("zod");
     init_api_auth();
@@ -48162,7 +48663,7 @@ async function readManifestFromSummary(summary) {
 function webhookSignature(body, timestamp2) {
   const secret2 = process.env.MCP_SCRAPER_WEBHOOK_SECRET?.trim();
   if (!secret2) return null;
-  return (0, import_node_crypto30.createHmac)("sha256", secret2).update(`${timestamp2}.${body}`).digest("hex");
+  return (0, import_node_crypto31.createHmac)("sha256", secret2).update(`${timestamp2}.${body}`).digest("hex");
 }
 async function deliverWorkflowWebhook(input) {
   if (!input.webhookUrl) return;
@@ -48369,11 +48870,11 @@ async function dispatchDueWorkflowSchedules(apiUrl, limit = 3) {
   }
   return { dispatched: results.length, results };
 }
-var import_node_crypto30, import_promises14, import_hono21, import_zod41, workflowApp, WorkflowInputSchema, WorkflowIdSchema, CadenceSchema, ScheduleStatusSchema, RunBodySchema, ScheduleCreateSchema, SchedulePatchSchema, TERMINAL_RUN_STATUSES;
+var import_node_crypto31, import_promises14, import_hono21, import_zod41, workflowApp, WorkflowInputSchema, WorkflowIdSchema, CadenceSchema, ScheduleStatusSchema, RunBodySchema, ScheduleCreateSchema, SchedulePatchSchema, TERMINAL_RUN_STATUSES;
 var init_workflow_routes = __esm({
   "src/api/workflow-routes.ts"() {
     "use strict";
-    import_node_crypto30 = require("crypto");
+    import_node_crypto31 = require("crypto");
     import_promises14 = require("fs/promises");
     import_hono21 = require("hono");
     import_zod41 = require("zod");
@@ -48654,7 +49155,7 @@ var init_workflow_routes = __esm({
 // src/serp-intelligence/page-snapshot-extractor.ts
 function sha2562(value) {
   if (!value) return null;
-  return (0, import_node_crypto31.createHash)("sha256").update(value).digest("hex");
+  return (0, import_node_crypto32.createHash)("sha256").update(value).digest("hex");
 }
 function countWords(markdown) {
   const matches = markdown.trim().match(/\b[\p{L}\p{N}][\p{L}\p{N}'-]*\b/gu);
@@ -48954,11 +49455,11 @@ async function capturePageSnapshots(targets, options = {}) {
     }
   };
 }
-var import_node_crypto31, import_p_limit6, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_CONCURRENCY, DEFAULT_MAX_CONTENT_CHARS;
+var import_node_crypto32, import_p_limit6, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_CONCURRENCY, DEFAULT_MAX_CONTENT_CHARS;
 var init_page_snapshot_extractor = __esm({
   "src/serp-intelligence/page-snapshot-extractor.ts"() {
     "use strict";
-    import_node_crypto31 = require("crypto");
+    import_node_crypto32 = require("crypto");
     import_p_limit6 = __toESM(require("p-limit"), 1);
     init_kpo_extractor();
     init_url_utils();
@@ -49455,21 +49956,21 @@ async function logRequestEventBestEffort(input) {
   }
 }
 function captureBillingKeys(userId, suppliedKey, body) {
-  const responseKey = suppliedKey?.trim() || (0, import_node_crypto32.randomUUID)();
-  const requestFingerprint3 = (0, import_node_crypto32.createHash)("sha256").update(JSON.stringify(body)).digest("hex");
-  const keyDigest = (0, import_node_crypto32.createHash)("sha256").update(String(userId)).update("\0").update(responseKey).digest("hex");
+  const responseKey = suppliedKey?.trim() || (0, import_node_crypto33.randomUUID)();
+  const requestFingerprint3 = (0, import_node_crypto33.createHash)("sha256").update(JSON.stringify(body)).digest("hex");
+  const keyDigest = (0, import_node_crypto33.createHash)("sha256").update(String(userId)).update("\0").update(responseKey).digest("hex");
   return {
     responseKey,
     debitKey: `serp-capture:${userId}:${keyDigest}`,
     debitDescription: `${body.query} [request:${requestFingerprint3}]`
   };
 }
-var import_hono22, import_node_crypto32, SERP_INTELLIGENCE_RATE_LIMIT, SERP_INTELLIGENCE_RATE_WINDOW_SECONDS, POST_CAPTURE_ROUTE_LABEL, POST_PAGE_SNAPSHOTS_ROUTE_LABEL, SERP_CAPTURE_BILLING_SOURCE, serpIntelligenceApp;
+var import_hono22, import_node_crypto33, SERP_INTELLIGENCE_RATE_LIMIT, SERP_INTELLIGENCE_RATE_WINDOW_SECONDS, POST_CAPTURE_ROUTE_LABEL, POST_PAGE_SNAPSHOTS_ROUTE_LABEL, SERP_CAPTURE_BILLING_SOURCE, serpIntelligenceApp;
 var init_serp_intelligence_routes = __esm({
   "src/api/serp-intelligence-routes.ts"() {
     "use strict";
     import_hono22 = require("hono");
-    import_node_crypto32 = require("crypto");
+    import_node_crypto33 = require("crypto");
     init_browser_service_env();
     init_page_snapshot_extractor();
     init_serp_capture_service();
@@ -49706,7 +50207,7 @@ var PACKAGE_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    PACKAGE_VERSION = "0.66.5";
+    PACKAGE_VERSION = "0.66.7";
   }
 });
 
@@ -49775,11 +50276,20 @@ seam is noted so you can chain them.
 - Plan a new or edited entity -> **commons_prepare_entity**. This is the Commons equivalent of
   prepare-memory-write: it returns the live entity profile contract, duplicate candidates, tag reuse/review/create
   guidance, recommended sections, optional sections, and heading guidance before any write occurs.
-- Validate a composed entity without writing -> **commons_validate_entity**. Use it after composing and before submit
-  to catch missing featured images, missing source/body evidence, duplicate candidates, and
-  unsupported placeholder sections.
+- Host a featured image -> **commons_host_image**. The normal write sequence is **commons_prepare_entity ->
+  compose the payload -> commons_host_image -> commons_validate_entity -> commons_submit_entity**. Put the
+  permanent returned URL in featuredImage.url. Use imageBase64 for available attachment bytes within the request
+  bound, or a stable direct public HTTPS image URL; never use a caller-local path, opaque chat attachment reference,
+  HTML page, private URL, or temporary/signed URL.
+- Validate a composed entity without writing -> **commons_validate_entity**. Use it after image hosting and before
+  submit. Validation does not fetch or store image bytes; an external/unregistered featured image is reported in
+  imageDiagnostics as not publishable until commons_host_image returns its permanent Commons URL. Validation also
+  catches missing source/body evidence, duplicate candidates, and unsupported placeholder sections.
 - Create or edit a public wiki entity -> **commons_submit_entity**. This is a governed proposal write,
-  not direct rendered HTML editing. Normal workflow is prepare -> validate -> submit. Pick the closest entity type
+  not direct rendered HTML editing. Submit retains defensive auto-hosting for a stable direct public HTTPS image,
+  but image ingress failure returns an actionable tool error: host different bytes or a different stable source,
+  replace featuredImage.url, validate again, and retry the same intended write with the same idempotency key.
+  Pick the closest entity type
   first: SoftwareApplication, Organization, Person, Event, Place, Taxon, ScienceConcept, MathConcept, TechArticle,
   Trail, or PublicArticle.
   Creating a new entity costs 10 Credits; editing an existing entity costs 2 Credits. Preparation, validation,
@@ -51521,7 +52031,7 @@ var init_contracts = __esm({
 });
 
 // src/mcp/mcp-tool-schemas.ts
-var import_zod45, WEBSITE_URL_OR_DOMAIN_ERROR, WebsiteUrlOrDomainSchema, HarvestPaaInputSchema, HarvestPaaHostedInputSchema, ExtractUrlBaseInputSchema, ExtractUrlInputSchema, ExtractUrlLocalInputSchema, DiffPageBaseInputSchema, DiffPageInputSchema, DiffPageLocalInputSchema, MapSiteUrlsInputSchema, MapWaybackSnapshotsInputSchema, ExtractSiteInputSchema, AnalyzeSiteSimilarityInputSchema, AuditSiteInputSchema, CheckSiteExportInputSchema, SiteExportReadInputSchema, SiteExportImageInputSchema, ArchiveReadInputSchema, YoutubeHarvestInputSchema, YoutubeTranscribeInputSchema, FacebookPageIntelInputSchema, FacebookAdSearchInputSchema, RedditThreadInputSchema, RedditTrendingInputSchema, VideoFrameAnalysisInputSchema, VideoFrameAnalysisStatusInputSchema, FacebookAdTranscribeInputSchema, FacebookVideoTranscribeInputSchema, GoogleAdsSearchInputSchema, GoogleAdsPageIntelInputSchema, GoogleAdsTranscribeInputSchema, InstagramProfileContentInputSchema, InstagramMediaDownloadInputSchema, MapsPlaceIntelInputSchema, TrustpilotReviewsInputSchema, G2ReviewsInputSchema, ReviewCardSchema, MapsSearchInputSchema, DirectoryWorkflowInputSchema, LeadScalarSchema2, LeadRowSchema, LeadColumnMapSchema2, LeadRowsImportSourceSchema, LeadCsvTextImportSourceSchema, LeadUploadImportSourceSchema, LeadListUploadStartInputSchema, LeadListImportInputSchema, LeadRowsEnrichmentSourceSchema, ImportedLeadListSourceSchema, LeadListEnrichInputSchema, LeadListEnrichStatusInputSchema, LocationMarketsInputSchema, CommonsSearchEntitiesInputSchema, CommonsGetEntityInputSchema, CommonsGetEntityLinksetInputSchema, CommonsFeaturedImageInputSchema, CommonsMediaInputSchema, CommonsCitationInputSchema, CommonsSourceInputSchema, CommonsRelatedLinkInputSchema, CommonsClaimInputSchema, CommonsPrepareEntityInputSchema, CommonsSubmitEntityInputSchema, CommonsValidateEntityInputSchema, CommonsGetEntityLedgerInputSchema, CommonsHostImageInputSchema, CommonsGetProposalInputSchema, CommonsSaveFilterInputSchema, CommonsListFiltersInputSchema, CommonsListNeedsLinksInputSchema, CommonsGenericOutputSchema, DirectoryWorkflowStatusInputSchema, LocalSourcebookSubmitInputSchema, LocalSourcebookCategorySchema, LocalSourcebookSchemaTypeInputSchema, LocalSourcebookTagCandidateObjectSchema, LocalSourcebookTagDecisionObjectSchema, LocalSourcebookIdentityObjectSchema, GetLocalSourcebookContractInputSchema, ListLocalSourcebookTagsInputSchema, ResolveLocalSourcebookTagsInputSchema, PrepareLocalSourcebookWriteInputSchema, ValidateLocalSourcebookWriteInputSchema, LocalSourcebookCaptureInputSchema, LocalSourcebookSubmissionStatusInputSchema, LocalSourcebookRefreshInputSchema, LocalSourcebookOutputSchema, ArtifactPointerOutputSchema, EditorialReadingRoomSiteSchema, EditorialReadingRoomImageSchema, EditorialReadingRoomArticleSchema, EditorialReadingRoomGuideInputSchema, EditorialReadingRoomGuideOutputSchema, CreateEditorialReadingRoomInputSchema, EditorialReadingRoomArtifactSchema, CreateEditorialReadingRoomOutputSchema, RenewEditorialReadingRoomDownloadInputSchema, RenewEditorialReadingRoomDownloadOutputSchema, CommonsPublicationSubdomainSchema, CommonsPreparePublicationInputSchema, CommonsValidatePublicationInputSchema, CommonsClaimPublicationInputSchema, CommonsPublishEditorialInputSchema, CommonsUpdateEditorialArticleInputSchema, CommonsGetPublicationInputSchema, RankTrackerModeSchema, RankTrackerBlueprintInputSchema, NullableString, MapsSearchAttemptOutput, MapsSearchOutputSchema, DirectoryMapsBusinessOutput, DirectoryCsvArtifactOutput, DirectoryWorkflowOutputSchema, LeadSuggestedColumnOutputSchema, LeadColumnMapSuggestionOutputSchema, LeadArtifactOutputSchema, LeadListUploadStartOutputSchema, LeadListImportOutputSchema, LeadCandidateOutputSchema, LeadProgressOutputSchema, LeadBillingOutputSchema, LeadAssociatedPersonSourceOutputSchema, LeadAssociatedPersonOutputSchema, LeadSampleRowOutputSchema, LeadListEnrichmentOutputSchema, LocationDatasetProvenanceOutput, LocationMarketsOutputSchema, RankTrackerToolPlanOutput, RankTrackerTableOutput, RankTrackerCronJobOutput, RankTrackerBlueprintOutputSchema, OrganicResultOutput, AiOverviewOutput, EntityIdsOutput, HarvestPaaOutputSchema, SearchSerpOutputSchema, PageMediaAssetOutput, PageMediaArtifactOutput, ExtractUrlOutputSchema, DiffPageOutputSchema, ExtractSiteOutputSchema, AuditSiteOutputSchema, CheckSiteExportOutputSchema, SiteExportReadOutputSchema, SiteExportImageOutputSchema, ArchiveEntryOutputSchema, ArchiveReadOutputSchema, MapsPlaceIntelOutputSchema, TrustpilotReviewsOutputSchema, G2ReviewsOutputSchema, CreditsInfoOutputSchema, MapSiteUrlsOutputSchema, WaybackCaptureOutputSchema, MapWaybackSnapshotsOutputSchema, YoutubeHarvestOutputSchema, FacebookAdSearchOutputSchema, VideoFrameAnalysisOutputSchema, VideoFrameAnalysisStatusOutputSchema, RedditThreadOutputSchema, RedditTrendingOutputSchema, FacebookPageIntelOutputSchema, GoogleAdsSearchOutputSchema, GoogleAdsPageIntelOutputSchema, TranscriptSignalOutput, FacebookVideoTranscribeOutputSchema, TranscriptChunkOutput, InstagramBrowserOutput, InstagramPaginationOutput, InstagramProfileContentOutputSchema, InstagramMediaTrackOutput, InstagramDownloadOutput, InstagramMediaDownloadOutputSchema, YoutubeTranscribeOutputSchema, FacebookAdTranscribeOutputSchema, GoogleAdsTranscribeOutputSchema, CaptureSerpSnapshotOutputSchema, CaptureSerpPageSnapshotsOutputSchema, CreditsInfoInputSchema, WorkflowIdSchema2, WorkflowListInputSchema, WorkflowSuggestInputSchema, WorkflowRunInputSchema, WorkflowStepInputSchema, WorkflowStatusInputSchema, WorkflowArtifactReadInputSchema, WorkflowRecipeOutput, WorkflowDefinitionOutput, WorkflowArtifactOutput, WorkflowListOutputSchema, WorkflowSuggestOutputSchema, WorkflowRunOutputSchema, WorkflowStepOutputSchema, WorkflowStatusOutputSchema, WorkflowArtifactReadOutputSchema, SearchSerpInputSchema, CaptureSerpSnapshotInputSchema, ScreenshotInputSchema, CaptureSerpPageSnapshotsInputSchema, ReportArtifactReadInputSchema, ReportArtifactReadOutputSchema, ListServiceConnectionsInputSchema, ListServiceConnectionsOutputSchema, TestServiceConnectionInputSchema, TestServiceConnectionOutputSchema, ReadServiceConnectionInputSchema, ReadServiceConnectionOutputSchema, MetaAdCreativeMediaInputSchema, MetaAdCreativeMediaOutputSchema, ImportServiceConnectionToMemoryInputSchema, ImportServiceConnectionToMemoryOutputSchema, DescribeServiceConnectionToolInputSchema, DescribeServiceConnectionToolOutputSchema, ConnectedDataContinuationSchema, ExportConnectedServiceDataInputSchema, ConnectedDataArtifactSchema, ExportConnectedServiceDataOutputSchema, SearchConsoleTableColumnSchema, SearchConsoleTableFilterSchema, ExportSearchConsoleTableDataInputSchema, ExportSearchConsoleTableDataOutputSchema, RenewConnectedDataExportDownloadInputSchema, RenewConnectedDataExportDownloadOutputSchema, CallServiceConnectionActionInputSchema, CallServiceConnectionActionOutputSchema, SetScheduledActionConnectionsInputSchema, SetScheduledActionConnectionsOutputSchema, SlackSendMessageInputSchema, SlackSendMessageOutputSchema, GmailSendMessageInputSchema, GmailSendMessageOutputSchema, GmailSearchContactsInputSchema, GmailSearchContactsOutputSchema, GoogleCalendarCreateEventInputSchema, GoogleCalendarCreateEventOutputSchema, ZoomCreateMeetingInputSchema, ZoomCreateMeetingOutputSchema;
+var import_zod45, WEBSITE_URL_OR_DOMAIN_ERROR, WebsiteUrlOrDomainSchema, HarvestPaaInputSchema, HarvestPaaHostedInputSchema, ExtractUrlBaseInputSchema, ExtractUrlInputSchema, ExtractUrlLocalInputSchema, DiffPageBaseInputSchema, DiffPageInputSchema, DiffPageLocalInputSchema, MapSiteUrlsInputSchema, MapWaybackSnapshotsInputSchema, ExtractSiteInputSchema, AnalyzeSiteSimilarityInputSchema, AuditSiteInputSchema, CheckSiteExportInputSchema, SiteExportReadInputSchema, SiteExportImageInputSchema, ArchiveReadInputSchema, YoutubeHarvestInputSchema, YoutubeTranscribeInputSchema, FacebookPageIntelInputSchema, FacebookAdSearchInputSchema, RedditThreadInputSchema, RedditTrendingInputSchema, VideoFrameAnalysisInputSchema, VideoFrameAnalysisStatusInputSchema, FacebookAdTranscribeInputSchema, FacebookVideoTranscribeInputSchema, GoogleAdsSearchInputSchema, GoogleAdsPageIntelInputSchema, GoogleAdsTranscribeInputSchema, InstagramProfileContentInputSchema, InstagramMediaDownloadInputSchema, MapsPlaceIntelInputSchema, TrustpilotReviewsInputSchema, G2ReviewsInputSchema, ReviewCardSchema, MapsSearchInputSchema, DirectoryWorkflowInputSchema, LeadScalarSchema2, LeadRowSchema, LeadColumnMapSchema2, LeadRowsImportSourceSchema, LeadCsvTextImportSourceSchema, LeadUploadImportSourceSchema, LeadListUploadStartInputSchema, LeadListImportInputSchema, LeadRowsEnrichmentSourceSchema, ImportedLeadListSourceSchema, LeadListEnrichInputSchema, LeadListEnrichStatusInputSchema, LocationMarketsInputSchema, CommonsSearchEntitiesInputSchema, CommonsGetEntityInputSchema, CommonsGetEntityLinksetInputSchema, CommonsFeaturedImageInputSchema, CommonsMediaInputSchema, CommonsCitationInputSchema, CommonsSourceInputSchema, CommonsRelatedLinkInputSchema, CommonsClaimInputSchema, CommonsPrepareEntityInputSchema, CommonsSubmitEntityInputSchema, CommonsValidateEntityInputSchema, CommonsGetEntityLedgerInputSchema, CommonsHostImageInputSchema, CommonsGetProposalInputSchema, CommonsSaveFilterInputSchema, CommonsListFiltersInputSchema, CommonsListNeedsLinksInputSchema, CommonsGenericOutputSchema, CommonsFeaturedImageDiagnosticsOutputSchema, CommonsValidateEntityOutputSchema, DirectoryWorkflowStatusInputSchema, LocalSourcebookSubmitInputSchema, LocalSourcebookCategorySchema, LocalSourcebookSchemaTypeInputSchema, LocalSourcebookTagCandidateObjectSchema, LocalSourcebookTagDecisionObjectSchema, LocalSourcebookIdentityObjectSchema, GetLocalSourcebookContractInputSchema, ListLocalSourcebookTagsInputSchema, ResolveLocalSourcebookTagsInputSchema, PrepareLocalSourcebookWriteInputSchema, ValidateLocalSourcebookWriteInputSchema, LocalSourcebookCaptureInputSchema, LocalSourcebookSubmissionStatusInputSchema, LocalSourcebookRefreshInputSchema, LocalSourcebookOutputSchema, ArtifactPointerOutputSchema, EditorialReadingRoomSiteSchema, EditorialReadingRoomImageSchema, EditorialReadingRoomArticleSchema, EditorialReadingRoomGuideInputSchema, EditorialReadingRoomGuideOutputSchema, CreateEditorialReadingRoomInputSchema, EditorialReadingRoomArtifactSchema, CreateEditorialReadingRoomOutputSchema, RenewEditorialReadingRoomDownloadInputSchema, RenewEditorialReadingRoomDownloadOutputSchema, CommonsPublicationSubdomainSchema, CommonsPreparePublicationInputSchema, CommonsValidatePublicationInputSchema, CommonsClaimPublicationInputSchema, CommonsPublishEditorialInputSchema, CommonsUpdateEditorialArticleInputSchema, CommonsGetPublicationInputSchema, RankTrackerModeSchema, RankTrackerBlueprintInputSchema, NullableString, MapsSearchAttemptOutput, MapsSearchOutputSchema, DirectoryMapsBusinessOutput, DirectoryCsvArtifactOutput, DirectoryWorkflowOutputSchema, LeadSuggestedColumnOutputSchema, LeadColumnMapSuggestionOutputSchema, LeadArtifactOutputSchema, LeadListUploadStartOutputSchema, LeadListImportOutputSchema, LeadCandidateOutputSchema, LeadProgressOutputSchema, LeadBillingOutputSchema, LeadAssociatedPersonSourceOutputSchema, LeadAssociatedPersonOutputSchema, LeadSampleRowOutputSchema, LeadListEnrichmentOutputSchema, LocationDatasetProvenanceOutput, LocationMarketsOutputSchema, RankTrackerToolPlanOutput, RankTrackerTableOutput, RankTrackerCronJobOutput, RankTrackerBlueprintOutputSchema, OrganicResultOutput, AiOverviewOutput, EntityIdsOutput, HarvestPaaOutputSchema, SearchSerpOutputSchema, PageMediaAssetOutput, PageMediaArtifactOutput, ExtractUrlOutputSchema, DiffPageOutputSchema, ExtractSiteOutputSchema, AuditSiteOutputSchema, CheckSiteExportOutputSchema, SiteExportReadOutputSchema, SiteExportImageOutputSchema, ArchiveEntryOutputSchema, ArchiveReadOutputSchema, MapsPlaceIntelOutputSchema, TrustpilotReviewsOutputSchema, G2ReviewsOutputSchema, CreditsInfoOutputSchema, MapSiteUrlsOutputSchema, WaybackCaptureOutputSchema, MapWaybackSnapshotsOutputSchema, YoutubeHarvestOutputSchema, FacebookAdSearchOutputSchema, VideoFrameAnalysisOutputSchema, VideoFrameAnalysisStatusOutputSchema, RedditThreadOutputSchema, RedditTrendingOutputSchema, FacebookPageIntelOutputSchema, GoogleAdsSearchOutputSchema, GoogleAdsPageIntelOutputSchema, TranscriptSignalOutput, FacebookVideoTranscribeOutputSchema, TranscriptChunkOutput, InstagramBrowserOutput, InstagramPaginationOutput, InstagramProfileContentOutputSchema, InstagramMediaTrackOutput, InstagramDownloadOutput, InstagramMediaDownloadOutputSchema, YoutubeTranscribeOutputSchema, FacebookAdTranscribeOutputSchema, GoogleAdsTranscribeOutputSchema, CaptureSerpSnapshotOutputSchema, CaptureSerpPageSnapshotsOutputSchema, CreditsInfoInputSchema, WorkflowIdSchema2, WorkflowListInputSchema, WorkflowSuggestInputSchema, WorkflowRunInputSchema, WorkflowStepInputSchema, WorkflowStatusInputSchema, WorkflowArtifactReadInputSchema, WorkflowRecipeOutput, WorkflowDefinitionOutput, WorkflowArtifactOutput, WorkflowListOutputSchema, WorkflowSuggestOutputSchema, WorkflowRunOutputSchema, WorkflowStepOutputSchema, WorkflowStatusOutputSchema, WorkflowArtifactReadOutputSchema, SearchSerpInputSchema, CaptureSerpSnapshotInputSchema, ScreenshotInputSchema, CaptureSerpPageSnapshotsInputSchema, ReportArtifactReadInputSchema, ReportArtifactReadOutputSchema, ListServiceConnectionsInputSchema, ListServiceConnectionsOutputSchema, TestServiceConnectionInputSchema, TestServiceConnectionOutputSchema, ReadServiceConnectionInputSchema, ReadServiceConnectionOutputSchema, MetaAdCreativeMediaInputSchema, MetaAdCreativeMediaOutputSchema, ImportServiceConnectionToMemoryInputSchema, ImportServiceConnectionToMemoryOutputSchema, DescribeServiceConnectionToolInputSchema, DescribeServiceConnectionToolOutputSchema, ConnectedDataContinuationSchema, ExportConnectedServiceDataInputSchema, ConnectedDataArtifactSchema, ExportConnectedServiceDataOutputSchema, SearchConsoleTableColumnSchema, SearchConsoleTableFilterSchema, ExportSearchConsoleTableDataInputSchema, ExportSearchConsoleTableDataOutputSchema, RenewConnectedDataExportDownloadInputSchema, RenewConnectedDataExportDownloadOutputSchema, CallServiceConnectionActionInputSchema, CallServiceConnectionActionOutputSchema, SetScheduledActionConnectionsInputSchema, SetScheduledActionConnectionsOutputSchema, SlackSendMessageInputSchema, SlackSendMessageOutputSchema, GmailSendMessageInputSchema, GmailSendMessageOutputSchema, GmailSearchContactsInputSchema, GmailSearchContactsOutputSchema, GoogleCalendarCreateEventInputSchema, GoogleCalendarCreateEventOutputSchema, ZoomCreateMeetingInputSchema, ZoomCreateMeetingOutputSchema;
 var init_mcp_tool_schemas = __esm({
   "src/mcp/mcp-tool-schemas.ts"() {
     "use strict";
@@ -51934,7 +52444,7 @@ var init_mcp_tool_schemas = __esm({
       idOrSlug: import_zod45.z.string().trim().min(1).max(180).describe("Transparent Commons TPW-Q entity id or /wiki/ slug whose governed RFC 9264 linkset should be read.")
     };
     CommonsFeaturedImageInputSchema = import_zod45.z.object({
-      url: import_zod45.z.string().url().describe("Required public image URL for a publishable entity. Use extract_url includeFeaturedImage or preserved media when available."),
+      url: import_zod45.z.string().url().describe("For a publish-ready entity, use the permanent URL returned by commons_host_image. Submit can auto-host a stable direct public HTTPS image URL as a compatibility fallback, but validation reports any unregistered external URL as not ready. Do not use a chat attachment reference, caller-local path, temporary or signed URL, private URL, or HTML page URL."),
       alt: import_zod45.z.string().trim().max(500).optional(),
       caption: import_zod45.z.string().trim().max(1e3).optional(),
       sourceUrl: import_zod45.z.string().url().optional(),
@@ -52026,14 +52536,14 @@ var init_mcp_tool_schemas = __esm({
       maxCandidates: import_zod45.z.number().int().min(1).max(20).default(8).describe("Maximum duplicate candidates to return.")
     };
     CommonsSubmitEntityInputSchema = {
-      idempotencyKey: import_zod45.z.string().trim().min(8).max(200).describe("Required unique opaque ID for this intended Commons write. Reuse only when retrying the same write after a timeout; use a new value for each intentional create or edit."),
+      idempotencyKey: import_zod45.z.string().trim().min(8).max(200).describe("Required unique opaque ID for this intended Commons write. Reuse it when retrying the same intended write after a timeout or after correcting a pre-persistence image-ingress failure; use a new value for each intentional create or edit."),
       title: import_zod45.z.string().trim().min(3).max(180).describe("Public page title. This is also used for duplicate slug/entity checks when slug is omitted."),
       description: import_zod45.z.string().trim().min(8).max(600).describe("Short article summary and schema.org description."),
       slug: import_zod45.z.string().trim().max(180).optional().describe("Optional URL slug. Omit to derive one from title."),
       entityId: import_zod45.z.string().trim().max(80).optional().describe("Existing Transparent Public Wiki entity id when proposing an edit. New entities normally omit this and receive a TPW-Q id."),
       entityType: import_zod45.z.string().trim().max(120).default("PublicArticle").describe("Backend Wikidata-style type. Prefer precise entity classes such as SoftwareApplication, Organization, Person, Event, Place, Taxon, ScienceConcept, MathConcept, TechArticle, or PublicArticle; the public article structure should match the selected type."),
       disambiguationName: import_zod45.z.string().trim().max(240).optional().describe("Clarifying name used when the concept could be confused with another entity."),
-      featuredImage: CommonsFeaturedImageInputSchema.optional().describe("Required for auto-published public entities. The image is also added to the media manifest if absent."),
+      featuredImage: CommonsFeaturedImageInputSchema.optional().describe("Required for auto-published public entities. First call commons_host_image and place its returned permanent URL here; validation does not fetch external images and reports unregistered URLs as not publishable. Submit retains a compatibility fallback that auto-hosts a stable direct public HTTPS image URL. The image is also added to the media manifest if absent."),
       source: CommonsSourceInputSchema.optional().describe("Source provenance. Store original URL, source byline, and origin canonical here; canonical does not replace rights review."),
       tags: import_zod45.z.array(import_zod45.z.string().trim().min(1).max(80)).max(24).optional().describe("Standardized topic tags. Use existing/searchable concepts when possible."),
       keywords: import_zod45.z.array(import_zod45.z.string().trim().min(1).max(120)).max(50).optional().describe("SEO and retrieval keywords."),
@@ -52095,8 +52605,8 @@ var init_mcp_tool_schemas = __esm({
       idOrSlug: import_zod45.z.string().trim().min(1).max(180).describe("Published entity id or /wiki/ slug whose contribution ledger should be read.")
     };
     CommonsHostImageInputSchema = {
-      sourceUrl: import_zod45.z.string().url().optional().describe("Public https image URL to download and host. The wiki never serves a third-party URL directly, so pass the original source here rather than putting it on the entity."),
-      imageBase64: import_zod45.z.string().min(16).optional().describe("Base64 image bytes for an image you already hold. Use for images under about 3 MB; larger files should be published from a URL."),
+      sourceUrl: import_zod45.z.string().url().optional().describe("Stable direct public HTTPS URL whose response is the image bytes to host. Do not pass an HTML webpage, chat attachment reference, caller-local path, temporary or signed URL, or private/authenticated URL."),
+      imageBase64: import_zod45.z.string().min(16).optional().describe("Base64 image bytes for an image you already hold, including forwarded chat attachment bytes. Prefer this over a temporary attachment URL when the serialized request remains under about 3 MB; larger files require a stable direct public HTTPS source URL."),
       alt: import_zod45.z.string().trim().max(500).optional().describe("Alt text describing the image for readers who cannot see it."),
       license: import_zod45.z.string().trim().max(240).optional().describe("License or usage terms of the original image, preserved with the hosted copy."),
       attribution: import_zod45.z.string().trim().max(500).optional().describe("Credit line for the original photographer, publication, or archive.")
@@ -52128,6 +52638,30 @@ var init_mcp_tool_schemas = __esm({
       error: import_zod45.z.string().optional(),
       message: import_zod45.z.string().optional()
     };
+    CommonsFeaturedImageDiagnosticsOutputSchema = import_zod45.z.object({
+      state: import_zod45.z.enum(["missing", "external_unhosted", "commons_hosted"]).describe("Storage-readiness state for the candidate featured image."),
+      url: import_zod45.z.string().url().nullable().describe("Normalized candidate featured-image URL, or null when none was supplied."),
+      commonsImageId: import_zod45.z.string().nullable().describe("Registered Commons image ID when metadata proves the image is hosted, otherwise null."),
+      readyForPublish: import_zod45.z.boolean().describe("Whether Commons storage metadata proves this featured image is ready to publish."),
+      submitWillAttemptAutoHost: import_zod45.z.boolean().describe("Whether submit will use its compatibility fallback to try hosting this external image."),
+      requiredAction: import_zod45.z.string().nullable().describe("Action the caller must take before submit, or null when the image is ready.")
+    }).describe("Featured-image storage readiness determined without fetching or storing external bytes.");
+    CommonsValidateEntityOutputSchema = {
+      ok: import_zod45.z.boolean(),
+      data: import_zod45.z.object({
+        ok: import_zod45.z.literal(true),
+        valid: import_zod45.z.boolean(),
+        publishable: import_zod45.z.boolean(),
+        autoPublishEligible: import_zod45.z.boolean(),
+        errors: import_zod45.z.array(import_zod45.z.string()),
+        warnings: import_zod45.z.array(import_zod45.z.string()),
+        imageDiagnostics: import_zod45.z.object({
+          featuredImage: CommonsFeaturedImageDiagnosticsOutputSchema
+        }).describe("Read-only image readiness and recovery guidance for this payload.")
+      }).passthrough().optional(),
+      error: import_zod45.z.string().optional(),
+      message: import_zod45.z.string().optional()
+    };
     DirectoryWorkflowStatusInputSchema = {
       jobId: import_zod45.z.string().trim().min(1).describe("The jobId returned by directory_workflow. Poll until status is complete, partial, empty, or failed.")
     };
@@ -54839,11 +55373,11 @@ function requireTasksCapability(capabilityValue) {
   );
 }
 function taskKey(secret2) {
-  return (0, import_node_crypto33.createHash)("sha256").update("mcp-scraper-task-handle\0", "utf8").update(secret2, "utf8").digest();
+  return (0, import_node_crypto34.createHash)("sha256").update("mcp-scraper-task-handle\0", "utf8").update(secret2, "utf8").digest();
 }
 function encodeTaskHandle(payload, secret2) {
-  const nonce = (0, import_node_crypto33.randomBytes)(12);
-  const cipher = (0, import_node_crypto33.createCipheriv)("aes-256-gcm", taskKey(secret2), nonce);
+  const nonce = (0, import_node_crypto34.randomBytes)(12);
+  const cipher = (0, import_node_crypto34.createCipheriv)("aes-256-gcm", taskKey(secret2), nonce);
   const ciphertext = Buffer.concat([
     cipher.update(JSON.stringify(payload), "utf8"),
     cipher.final()
@@ -54860,7 +55394,7 @@ function decodeTaskHandle(taskId, secret2, ownerId2) {
     const nonce = bytes.subarray(0, 12);
     const tag = bytes.subarray(bytes.length - 16);
     const ciphertext = bytes.subarray(12, bytes.length - 16);
-    const decipher = (0, import_node_crypto33.createDecipheriv)("aes-256-gcm", taskKey(secret2), nonce);
+    const decipher = (0, import_node_crypto34.createDecipheriv)("aes-256-gcm", taskKey(secret2), nonce);
     decipher.setAuthTag(tag);
     const parsed = JSON.parse(Buffer.concat([
       decipher.update(ciphertext),
@@ -55224,12 +55758,12 @@ async function handleMcpTasksHttpRequest(request, executor, options) {
     return taskHttpError(id, error instanceof import_server.ProtocolError ? error : new import_server.ProtocolError(-32603, error instanceof Error ? error.message : "Internal error"));
   }
 }
-var import_server, import_node_crypto33, import_zod46, MCP_TASKS_EXTENSION_ID, TASK_HANDLE_VERSION, TASK_TTL_MS, TASK_POLL_INTERVAL_MS, TASK_INVALID_PARAMS, TASK_MISSING_CAPABILITY, TASK_START_TOOL_NAMES;
+var import_server, import_node_crypto34, import_zod46, MCP_TASKS_EXTENSION_ID, TASK_HANDLE_VERSION, TASK_TTL_MS, TASK_POLL_INTERVAL_MS, TASK_INVALID_PARAMS, TASK_MISSING_CAPABILITY, TASK_START_TOOL_NAMES;
 var init_mcp_tasks_extension = __esm({
   "src/mcp/mcp-tasks-extension.ts"() {
     "use strict";
     import_server = require("@modelcontextprotocol/server");
-    import_node_crypto33 = require("crypto");
+    import_node_crypto34 = require("crypto");
     import_zod46 = require("zod");
     init_mcp_tool_schemas();
     MCP_TASKS_EXTENSION_ID = "io.modelcontextprotocol/tasks";
@@ -55537,7 +56071,7 @@ var init_analytics_mcp_tools = __esm({
 
 // src/mcp/paa-mcp-server.ts
 function hashOwnerId(callerKey) {
-  return (0, import_node_crypto34.createHash)("sha256").update(callerKey).digest("hex").slice(0, 24);
+  return (0, import_node_crypto35.createHash)("sha256").update(callerKey).digest("hex").slice(0, 24);
 }
 function liveWebToolAnnotations(title) {
   return {
@@ -56024,9 +56558,9 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => executor.commonsPrepareEntity(input));
   server.registerTool("commons_validate_entity", {
     title: "Transparent Commons Validate Entity",
-    description: "Validate a proposed Transparent Commons entity payload without writing. Checks publishable basics, featured image, source/body evidence, existing-entity conflict state, heading profile alignment, and unsupported placeholder sections. Call this after composing the page and before commons_submit_entity.",
+    description: "Read-only validation for a proposed Transparent Commons entity payload. Call it after commons_prepare_entity, composing the page, and commons_host_image. It does not fetch or store image bytes: an external or otherwise unregistered featured image remains not publishable until commons_host_image returns the permanent Commons URL. Inspect imageDiagnostics for readiness and the required action before commons_submit_entity. Also checks source/body evidence, existing-entity conflict state, heading profile alignment, and unsupported placeholder sections.",
     inputSchema: CommonsValidateEntityInputSchema,
-    outputSchema: recordOutputSchema("commons_validate_entity", CommonsGenericOutputSchema),
+    outputSchema: recordOutputSchema("commons_validate_entity", CommonsValidateEntityOutputSchema),
     annotations: {
       title: "Transparent Commons Validate Entity",
       readOnlyHint: true,
@@ -56037,7 +56571,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => executor.commonsValidateEntity(input));
   server.registerTool("commons_submit_entity", {
     title: "Transparent Commons Governed Entity Write",
-    description: "Create or propose an edit to a Transparent Commons public wiki entity through the governed MCP Scraper write plane. A new entity costs 10 Credits; an edit to an existing entity costs 2 Credits. Preparation and validation are free, and idempotent retries are not charged twice. This never edits rendered HTML directly. Normal workflow is commons_prepare_entity, compose, commons_validate_entity, then submit. commons_prepare_entity returns the entity profile contract and section guidance to compose against. Transparent Commons is an open wiki: any account may edit any entity, and every edit publishes and is recorded on the public contribution ledger. Publishing requires a featured image and body/source evidence. Pass baseRevision when editing so the ledger can show whether the edit was written on top of a newer revision. Requires idempotencyKey.",
+    description: "Charged governed write that creates or proposes an edit to a Transparent Commons public wiki entity. A new entity costs 10 Credits; an edit costs 2 Credits. Preparation, image hosting, and validation are free, and idempotent retries are not charged twice. Normal workflow is commons_prepare_entity, compose the page, commons_host_image, commons_validate_entity, then submit with the returned permanent featuredImage.url. Submit retains a compatibility fallback that auto-hosts a stable direct public HTTPS image URL; if image ingress fails, it returns an actionable image tool error so you can host different bytes or a different stable source, replace the URL, validate again, and retry the same intended write with the same idempotencyKey. This never edits rendered HTML directly. Transparent Commons is an open wiki: any account may edit any entity, and every applied edit is recorded on the public contribution ledger. Publishing requires a ready featured image and body/source evidence. Pass baseRevision when editing so the ledger can show whether the edit was written on top of a newer revision. Requires idempotencyKey.",
     inputSchema: CommonsSubmitEntityInputSchema,
     outputSchema: recordOutputSchema("commons_submit_entity", CommonsGenericOutputSchema),
     annotations: {
@@ -56063,7 +56597,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => executor.commonsGetEntityLedger(input));
   server.registerTool("commons_host_image", {
     title: "Host a Transparent Commons Image",
-    description: "Host an image from a public https URL or base64 bytes, returning a permanent Commons URL. Commons never serves a third-party image URL \u2014 commons_submit_entity hosts external images automatically, so use this only to host one before or independently of a write. JPEG, PNG, GIF, WebP up to 10 MB; SVG rejected. Identical bytes are stored once.",
+    description: "Normal prerequisite for any featured image whose URL was not already returned by commons_host_image. Host image bytes from imageBase64 when you already have an attachment and the serialized request stays under about 3 MB, or from a stable direct public HTTPS image URL; do not pass a webpage, caller-local path, private URL, or temporary/signed attachment URL. Returns the permanent Commons URL to place in featuredImage.url before commons_validate_entity and commons_submit_entity. Submit can still auto-host a stable public source as a compatibility fallback. JPEG, PNG, GIF, and WebP are accepted up to 10 MB; SVG is rejected. Identical bytes are stored once.",
     inputSchema: CommonsHostImageInputSchema,
     outputSchema: recordOutputSchema("commons_host_image", CommonsGenericOutputSchema),
     annotations: {
@@ -56525,7 +57059,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
     annotations: { title: "Set Scheduled Action Connections", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false }
   }, async (input) => executor.setScheduledActionConnections(input));
 }
-var import_server2, import_zod48, import_node_fs11, import_node_path17, import_node_crypto34, ACTION_CONFIRMATION_SCHEMA;
+var import_server2, import_zod48, import_node_fs11, import_node_path17, import_node_crypto35, ACTION_CONFIRMATION_SCHEMA;
 var init_paa_mcp_server = __esm({
   "src/mcp/paa-mcp-server.ts"() {
     "use strict";
@@ -56533,7 +57067,7 @@ var init_paa_mcp_server = __esm({
     import_zod48 = require("zod");
     import_node_fs11 = require("fs");
     import_node_path17 = require("path");
-    import_node_crypto34 = require("crypto");
+    import_node_crypto35 = require("crypto");
     init_version();
     init_rates();
     init_mcp_response_formatter();
@@ -56618,7 +57152,8 @@ function httpErrorPayload(path6, res, data) {
   const safeCode = privateUpstreamState ? "service_unavailable" : recognized ? candidateCode : normalizePublicErrorCode(candidateCode);
   const bodyMessage = objectData ? objectData.message ?? objectData.error ?? rawCode : data;
   return {
-    ...recognized && objectData ? objectData : {},
+    ...recognized && objectData && safeCode !== "mcp_request_timeout" ? objectData : {},
+    ...recognized ? { code: safeCode } : {},
     error: safeCode,
     error_code: safeCode,
     error_type: recognized && typeof objectData?.error_type === "string" ? objectData.error_type : "http",
@@ -56626,7 +57161,7 @@ function httpErrorPayload(path6, res, data) {
     status: res.status,
     statusText: res.statusText,
     path: path6,
-    message: recognized && typeof bodyMessage === "string" && bodyMessage.trim() ? sanitizeVendorName(bodyMessage) : publicErrorMessage(safeCode)
+    message: safeCode === "mcp_request_timeout" ? "The connected service operation timed out before returning a result. Retry failed items or use a smaller batch." : recognized && typeof bodyMessage === "string" && bodyMessage.trim() ? sanitizeVendorName(bodyMessage) : publicErrorMessage(safeCode)
   };
 }
 function withDefaultHostedProfile(input) {
@@ -56654,11 +57189,11 @@ function analyticsReportPath(input, report) {
   const suffix2 = query.size ? `?${query.toString()}` : "";
   return `/analytics/sites/${encodeURIComponent(input.siteId)}/${report}${suffix2}`;
 }
-var import_node_crypto35, HttpMcpToolExecutor;
+var import_node_crypto36, HttpMcpToolExecutor;
 var init_http_mcp_tool_executor = __esm({
   "src/mcp/http-mcp-tool-executor.ts"() {
     "use strict";
-    import_node_crypto35 = require("crypto");
+    import_node_crypto36 = require("crypto");
     init_harvest_timeout();
     init_browser_service_env();
     init_errors();
@@ -56727,13 +57262,13 @@ var init_http_mcp_tool_executor = __esm({
         });
       }
       async callDirectoryWorkflowStart(body, explicitIdempotencyKey) {
-        const idempotencyKey4 = `mcp-directory-${(0, import_node_crypto35.createHash)("sha256").update(explicitIdempotencyKey).digest("hex")}`;
+        const idempotencyKey4 = `mcp-directory-${(0, import_node_crypto36.createHash)("sha256").update(explicitIdempotencyKey).digest("hex")}`;
         return this.call("/directory/run", body, this.timeoutMs, "POST", {
           "Idempotency-Key": idempotencyKey4
         });
       }
       async callSiteExtractStart(toolName, body, explicitIdempotencyKey) {
-        const idempotencyKey4 = `mcp-site-${(0, import_node_crypto35.createHash)("sha256").update(toolName).update("\0").update(explicitIdempotencyKey).digest("hex")}`;
+        const idempotencyKey4 = `mcp-site-${(0, import_node_crypto36.createHash)("sha256").update(toolName).update("\0").update(explicitIdempotencyKey).digest("hex")}`;
         return this.call("/extract-site", body, this.timeoutMs, "POST", {
           "Idempotency-Key": idempotencyKey4
         });
@@ -57177,7 +57712,7 @@ var init_http_mcp_tool_executor = __esm({
           report: input.report,
           format: input.format
         }, this.timeoutMs, "POST", {
-          "Idempotency-Key": `analytics-export-${(0, import_node_crypto35.createHash)("sha256").update(idempotencyKey4).digest("hex")}`
+          "Idempotency-Key": `analytics-export-${(0, import_node_crypto36.createHash)("sha256").update(idempotencyKey4).digest("hex")}`
         });
       }
       commonsSearchEntities(input) {
@@ -57216,7 +57751,7 @@ var init_http_mcp_tool_executor = __esm({
       commonsSubmitEntity(input) {
         const { idempotencyKey: idempotencyKey4, ...body } = input;
         return this.call("/commons/entities/propose", { ...body, idempotencyKey: idempotencyKey4 }, this.timeoutMs, "POST", {
-          "Idempotency-Key": `commons-${(0, import_node_crypto35.createHash)("sha256").update(idempotencyKey4).digest("hex")}`
+          "Idempotency-Key": `commons-${(0, import_node_crypto36.createHash)("sha256").update(idempotencyKey4).digest("hex")}`
         });
       }
       commonsGetEntityLedger(input) {
@@ -57231,7 +57766,7 @@ var init_http_mcp_tool_executor = __esm({
       commonsUpdateEditorialArticle(input) {
         const { idempotencyKey: idempotencyKey4, ...body } = input;
         return this.call("/commons/publications/articles", { ...body, idempotencyKey: idempotencyKey4 }, this.timeoutMs, "POST", {
-          "Idempotency-Key": `commons-article-${(0, import_node_crypto35.createHash)("sha256").update(idempotencyKey4).digest("hex")}`
+          "Idempotency-Key": `commons-article-${(0, import_node_crypto36.createHash)("sha256").update(idempotencyKey4).digest("hex")}`
         });
       }
       commonsSaveFilter(input) {
@@ -57252,13 +57787,13 @@ var init_http_mcp_tool_executor = __esm({
       commonsClaimPublication(input) {
         const { idempotencyKey: idempotencyKey4, ...body } = input;
         return this.call("/commons/publications/claim", { ...body, idempotencyKey: idempotencyKey4 }, this.timeoutMs, "POST", {
-          "Idempotency-Key": `commons-publication-claim-${(0, import_node_crypto35.createHash)("sha256").update(idempotencyKey4).digest("hex")}`
+          "Idempotency-Key": `commons-publication-claim-${(0, import_node_crypto36.createHash)("sha256").update(idempotencyKey4).digest("hex")}`
         });
       }
       commonsPublishEditorial(input) {
         const { idempotencyKey: idempotencyKey4, ...body } = input;
         return this.call("/commons/publications/publish", { ...body, idempotencyKey: idempotencyKey4 }, this.timeoutMs, "POST", {
-          "Idempotency-Key": `commons-publication-publish-${(0, import_node_crypto35.createHash)("sha256").update(idempotencyKey4).digest("hex")}`
+          "Idempotency-Key": `commons-publication-publish-${(0, import_node_crypto36.createHash)("sha256").update(idempotencyKey4).digest("hex")}`
         });
       }
       commonsGetPublication(input) {
@@ -57266,13 +57801,13 @@ var init_http_mcp_tool_executor = __esm({
         return this.getJson(input.subdomain ? `/commons/publications/${encodeURIComponent(input.subdomain)}?${query}` : `/commons/publications/me?${query}`);
       }
       async captureSerpSnapshot(input) {
-        const fingerprint2 = (0, import_node_crypto35.createHash)("sha256").update(JSON.stringify(input)).digest("hex");
+        const fingerprint2 = (0, import_node_crypto36.createHash)("sha256").update(JSON.stringify(input)).digest("hex");
         const now = Date.now();
         for (const [pendingFingerprint, pendingEntry] of this.pendingSerpCaptureBillingKeys) {
           if (pendingEntry.expiresAt <= now) this.pendingSerpCaptureBillingKeys.delete(pendingFingerprint);
         }
         const pending = this.pendingSerpCaptureBillingKeys.get(fingerprint2);
-        const idempotencyKey4 = pending && pending.expiresAt > now ? pending.key : (0, import_node_crypto35.randomUUID)();
+        const idempotencyKey4 = pending && pending.expiresAt > now ? pending.key : (0, import_node_crypto36.randomUUID)();
         this.pendingSerpCaptureBillingKeys.set(fingerprint2, {
           key: idempotencyKey4,
           expiresAt: now + 15 * 6e4
@@ -63282,7 +63817,7 @@ async function createImageSourceArtifact(args) {
   if (args.content.length === 0 || args.content.length > IMAGE_SOURCE_MAX_BYTES) {
     throw new Error("image_source_size_invalid");
   }
-  const id = (0, import_node_crypto36.randomUUID)().replaceAll("-", "");
+  const id = (0, import_node_crypto37.randomUUID)().replaceAll("-", "");
   return createPrivateArtifact({
     policy: policy4(),
     ownerId: args.ownerId,
@@ -63301,11 +63836,11 @@ async function readOwnedImageSourceArtifact(args) {
     maxBytes: IMAGE_SOURCE_MAX_BYTES
   });
 }
-var import_node_crypto36, IMAGE_SOURCE_ARTIFACT_PREFIX, IMAGE_SOURCE_ARTIFACT_TTL_MS, IMAGE_SOURCE_DOWNLOAD_TTL_MS, IMAGE_SOURCE_MAX_BYTES, ALLOWED_IMAGE_TYPES;
+var import_node_crypto37, IMAGE_SOURCE_ARTIFACT_PREFIX, IMAGE_SOURCE_ARTIFACT_TTL_MS, IMAGE_SOURCE_DOWNLOAD_TTL_MS, IMAGE_SOURCE_MAX_BYTES, ALLOWED_IMAGE_TYPES;
 var init_image_source_artifacts = __esm({
   "src/api/image-source-artifacts.ts"() {
     "use strict";
-    import_node_crypto36 = require("crypto");
+    import_node_crypto37 = require("crypto");
     init_private_artifacts();
     IMAGE_SOURCE_ARTIFACT_PREFIX = "image-sources/";
     IMAGE_SOURCE_ARTIFACT_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
@@ -64919,7 +65454,7 @@ async function runBrowserAgentMigration() {
 }
 async function createExtensionRow(input) {
   const db = getDb();
-  const id = `bext_${(0, import_node_crypto37.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
+  const id = `bext_${(0, import_node_crypto38.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_agent_extensions (id, user_id, name, backend_id, backend_name, source, source_url, size_bytes)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
@@ -64954,7 +65489,7 @@ async function deleteExtensionRow(userId, name) {
 }
 async function createAuthConnectionRow(input) {
   const db = getDb();
-  const connectionId = `authc_${(0, import_node_crypto37.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
+  const connectionId = `authc_${(0, import_node_crypto38.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_auth_connections (connection_id, domain, profile, account_email, note, status, browser_agent_session_id)
           VALUES (?, ?, ?, ?, ?, 'NEEDS_AUTH', ?)`,
@@ -65039,7 +65574,7 @@ async function deleteProfileLabel(userId, profile) {
 }
 async function createSessionRow(input) {
   const db = getDb();
-  const id = `bas_${(0, import_node_crypto37.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
+  const id = `bas_${(0, import_node_crypto38.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_agent_sessions (id, runtime_session_id, live_view_url, cdp_ws_url, status, label, user_id, concurrency_lock_id, last_action_at)
           VALUES (?, ?, ?, ?, 'open', ?, ?, ?, datetime('now'))`,
@@ -65116,7 +65651,7 @@ async function recordAction(input) {
     sql: `INSERT INTO browser_agent_actions (id, session_id, type, params_json, ok, error)
           VALUES (?, ?, ?, ?, ?, ?)`,
     args: [
-      `baa_${(0, import_node_crypto37.randomUUID)().replace(/-/g, "").slice(0, 20)}`,
+      `baa_${(0, import_node_crypto38.randomUUID)().replace(/-/g, "").slice(0, 20)}`,
       input.sessionId,
       input.type,
       input.params == null ? null : JSON.stringify(input.params),
@@ -65156,11 +65691,11 @@ async function listReplayRows(sessionId) {
   });
   return res.rows;
 }
-var import_node_crypto37, _ready2, _migrationPromise2, ORPHANED_SESSION_STATUS;
+var import_node_crypto38, _ready2, _migrationPromise2, ORPHANED_SESSION_STATUS;
 var init_browser_agent_db = __esm({
   "src/api/browser-agent-db.ts"() {
     "use strict";
-    import_node_crypto37 = require("crypto");
+    import_node_crypto38 = require("crypto");
     init_db();
     _ready2 = false;
     _migrationPromise2 = null;
@@ -66302,7 +66837,7 @@ var init_browser_agent_service = __esm({
 
 // src/api/serp-identity-db.ts
 async function createSerpIdentityRow(input) {
-  const id = `serpi_${(0, import_node_crypto38.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
+  const id = `serpi_${(0, import_node_crypto39.randomUUID)().replace(/-/g, "").slice(0, 20)}`;
   await getDb().execute({
     sql: `INSERT INTO serp_identities
           (id, user_id, name, kernel_profile_name, kernel_proxy_id, proxy_type, country, status)
@@ -66347,11 +66882,11 @@ async function deleteSerpIdentityRow(userId, name) {
     args: [userId, name]
   });
 }
-var import_node_crypto38;
+var import_node_crypto39;
 var init_serp_identity_db = __esm({
   "src/api/serp-identity-db.ts"() {
     "use strict";
-    import_node_crypto38 = require("crypto");
+    import_node_crypto39 = require("crypto");
     init_db();
   }
 });
@@ -66363,8 +66898,8 @@ function kernelClient() {
   return new import_sdk10.default({ apiKey });
 }
 function backendName(userId, name, resource) {
-  const digest2 = (0, import_node_crypto39.createHash)("sha256").update(`${userId}:${name}`).digest("hex").slice(0, 16);
-  const nonce = (0, import_node_crypto39.randomUUID)().replace(/-/g, "").slice(0, 8);
+  const digest2 = (0, import_node_crypto40.createHash)("sha256").update(`${userId}:${name}`).digest("hex").slice(0, 16);
+  const nonce = (0, import_node_crypto40.randomUUID)().replace(/-/g, "").slice(0, 8);
   return `mcp-serp-${resource}-${digest2}-${nonce}`;
 }
 function isNotFound2(error) {
@@ -66442,11 +66977,11 @@ async function deleteSerpIdentity(userId, name) {
     throw error;
   }
 }
-var import_node_crypto39, import_sdk10, MAX_SERP_IDENTITIES_PER_USER;
+var import_node_crypto40, import_sdk10, MAX_SERP_IDENTITIES_PER_USER;
 var init_serp_identity_service = __esm({
   "src/api/serp-identity-service.ts"() {
     "use strict";
-    import_node_crypto39 = require("crypto");
+    import_node_crypto40 = require("crypto");
     import_sdk10 = __toESM(require("@onkernel/sdk"), 1);
     init_browser_service_env();
     init_serp_identity_db();
@@ -67157,7 +67692,7 @@ function buildBrowserAgentRoutes() {
     }
     const existing = await getExtensionRow(user.id, name);
     if (existing) return c.json({ error: `an extension named "${name}" already exists \u2014 delete it first or pick another name` }, 409);
-    const backendName2 = `u${user.id}_${(0, import_node_crypto40.randomUUID)().replace(/-/g, "")}`;
+    const backendName2 = `u${user.id}_${(0, import_node_crypto41.randomUUID)().replace(/-/g, "")}`;
     try {
       const imported = await importExtensionFromStore(storeUrl, backendName2);
       const row = await createExtensionRow({
@@ -67216,11 +67751,11 @@ function buildBrowserAgentRoutes() {
   });
   return app2;
 }
-var import_node_crypto40, import_hono24, auth, DEFAULT_BROWSER_SESSION_LOCK_TTL_SECONDS, EXTENSION_NAME_RE, SERP_IDENTITY_NAME_RE;
+var import_node_crypto41, import_hono24, auth, DEFAULT_BROWSER_SESSION_LOCK_TTL_SECONDS, EXTENSION_NAME_RE, SERP_IDENTITY_NAME_RE;
 var init_browser_agent_routes = __esm({
   "src/api/browser-agent-routes.ts"() {
     "use strict";
-    import_node_crypto40 = require("crypto");
+    import_node_crypto41 = require("crypto");
     import_hono24 = require("hono");
     init_api_auth();
     init_errors();
@@ -67778,7 +68313,7 @@ async function getKeys() {
   const privateKey = await (0, import_jose2.importPKCS8)(pem, "RS256", { extractable: true });
   const full = await (0, import_jose2.exportJWK)(privateKey);
   const publicJwk = { kty: full.kty, n: full.n, e: full.e };
-  const kid = (0, import_node_crypto41.createHash)("sha256").update(JSON.stringify({ e: publicJwk.e, kty: publicJwk.kty, n: publicJwk.n })).digest("base64url").slice(0, 16);
+  const kid = (0, import_node_crypto42.createHash)("sha256").update(JSON.stringify({ e: publicJwk.e, kty: publicJwk.kty, n: publicJwk.n })).digest("base64url").slice(0, 16);
   publicJwk.kid = kid;
   publicJwk.alg = "RS256";
   publicJwk.use = "sig";
@@ -67957,23 +68492,23 @@ async function validateAuthRequest(p) {
 }
 function pkceMatches(verifier, challenge) {
   if (!verifier) return false;
-  const computed = (0, import_node_crypto41.createHash)("sha256").update(verifier).digest("base64url");
+  const computed = (0, import_node_crypto42.createHash)("sha256").update(verifier).digest("base64url");
   return computed === challenge;
 }
 async function mintAccessToken(identity, scope, plan, audience) {
   const { privateKey, kid } = await getKeys();
-  return new import_jose2.SignJWT({ scope, plan }).setProtectedHeader({ alg: "RS256", kid }).setIssuer(ISSUER).setSubject(identity).setAudience(audience).setIssuedAt().setJti((0, import_node_crypto41.randomUUID)()).setExpirationTime(`${ACCESS_TTL_SECONDS}s`).sign(privateKey);
+  return new import_jose2.SignJWT({ scope, plan }).setProtectedHeader({ alg: "RS256", kid }).setIssuer(ISSUER).setSubject(identity).setAudience(audience).setIssuedAt().setJti((0, import_node_crypto42.randomUUID)()).setExpirationTime(`${ACCESS_TTL_SECONDS}s`).sign(privateKey);
 }
 function tokenErrorResponse(c, error, description, status) {
   return c.json({ error, error_description: description }, status);
 }
-var import_hono26, import_cookie, import_node_crypto41, import_jose2, ISSUER, RESOURCE, SCRAPER_RESOURCE, MEMORY_SCOPES, SCRAPER_SCOPES, SUPPORTED_SCOPES, ACCESS_TTL_SECONDS, REFRESH_TTL_SECONDS, CODE_TTL_SECONDS, ROTATION_GRACE_SECONDS, OAUTH_DATABASE_TIMEOUT_MS, OAuthDatabaseUnavailableError, secureCookies, sessionCookieOptions, cachedKeys, oauthApp;
+var import_hono26, import_cookie, import_node_crypto42, import_jose2, ISSUER, RESOURCE, SCRAPER_RESOURCE, MEMORY_SCOPES, SCRAPER_SCOPES, SUPPORTED_SCOPES, ACCESS_TTL_SECONDS, REFRESH_TTL_SECONDS, CODE_TTL_SECONDS, ROTATION_GRACE_SECONDS, OAUTH_DATABASE_TIMEOUT_MS, OAuthDatabaseUnavailableError, secureCookies, sessionCookieOptions, cachedKeys, oauthApp;
 var init_oauth_routes = __esm({
   "src/api/oauth-routes.ts"() {
     "use strict";
     import_hono26 = require("hono");
     import_cookie = require("hono/cookie");
-    import_node_crypto41 = require("crypto");
+    import_node_crypto42 = require("crypto");
     import_jose2 = require("jose");
     init_session();
     init_db();
@@ -68080,7 +68615,7 @@ var init_oauth_routes = __esm({
         }
       }
       const clientName = typeof body.client_name === "string" ? body.client_name : null;
-      const clientId = `client_${(0, import_node_crypto41.randomBytes)(16).toString("hex")}`;
+      const clientId = `client_${(0, import_node_crypto42.randomBytes)(16).toString("hex")}`;
       await withOAuthDatabaseDeadline("register-client", registerClient(clientId, redirectUris, clientName));
       console.log("[oauth-dcr] register OK client_id=%s redirect_uris=%s", clientId, JSON.stringify(redirectUris));
       return c.json({
@@ -68133,7 +68668,7 @@ var init_oauth_routes = __esm({
       if (action3 === "deny") return redirectWithError(p.redirect_uri, p.state, "access_denied");
       if (action3 !== "approve") return c.text("unsupported action", 400);
       const scope = negotiateScope(p.scope, user, p.resource);
-      const code = `code_${(0, import_node_crypto41.randomBytes)(32).toString("base64url")}`;
+      const code = `code_${(0, import_node_crypto42.randomBytes)(32).toString("base64url")}`;
       const expiresAt = new Date(Date.now() + CODE_TTL_SECONDS * 1e3).toISOString();
       await withOAuthDatabaseDeadline("put-authorization-code", putCode({
         code,
@@ -68172,7 +68707,7 @@ var init_oauth_routes = __esm({
         const plan = user ? resolvePlan(user) : "free";
         const audience = record.resource ?? RESOURCE();
         const accessToken = await mintAccessToken(record.identity, record.scope, plan, audience);
-        const refreshToken = `rt_${(0, import_node_crypto41.randomBytes)(40).toString("base64url")}`;
+        const refreshToken = `rt_${(0, import_node_crypto42.randomBytes)(40).toString("base64url")}`;
         await withOAuthDatabaseDeadline("put-refresh-token", putRefresh({
           refresh_token: refreshToken,
           client_id: clientId,
@@ -68202,7 +68737,7 @@ var init_oauth_routes = __esm({
         const plan = user ? resolvePlan(user) : "free";
         const audience = record.resource ?? RESOURCE();
         const accessToken = await mintAccessToken(record.identity, record.scope, plan, audience);
-        const nextRefresh = `rt_${(0, import_node_crypto41.randomBytes)(40).toString("base64url")}`;
+        const nextRefresh = `rt_${(0, import_node_crypto42.randomBytes)(40).toString("base64url")}`;
         await withOAuthDatabaseDeadline("rotate-refresh-token", rotateRefresh(refreshToken, {
           refresh_token: nextRefresh,
           client_id: record.client_id,
@@ -69622,7 +70157,7 @@ function quoteUntrusted(value) {
   return clean3.split("\n").map((line) => `> ${line}`).join("\n");
 }
 function shortHash(value, length = 24) {
-  return (0, import_node_crypto42.createHash)("sha256").update(value).digest("hex").slice(0, length);
+  return (0, import_node_crypto43.createHash)("sha256").update(value).digest("hex").slice(0, length);
 }
 function safePathPart(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "contact";
@@ -70110,11 +70645,11 @@ async function captureSupportMessage(memoryKey, email, options) {
     direction: options.direction
   };
 }
-var import_node_crypto42, SUPPORT_TAGS, ISSUE_TAGS;
+var import_node_crypto43, SUPPORT_TAGS, ISSUE_TAGS;
 var init_resend_support_thread = __esm({
   "src/api/resend-support-thread.ts"() {
     "use strict";
-    import_node_crypto42 = require("crypto");
+    import_node_crypto43 = require("crypto");
     init_memory();
     SUPPORT_TAGS = [
       {
@@ -70699,7 +71234,7 @@ async function claimWorkshopRegistration(input) {
       ) < ?
     `,
     args: [
-      (0, import_node_crypto43.randomUUID)(),
+      (0, import_node_crypto44.randomUUID)(),
       input.eventSlug,
       input.email,
       input.firstName,
@@ -70716,7 +71251,7 @@ async function claimWorkshopRegistration(input) {
         id, event_slug, email, first_name, last_name, status
       ) VALUES (?, ?, ?, ?, ?, 'waitlisted')
     `,
-    args: [(0, import_node_crypto43.randomUUID)(), input.eventSlug, input.email, input.firstName, input.lastName || null]
+    args: [(0, import_node_crypto44.randomUUID)(), input.eventSlug, input.email, input.firstName, input.lastName || null]
   });
   const waitlisted = await getWorkshopRegistration(input.eventSlug, input.email);
   if (!waitlisted) throw new Error("workshop registration could not be claimed");
@@ -70731,7 +71266,7 @@ async function registerWorkshopInterest(input) {
         id, event_slug, email, first_name, last_name, status
       ) VALUES (?, ?, ?, ?, ?, 'interested')
     `,
-    args: [(0, import_node_crypto43.randomUUID)(), input.eventSlug, input.email, input.firstName, input.lastName || null]
+    args: [(0, import_node_crypto44.randomUUID)(), input.eventSlug, input.email, input.firstName, input.lastName || null]
   });
   const registration = await getWorkshopRegistration(input.eventSlug, input.email);
   if (!registration) throw new Error("workshop interest could not be recorded");
@@ -70761,11 +71296,11 @@ async function updateWorkshopRegistration(id, patch) {
     args: [...entries.map(([, value]) => value), id]
   });
 }
-var import_node_crypto43;
+var import_node_crypto44;
 var init_workshop_registration_repository = __esm({
   "src/api/workshop-registration-repository.ts"() {
     "use strict";
-    import_node_crypto43 = require("crypto");
+    import_node_crypto44 = require("crypto");
     init_db();
   }
 });
@@ -71338,7 +71873,7 @@ function renderEditorialReadingRoom(input, now = /* @__PURE__ */ new Date()) {
     articleCount: articles.length,
     wordCount: totalWordCount,
     bytes,
-    sha256: (0, import_node_crypto44.createHash)("sha256").update(html).digest("hex"),
+    sha256: (0, import_node_crypto45.createHash)("sha256").update(html).digest("hex"),
     warnings
   };
 }
@@ -71421,14 +71956,14 @@ ${provenance}`;
     ...rendered,
     html,
     bytes: Buffer.byteLength(html),
-    sha256: (0, import_node_crypto44.createHash)("sha256").update(html).digest("hex")
+    sha256: (0, import_node_crypto45.createHash)("sha256").update(html).digest("hex")
   };
 }
-var import_node_crypto44, import_node_fs14, import_node_path21, import_marked, runtimeEntryDir, assetCache;
+var import_node_crypto45, import_node_fs14, import_node_path21, import_marked, runtimeEntryDir, assetCache;
 var init_render = __esm({
   "src/editorial-reading-room/render.ts"() {
     "use strict";
-    import_node_crypto44 = require("crypto");
+    import_node_crypto45 = require("crypto");
     import_node_fs14 = require("fs");
     import_node_path21 = require("path");
     import_marked = require("marked");
@@ -71572,8 +72107,9 @@ var init_editorial_reading_room_routes = __esm({
 
 // src/api/commons-image-store.ts
 async function ensureCommonsImageSchema() {
-  if (imageSchemaReady) return;
-  await getDb().execute(`
+  const db = getDb();
+  if (imageSchemaReady && imageSchemaDb === db) return;
+  await db.execute(`
     CREATE TABLE IF NOT EXISTS commons_images (
       id           TEXT    PRIMARY KEY,
       user_id      INTEGER NOT NULL,
@@ -71589,8 +72125,9 @@ async function ensureCommonsImageSchema() {
       created_at   TEXT    NOT NULL DEFAULT (datetime('now'))
     )
   `);
-  await getDb().execute(`CREATE UNIQUE INDEX IF NOT EXISTS commons_images_digest ON commons_images(digest)`);
+  await db.execute(`CREATE UNIQUE INDEX IF NOT EXISTS commons_images_digest ON commons_images(digest)`);
   imageSchemaReady = true;
+  imageSchemaDb = db;
 }
 function sniffImageFormat(bytes) {
   if (bytes.length < 12) return null;
@@ -71620,7 +72157,7 @@ async function assertPublicHttpsUrl(rawUrl) {
   try {
     url = new URL(rawUrl);
   } catch {
-    throw new CommonsImageError("image_url_invalid", `"${rawUrl}" is not a valid URL.`);
+    throw new CommonsImageError("image_url_invalid", "The image source is not a valid URL.");
   }
   if (url.protocol !== "https:") {
     throw new CommonsImageError("image_url_not_https", "Commons image sources must be https URLs.");
@@ -71628,7 +72165,7 @@ async function assertPublicHttpsUrl(rawUrl) {
   const hostname = url.hostname.replace(/^\[|\]$/g, "");
   const addresses = (0, import_node_net2.isIP)(hostname) ? [{ address: hostname }] : await (0, import_promises16.lookup)(hostname, { all: true }).catch(() => []);
   if (!addresses.length) {
-    throw new CommonsImageError("image_host_unresolvable", `Could not resolve ${url.hostname}.`);
+    throw new CommonsImageError("image_host_unresolvable", "The image source host could not be resolved.");
   }
   if (addresses.some((entry) => isBlockedAddress(entry.address))) {
     throw new CommonsImageError("image_host_blocked", "Commons image sources cannot resolve to private or loopback addresses.");
@@ -71639,15 +72176,36 @@ async function downloadImage(sourceUrl) {
   let current = sourceUrl;
   for (let redirect = 0; redirect <= COMMONS_IMAGE_MAX_REDIRECTS; redirect += 1) {
     const url = await assertPublicHttpsUrl(current);
-    const response = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(COMMONS_IMAGE_FETCH_TIMEOUT_MS) });
+    let response;
+    try {
+      response = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(COMMONS_IMAGE_FETCH_TIMEOUT_MS) });
+    } catch (error) {
+      if (error instanceof CommonsImageError) throw error;
+      throw new CommonsImageError(
+        "image_source_unavailable",
+        "The image source could not be reached by Commons.",
+        422,
+        true
+      );
+    }
     if (response.status >= 300 && response.status < 400) {
       const location2 = response.headers.get("location");
       if (!location2) throw new CommonsImageError("image_redirect_invalid", "Image source redirected without a destination.");
-      current = new URL(location2, url).toString();
+      try {
+        current = new URL(location2, url).toString();
+      } catch {
+        throw new CommonsImageError("image_redirect_invalid", "Image source redirected to an invalid destination.");
+      }
       continue;
     }
     if (!response.ok) {
-      throw new CommonsImageError("image_source_unavailable", `Image source returned HTTP ${response.status}.`, 422);
+      const retryable = response.status === 408 || response.status === 425 || response.status === 429 || response.status >= 500;
+      throw new CommonsImageError(
+        "image_source_unavailable",
+        `The image source returned HTTP ${response.status} and could not be hosted.`,
+        422,
+        retryable
+      );
     }
     const declaredLength = Number(response.headers.get("content-length") ?? "0");
     if (declaredLength > COMMONS_IMAGE_MAX_BYTES) {
@@ -71674,8 +72232,35 @@ function commonsImageBlobStore() {
   const token6 = process.env.COMMONS_IMAGE_READ_WRITE_TOKEN?.trim() || process.env.COMMONS_IMAGE_BLOB_READ_WRITE_TOKEN?.trim() || process.env.BLOB_READ_WRITE_TOKEN?.trim();
   return token6 ? new VercelBlobStore(token6) : getBlobStore();
 }
-function isCommonsHostedImageUrl(url) {
-  return /^https:\/\/[^/]*(\.public\.blob\.vercel-storage\.com|blob\.vercel-storage\.com)\//i.test(url);
+function normalizeCommonsImageUrl(rawUrl) {
+  try {
+    const url = new URL(rawUrl.trim());
+    if (url.protocol !== "https:") return null;
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+async function findCommonsHostedImageByUrl(rawUrl) {
+  const url = normalizeCommonsImageUrl(rawUrl);
+  if (!url) return null;
+  await ensureCommonsImageSchema();
+  const result = await getDb().execute({
+    sql: "SELECT id, url, content_type, bytes, digest, source_url FROM commons_images WHERE url = ? LIMIT 1",
+    args: [url]
+  });
+  const row = result.rows[0];
+  if (!row) return null;
+  return {
+    id: String(row.id),
+    url: String(row.url),
+    contentType: String(row.content_type),
+    bytes: Number(row.bytes),
+    digest: String(row.digest),
+    sourceUrl: row.source_url ? String(row.source_url) : null,
+    reused: true
+  };
 }
 async function hostCommonsImage(input) {
   if (hostOverride) return hostOverride(input);
@@ -71692,7 +72277,7 @@ async function hostCommonsImage(input) {
       415
     );
   }
-  const digest2 = (0, import_node_crypto45.createHash)("sha256").update(bytes).digest("hex");
+  const digest2 = (0, import_node_crypto46.createHash)("sha256").update(bytes).digest("hex");
   const existing = await getDb().execute({
     sql: "SELECT id, url, content_type, bytes, source_url FROM commons_images WHERE digest = ? LIMIT 1",
     args: [digest2]
@@ -71746,7 +72331,8 @@ async function hostCommonsImage(input) {
 async function hostEntityImages(input) {
   const rewrite = { mediaUrls: /* @__PURE__ */ new Map(), dropped: [] };
   const featuredUrl = input.featuredImage?.url;
-  if (featuredUrl && !isCommonsHostedImageUrl(featuredUrl)) {
+  const registeredFeatured = featuredUrl ? await findCommonsHostedImageByUrl(featuredUrl) : null;
+  if (featuredUrl && !registeredFeatured) {
     const hosted = await hostCommonsImage({
       userId: input.userId,
       sourceUrl: featuredUrl,
@@ -71754,17 +72340,19 @@ async function hostEntityImages(input) {
       license: input.featuredImage?.license,
       attribution: input.featuredImage?.sourceUrl
     }).catch((error) => {
-      const message = error instanceof Error ? error.message : String(error);
+      if (error instanceof CommonsImageError) throw error;
       throw new CommonsImageError(
-        error instanceof CommonsImageError ? error.code : "featured_image_unhostable",
-        `The featured image could not be hosted, so this entity would publish with a link that can break: ${message}`,
+        "featured_image_unhostable",
+        "The featured image could not be hosted, so the entity was not persisted with a link that could break.",
         422
       );
     });
     rewrite.featuredImageUrl = hosted.url;
+    rewrite.mediaUrls.set(featuredUrl, hosted.url);
   }
   for (const item of input.media ?? []) {
-    if (!item.url || isCommonsHostedImageUrl(item.url)) continue;
+    if (item.url && rewrite.mediaUrls.has(item.url)) continue;
+    if (!item.url || await findCommonsHostedImageByUrl(item.url)) continue;
     try {
       const hosted = await hostCommonsImage({
         userId: input.userId,
@@ -71780,11 +72368,11 @@ async function hostEntityImages(input) {
   }
   return rewrite;
 }
-var import_node_crypto45, import_promises16, import_node_net2, COMMONS_IMAGE_MAX_BYTES, COMMONS_IMAGE_MAX_REDIRECTS, COMMONS_IMAGE_FETCH_TIMEOUT_MS, CommonsImageError, imageSchemaReady, hostOverride;
+var import_node_crypto46, import_promises16, import_node_net2, COMMONS_IMAGE_MAX_BYTES, COMMONS_IMAGE_MAX_REDIRECTS, COMMONS_IMAGE_FETCH_TIMEOUT_MS, COMMONS_IMAGE_RETRY_GUIDANCE, CommonsImageError, imageSchemaReady, imageSchemaDb, hostOverride;
 var init_commons_image_store = __esm({
   "src/api/commons-image-store.ts"() {
     "use strict";
-    import_node_crypto45 = require("crypto");
+    import_node_crypto46 = require("crypto");
     import_promises16 = require("dns/promises");
     import_node_net2 = require("net");
     init_blob_store();
@@ -71792,17 +72380,23 @@ var init_commons_image_store = __esm({
     COMMONS_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
     COMMONS_IMAGE_MAX_REDIRECTS = 3;
     COMMONS_IMAGE_FETCH_TIMEOUT_MS = 2e4;
+    COMMONS_IMAGE_RETRY_GUIDANCE = "Call commons_host_image with a different stable public HTTPS image URL or imageBase64, replace featuredImage.url with the returned URL, validate again, then retry commons_submit_entity with the same idempotency key.";
     CommonsImageError = class extends Error {
-      constructor(code, message, httpStatus = 400) {
+      constructor(code, message, httpStatus = 400, retryable = false, retryGuidance = COMMONS_IMAGE_RETRY_GUIDANCE) {
         super(message);
         this.code = code;
         this.httpStatus = httpStatus;
+        this.retryable = retryable;
+        this.retryGuidance = retryGuidance;
         this.name = "CommonsImageError";
       }
       code;
       httpStatus;
+      retryable;
+      retryGuidance;
     };
     imageSchemaReady = false;
+    imageSchemaDb = null;
     hostOverride = null;
   }
 });
@@ -71909,7 +72503,7 @@ function buildCommonsLinkset(entity, claims) {
     context[claim.predicate] = targets;
   }
   const document2 = { linkset: [context] };
-  const etag = `"${(0, import_node_crypto46.createHash)("sha256").update(JSON.stringify(document2)).digest("hex")}"`;
+  const etag = `"${(0, import_node_crypto47.createHash)("sha256").update(JSON.stringify(document2)).digest("hex")}"`;
   return { document: document2, etag, publicUrl, linksetUrl, profile: COMMONS_RELATIONSHIP_PROFILE };
 }
 function commonsLinksetDiscoveryHeader(idOrSlug) {
@@ -71977,11 +72571,11 @@ function normalizeHreflang(value) {
   const languages = [...new Set(value.map((item) => optionalText(item, 80)).filter((item) => Boolean(item)))];
   return languages.length ? languages : void 0;
 }
-var import_node_crypto46, COMMONS_LINKSET_MEDIA_TYPE, COMMONS_RELATIONSHIP_PROFILE, REGISTERED_RELATIONS;
+var import_node_crypto47, COMMONS_LINKSET_MEDIA_TYPE, COMMONS_RELATIONSHIP_PROFILE, REGISTERED_RELATIONS;
 var init_commons_linksets = __esm({
   "src/api/commons-linksets.ts"() {
     "use strict";
-    import_node_crypto46 = require("crypto");
+    import_node_crypto47 = require("crypto");
     COMMONS_LINKSET_MEDIA_TYPE = "application/linkset+json";
     COMMONS_RELATIONSHIP_PROFILE = "https://mcpscraper.dev/commons/profiles/relationships/v1";
     REGISTERED_RELATIONS = /* @__PURE__ */ new Set([
@@ -72024,9 +72618,9 @@ var init_commons_linksets = __esm({
 
 // src/api/commons-repository.ts
 async function ensureCommonsSchema() {
-  if (schemaReady) return;
+  if (schemaReady2) return;
   if (await schemaObjectsPresent(COMMONS_SCHEMA_OBJECTS)) {
-    schemaReady = true;
+    schemaReady2 = true;
     return;
   }
   const db = getDb();
@@ -72249,7 +72843,7 @@ async function ensureCommonsSchema() {
       args: [COMMONS_SCHEMA_VERSION]
     }
   ], "write");
-  schemaReady = true;
+  schemaReady2 = true;
 }
 async function searchCommonsEntities(filters = {}, userId) {
   await ensureCommonsSchema();
@@ -72457,7 +73051,7 @@ async function prepareCommonsEntity(input, user) {
       normalizedEntityType: entityType,
       proposedSlug: slug4 || null,
       publicUrl: slug4 ? publicUrlForSlug(slug4) : null,
-      writePath: "commons_prepare_entity -> commons_validate_entity -> commons_submit_entity"
+      writePath: "commons_prepare_entity -> compose the entity -> commons_host_image -> commons_validate_entity -> commons_submit_entity"
     },
     contract,
     billing: {
@@ -72479,8 +73073,8 @@ async function prepareCommonsEntity(input, user) {
       "Search likely duplicates before submitting a new entity. If one matches, edit it with entityId and baseRevision instead of creating another page.",
       "Use the returned profile as a contract, not a rigid empty template: do not include History, Reception, Pricing, Timeline, or similar sections unless source evidence supports them.",
       "Write neutral encyclopedia prose. Do not paste raw scrape Markdown, marketing layout fragments, or empty/filler headings.",
-      "Attach a featured image for auto-publish eligibility, preserve original URL/source byline/relCanonical when republishing, and put media assets in the media array.",
-      "Call commons_validate_entity with the composed payload before commons_submit_entity.",
+      "For a featured image not already hosted by Commons, call commons_host_image and replace featuredImage.url with its returned permanent URL. Preserve original URL/source byline/relCanonical when republishing, and put media assets in the media array.",
+      "Call commons_validate_entity with the composed, image-ready payload before commons_submit_entity.",
       "Validation is free. Submitting a new entity costs 10 Credits; submitting an edit to an existing entity costs 2 Credits."
     ]
   };
@@ -72495,6 +73089,8 @@ async function validateCommonsEntity(input, user) {
   const contract = commonsEntityProfileFor(input.entityType, input.seo?.schemaOrgType);
   const source = normalizeSource(input.source);
   const featuredImage = normalizeFeaturedImage(input.featuredImage);
+  const normalizedFeaturedImageUrl = featuredImage?.url ? normalizeCommonsImageUrl(featuredImage.url) : null;
+  const registeredFeaturedImage = normalizedFeaturedImageUrl ? await findCommonsHostedImageByUrl(normalizedFeaturedImageUrl) : null;
   const bodyMarkdown = safeCandidateBody(input.bodyMarkdown, input.contentSections);
   const headings = extractMarkdownHeadings(bodyMarkdown);
   const placeholderSections = unsupportedPlaceholderSections(bodyMarkdown);
@@ -72532,15 +73128,44 @@ async function validateCommonsEntity(input, user) {
   if (input.reviewPolicy === "always_review") {
     warnings.push("reviewPolicy is always_review, so the proposal will not auto-publish even if the payload is otherwise valid.");
   }
+  if (featuredImage?.url && !registeredFeaturedImage) {
+    warnings.push("The featured image is not registered in permanent Commons image storage. Call commons_host_image, replace featuredImage.url with its returned URL, and validate again before submitting.");
+  }
   if (user?.id == null) warnings.push("No authenticated user was supplied to validation; submit still requires API-key authenticated user context.");
   const valid = errors.length === 0;
-  const autoPublishEligible = valid && input.reviewPolicy !== "always_review";
+  const imageReadyForPublish = Boolean(registeredFeaturedImage);
+  const publishable = valid && imageReadyForPublish;
+  const autoPublishEligible = publishable && input.reviewPolicy !== "always_review";
   const tagVocabulary = await commonsTagVocabulary();
   return {
     ok: true,
     valid,
-    publishable: valid,
+    publishable,
     autoPublishEligible,
+    imageDiagnostics: {
+      featuredImage: registeredFeaturedImage ? {
+        state: "commons_hosted",
+        url: registeredFeaturedImage.url,
+        commonsImageId: registeredFeaturedImage.id,
+        readyForPublish: true,
+        submitWillAttemptAutoHost: false,
+        requiredAction: null
+      } : featuredImage?.url ? {
+        state: "external_unhosted",
+        url: normalizedFeaturedImageUrl,
+        commonsImageId: null,
+        readyForPublish: false,
+        submitWillAttemptAutoHost: true,
+        requiredAction: "Call commons_host_image, replace featuredImage.url with its returned permanent URL, and validate again."
+      } : {
+        state: "missing",
+        url: null,
+        commonsImageId: null,
+        readyForPublish: false,
+        submitWillAttemptAutoHost: false,
+        requiredAction: "Add a featured image by calling commons_host_image, then set featuredImage.url to its returned permanent URL."
+      }
+    },
     errors,
     warnings,
     contract,
@@ -72621,7 +73246,7 @@ async function submitCommonsEntity(input, user) {
   const existingClaims = existing && normalized.claims !== void 0 ? await getCommonsClaimsByEntityId(existing.id) : [];
   const safety = evaluatePublishSafety(normalized, existing);
   const shouldApply = safety.safe && normalized.reviewPolicy !== "always_review";
-  const proposalId = `commons-proposal-${(0, import_node_crypto47.randomUUID)()}`;
+  const proposalId = `commons-proposal-${(0, import_node_crypto48.randomUUID)()}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const entityId = existing?.id ?? normalized.entityId ?? allocateEntityId();
   const proposalStatus = shouldApply ? "accepted" : "pending_review";
@@ -72676,7 +73301,7 @@ async function submitCommonsEntity(input, user) {
         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       `,
       args: [
-        `commons-ledger-${(0, import_node_crypto47.randomUUID)()}`,
+        `commons-ledger-${(0, import_node_crypto48.randomUUID)()}`,
         nextEntity.id,
         proposalId,
         user.id,
@@ -72782,7 +73407,7 @@ async function saveCommonsFilter(input, user) {
     sql: "SELECT id FROM commons_saved_filters WHERE user_id = ? AND name = ? LIMIT 1",
     args: [user.id, name]
   });
-  const id = existing.rows[0]?.id != null ? String(existing.rows[0].id) : `commons-filter-${(0, import_node_crypto47.randomUUID)()}`;
+  const id = existing.rows[0]?.id != null ? String(existing.rows[0].id) : `commons-filter-${(0, import_node_crypto48.randomUUID)()}`;
   await getDb().execute({
     sql: `
       INSERT INTO commons_saved_filters (id, user_id, name, description, filter_json, created_at, updated_at)
@@ -73560,7 +74185,7 @@ function commonsIndexDocuments(entity, now) {
   return documents;
 }
 function commonsIndexDocumentId(entityId, documentType, documentKey) {
-  return `commons-index-${(0, import_node_crypto47.createHash)("sha256").update(`${entityId}
+  return `commons-index-${(0, import_node_crypto48.createHash)("sha256").update(`${entityId}
 ${documentType}
 ${documentKey}`).digest("hex").slice(0, 32)}`;
 }
@@ -74126,11 +74751,11 @@ function jsonLikeValue(value) {
 function escapeLike(value) {
   return value.replace(/[%_]/g, "");
 }
-var import_node_crypto47, COMMONS_SCHEMA_VERSION, DEFAULT_COMMONS_BASE_URL, DEFAULT_ENTITY_TYPE, COMMONS_ENTITY_PROFILES, schemaReady, COMMONS_SCHEMA_OBJECTS, SEARCH_CANDIDATE_LIMIT, CommonsRepositoryError;
+var import_node_crypto48, COMMONS_SCHEMA_VERSION, DEFAULT_COMMONS_BASE_URL, DEFAULT_ENTITY_TYPE, COMMONS_ENTITY_PROFILES, schemaReady2, COMMONS_SCHEMA_OBJECTS, SEARCH_CANDIDATE_LIMIT, CommonsRepositoryError;
 var init_commons_repository = __esm({
   "src/api/commons-repository.ts"() {
     "use strict";
-    import_node_crypto47 = require("crypto");
+    import_node_crypto48 = require("crypto");
     init_db();
     init_commons_image_store();
     init_commons_embeddings();
@@ -74285,7 +74910,7 @@ var init_commons_repository = __esm({
         ]
       }
     };
-    schemaReady = false;
+    schemaReady2 = false;
     COMMONS_SCHEMA_OBJECTS = [
       "schema_migrations",
       "commons_entities",
@@ -74509,7 +75134,7 @@ async function claimCommonsPublication(input, user) {
   }
   const existingName = await getCommonsPublicationBySubdomain(subdomain);
   if (existingName) throw new CommonsPublicationError("publication_name_unavailable", "That publication name is already claimed.", 409);
-  const id = `tcpub_${(0, import_node_crypto48.randomUUID)()}`;
+  const id = `tcpub_${(0, import_node_crypto49.randomUUID)()}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   try {
     await getDb().execute({
@@ -74561,7 +75186,7 @@ async function publishCommonsEditorial(input, user) {
   const canonicalUrl = editionPublicUrl(subdomain, editionSlug);
   const rendered = renderEditorialReadingRoom(editionInput);
   const html = addPublicMetadata(rendered.html, canonicalUrl, publication.title);
-  const editionId = `tced_${(0, import_node_crypto48.randomUUID)()}`;
+  const editionId = `tced_${(0, import_node_crypto49.randomUUID)()}`;
   const revision = (latest?.revision ?? 0) + 1;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   await getDb().batch([
@@ -74585,7 +75210,7 @@ async function publishCommonsEditorial(input, user) {
         JSON.stringify(editionInput.articles),
         html,
         rendered.filename,
-        (0, import_node_crypto48.createHash)("sha256").update(html).digest("hex"),
+        (0, import_node_crypto49.createHash)("sha256").update(html).digest("hex"),
         rendered.articleCount,
         rendered.wordCount,
         Buffer.byteLength(html),
@@ -74643,7 +75268,7 @@ async function updateCommonsEditorialArticle(input, user) {
   const canonicalUrl = editionPublicUrl(subdomain, editionSlug);
   const rendered = renderEditorialReadingRoom(editionInput);
   const html = addPublicMetadata(rendered.html, canonicalUrl, publication.title);
-  const editionId = `tced_${(0, import_node_crypto48.randomUUID)()}`;
+  const editionId = `tced_${(0, import_node_crypto49.randomUUID)()}`;
   const revision = latest.revision + 1;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   await getDb().batch([
@@ -74667,7 +75292,7 @@ async function updateCommonsEditorialArticle(input, user) {
         JSON.stringify(nextArticles),
         html,
         rendered.filename,
-        (0, import_node_crypto48.createHash)("sha256").update(html).digest("hex"),
+        (0, import_node_crypto49.createHash)("sha256").update(html).digest("hex"),
         rendered.articleCount,
         rendered.wordCount,
         Buffer.byteLength(html),
@@ -74872,11 +75497,11 @@ function addPublicMetadata(html, canonicalUrl, publicationTitle) {
     "</head>"
   ].join("\n"));
 }
-var import_node_crypto48, PUBLICATION_ROOT_DOMAIN, RESERVED_SUBDOMAINS, CommonsPublicationError;
+var import_node_crypto49, PUBLICATION_ROOT_DOMAIN, RESERVED_SUBDOMAINS, CommonsPublicationError;
 var init_commons_publication_repository = __esm({
   "src/api/commons-publication-repository.ts"() {
     "use strict";
-    import_node_crypto48 = require("crypto");
+    import_node_crypto49 = require("crypto");
     init_db();
     init_commons_repository();
     init_render();
@@ -74963,6 +75588,18 @@ function repositoryStatus(error) {
   if (error.httpStatus === 409) return 409;
   return 400;
 }
+function imageErrorResponse(c, error, chargeStatus) {
+  return c.json({
+    ok: false,
+    error: error.code,
+    error_code: error.code,
+    error_type: "invalid_request",
+    retryable: error.retryable,
+    ...chargeStatus ? { charge_status: chargeStatus } : {},
+    message: `${error.message} ${error.retryGuidance}`,
+    details: { retry_guidance: error.retryGuidance }
+  }, error.httpStatus);
+}
 async function publicationOperation(c, operation, successStatus = 200) {
   try {
     return c.json({ ok: true, data: await operation() }, successStatus);
@@ -75303,7 +75940,7 @@ var init_commons_routes = __esm({
         return c.json({ ok: true, data: hosted }, hosted.reused ? 200 : 201);
       } catch (error) {
         if (error instanceof CommonsImageError) {
-          return c.json({ ok: false, error: error.code, message: error.message }, error.httpStatus);
+          return imageErrorResponse(c, error);
         }
         throw error;
       }
@@ -75367,7 +76004,14 @@ var init_commons_routes = __esm({
         }
         return c.json({ ok: true, data: result, billing: publicListingWriteBilling(billing) }, 201);
       } catch (error) {
-        if (billing) await refundListingWrite(billing, "Transparent Commons write failed before persistence.").catch(() => null);
+        let chargeStatus = billing ? billing.duplicate ? "not_charged" : "refund_pending" : "not_charged";
+        if (billing && !billing.duplicate) {
+          const settlement = await refundListingWrite(billing, "Transparent Commons write failed before persistence.").catch(() => null);
+          if (settlement) chargeStatus = "refunded";
+        }
+        if (error instanceof CommonsImageError) {
+          return imageErrorResponse(c, error, chargeStatus);
+        }
         if (error instanceof CommonsRepositoryError) {
           return c.json({ ok: false, error: error.code, message: error.message }, repositoryStatus(error));
         }
@@ -76109,7 +76753,7 @@ async function migrateAnalytics() {
 }
 function normalizeSlug2(value) {
   const slug4 = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
-  return slug4 || `site-${(0, import_node_crypto49.randomBytes)(4).toString("hex")}`;
+  return slug4 || `site-${(0, import_node_crypto50.randomBytes)(4).toString("hex")}`;
 }
 function normalizeObservedHostname(origin) {
   if (!origin || origin === "null") return null;
@@ -76122,7 +76766,7 @@ function normalizeObservedHostname(origin) {
   }
 }
 function publicPixelId() {
-  return `px_${(0, import_node_crypto49.randomBytes)(18).toString("base64url")}`;
+  return `px_${(0, import_node_crypto50.randomBytes)(18).toString("base64url")}`;
 }
 function mapRows(rows) {
   return rows;
@@ -76154,7 +76798,7 @@ async function requireEditor(client2, siteId, userId) {
 async function createAnalyticsSite(input) {
   const db = getAnalyticsPool();
   const client2 = await db.connect();
-  const id = (0, import_node_crypto49.randomUUID)();
+  const id = (0, import_node_crypto50.randomUUID)();
   const baseSlug = normalizeSlug2(input.slug || input.name);
   try {
     await client2.query("BEGIN");
@@ -76170,7 +76814,7 @@ async function createAnalyticsSite(input) {
       } catch (error) {
         const code = error.code;
         if (code !== "23505" || attempt === 2) throw error;
-        slug4 = `${baseSlug}-${(0, import_node_crypto49.randomBytes)(2).toString("hex")}`;
+        slug4 = `${baseSlug}-${(0, import_node_crypto50.randomBytes)(2).toString("hex")}`;
       }
     }
     await client2.query(
@@ -76385,7 +77029,7 @@ async function createAnalyticsPixel(input) {
      VALUES ($1, $2, $3, $4, $5)
      RETURNING id, site_id, public_id, name, environment, status, created_at::text, NULL::text AS last_event_at`,
     [
-      (0, import_node_crypto49.randomUUID)(),
+      (0, import_node_crypto50.randomUUID)(),
       input.siteId,
       publicPixelId(),
       input.name.trim(),
@@ -76462,7 +77106,7 @@ async function setAnalyticsPixelDomainState(input) {
      SELECT $1, p.id, $4, $5 FROM analytics_pixels p WHERE p.id = $2 AND p.site_id = $3
      ON CONFLICT(pixel_id, hostname) DO UPDATE SET state = EXCLUDED.state, updated_at = now()
      RETURNING id`,
-    [(0, import_node_crypto49.randomUUID)(), input.pixelId, input.siteId, hostname, input.state]
+    [(0, import_node_crypto50.randomUUID)(), input.pixelId, input.siteId, hostname, input.state]
   );
   if (!result.rowCount)
     throw new AnalyticsRepositoryError(
@@ -76512,7 +77156,7 @@ function sanitizeAnalyticsProperties(value) {
 }
 async function ingestAnalyticsEvents(input) {
   const db = getAnalyticsPool();
-  const requestId = `air_${(0, import_node_crypto49.randomUUID)()}`;
+  const requestId = `air_${(0, import_node_crypto50.randomUUID)()}`;
   const hostname = normalizeObservedHostname(input.origin);
   const pixelResult = await db.query(
     `SELECT p.id, p.site_id, p.status,
@@ -76533,7 +77177,7 @@ async function ingestAnalyticsEvents(input) {
       `INSERT INTO analytics_ingestion_receipts(id, request_id, site_id, pixel_id, hostname, rejected_count, reason_codes)
        VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)`,
       [
-        (0, import_node_crypto49.randomUUID)(),
+        (0, import_node_crypto50.randomUUID)(),
         requestId,
         pixel?.site_id ?? null,
         pixel?.id ?? null,
@@ -76558,7 +77202,7 @@ async function ingestAnalyticsEvents(input) {
       `INSERT INTO analytics_ingestion_receipts(id, request_id, site_id, pixel_id, hostname, rejected_count, reason_codes)
        VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)`,
       [
-        (0, import_node_crypto49.randomUUID)(),
+        (0, import_node_crypto50.randomUUID)(),
         requestId,
         pixel.site_id,
         pixel.id,
@@ -76583,7 +77227,7 @@ async function ingestAnalyticsEvents(input) {
       `INSERT INTO analytics_ingestion_receipts(id, request_id, site_id, pixel_id, rejected_count, reason_codes)
        VALUES ($1, $2, $3, $4, $5, $6::jsonb)`,
       [
-        (0, import_node_crypto49.randomUUID)(),
+        (0, import_node_crypto50.randomUUID)(),
         requestId,
         pixel.site_id,
         pixel.id,
@@ -76607,7 +77251,7 @@ async function ingestAnalyticsEvents(input) {
      ON CONFLICT(pixel_id, hostname) DO UPDATE
        SET last_seen_at = now(), updated_at = now()
      RETURNING state`,
-    [(0, import_node_crypto49.randomUUID)(), pixel.id, hostname]
+    [(0, import_node_crypto50.randomUUID)(), pixel.id, hostname]
   );
   if (domainResult.rows[0]?.state !== "approved") {
     await db.query(
@@ -76621,7 +77265,7 @@ async function ingestAnalyticsEvents(input) {
       `INSERT INTO analytics_ingestion_receipts(id, request_id, site_id, pixel_id, hostname, rejected_count, reason_codes)
        VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)`,
       [
-        (0, import_node_crypto49.randomUUID)(),
+        (0, import_node_crypto50.randomUUID)(),
         requestId,
         pixel.site_id,
         pixel.id,
@@ -76671,7 +77315,7 @@ async function ingestAnalyticsEvents(input) {
              $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33
            ) ON CONFLICT(site_id, event_id) DO NOTHING`,
           [
-            (0, import_node_crypto49.randomUUID)(),
+            (0, import_node_crypto50.randomUUID)(),
             event2.eventId,
             pixel.site_id,
             pixel.id,
@@ -76729,7 +77373,7 @@ async function ingestAnalyticsEvents(input) {
          id, request_id, site_id, pixel_id, hostname, accepted_count, rejected_count, reason_codes
        ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb)`,
       [
-        (0, import_node_crypto49.randomUUID)(),
+        (0, import_node_crypto50.randomUUID)(),
         requestId,
         pixel.site_id,
         pixel.id,
@@ -76761,7 +77405,7 @@ function normalizeGeographyCode(value, max) {
   return normalized && /^[A-Z0-9-]+$/.test(normalized) ? normalized.slice(0, max) : null;
 }
 function pageFingerprint(scope, siteId, filters) {
-  return (0, import_node_crypto49.createHash)("sha256").update(JSON.stringify({ scope, siteId, filters })).digest("base64url").slice(0, 18);
+  return (0, import_node_crypto50.createHash)("sha256").update(JSON.stringify({ scope, siteId, filters })).digest("base64url").slice(0, 18);
 }
 function decodePageOffset(cursor, fingerprint2) {
   if (!cursor) return 0;
@@ -76811,7 +77455,7 @@ async function createAnalyticsConversion(input) {
         404
       );
   }
-  const id = (0, import_node_crypto49.randomUUID)();
+  const id = (0, import_node_crypto50.randomUUID)();
   const resolvedPerson = input.sessionId ? await db.query(
     `SELECT e.person_id FROM analytics_identity_nodes n JOIN analytics_identity_edges e ON e.identity_node_id = n.id
         WHERE n.site_id = $1 AND n.kind = 'session_id' AND n.value_hmac = $2 ORDER BY e.confidence DESC LIMIT 1`,
@@ -77560,7 +78204,7 @@ async function createAnalyticsCampaignLink(input) {
         404
       );
   }
-  const shortCode = (input.shortCode?.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "-") || (0, import_node_crypto49.randomBytes)(5).toString("base64url").toLowerCase()).slice(0, 48);
+  const shortCode = (input.shortCode?.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "-") || (0, import_node_crypto50.randomBytes)(5).toString("base64url").toLowerCase()).slice(0, 48);
   try {
     const result = await db.query(
       `INSERT INTO analytics_campaign_links(
@@ -77569,7 +78213,7 @@ async function createAnalyticsCampaignLink(input) {
        ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)
        RETURNING *, 0::int AS click_count`,
       [
-        (0, import_node_crypto49.randomUUID)(),
+        (0, import_node_crypto50.randomUUID)(),
         input.siteId,
         input.pixelId ?? null,
         input.name.trim(),
@@ -77640,7 +78284,7 @@ async function resolveAnalyticsCampaignLink(shortCode, referrer) {
   if (!row) return null;
   await db.query(
     `INSERT INTO analytics_campaign_clicks(id, link_id, referrer) VALUES ($1, $2, $3)`,
-    [(0, import_node_crypto49.randomUUID)(), row.id, normalizeAnalyticsUrl(referrer || void 0)]
+    [(0, import_node_crypto50.randomUUID)(), row.id, normalizeAnalyticsUrl(referrer || void 0)]
   );
   return buildTaggedCampaignUrl(row);
 }
@@ -77658,14 +78302,14 @@ async function createAnalyticsForm(input) {
       404
     );
   const baseSlug = normalizeSlug2(input.name);
-  const slug4 = `${baseSlug}-${(0, import_node_crypto49.randomBytes)(3).toString("hex")}`;
-  const publicId = `form_${(0, import_node_crypto49.randomBytes)(18).toString("base64url")}`;
+  const slug4 = `${baseSlug}-${(0, import_node_crypto50.randomBytes)(3).toString("hex")}`;
+  const publicId = `form_${(0, import_node_crypto50.randomBytes)(18).toString("base64url")}`;
   const result = await db.query(
     `INSERT INTO analytics_forms(id, public_id, site_id, pixel_id, name, slug, fields, brand, submit_label, success_message, redirect_url, consent_text, status, created_by_user_id)
      VALUES ($1,$2,$3,$4,$5,$6,$7::jsonb,$8::jsonb,$9,$10,$11,$12,$13,$14)
      RETURNING *, 0::int AS submission_count`,
     [
-      (0, import_node_crypto49.randomUUID)(),
+      (0, import_node_crypto50.randomUUID)(),
       publicId,
       input.siteId,
       input.pixelId,
@@ -77710,7 +78354,7 @@ async function getPublicAnalyticsForm(publicId) {
   return result.rows[0] ?? null;
 }
 async function recordAnalyticsFormSubmission(input) {
-  const id = (0, import_node_crypto49.randomUUID)();
+  const id = (0, import_node_crypto50.randomUUID)();
   await getAnalyticsPool().query(
     `INSERT INTO analytics_form_submissions(id, form_id, site_id, pixel_id, visitor_id, session_id, crm_person_ref, source, medium, campaign, crm_delivery_status, click_ids)
      VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12::jsonb)`,
@@ -77741,7 +78385,7 @@ function sanitizeClickIds(value) {
   return output;
 }
 function identityHmac(kind, value) {
-  return (0, import_node_crypto49.createHmac)("sha256", getSessionSecret()).update(`${kind}:${value.trim().toLowerCase()}`).digest("hex");
+  return (0, import_node_crypto50.createHmac)("sha256", getSessionSecret()).update(`${kind}:${value.trim().toLowerCase()}`).digest("hex");
 }
 async function linkAnalyticsFormIdentity(input) {
   const client2 = await getAnalyticsPool().connect();
@@ -77750,7 +78394,7 @@ async function linkAnalyticsFormIdentity(input) {
     const person = await client2.query(
       `INSERT INTO analytics_people(id, site_id, crm_person_ref) VALUES ($1,$2,$3)
        ON CONFLICT(site_id, crm_person_ref) DO UPDATE SET last_seen_at = now() RETURNING id`,
-      [(0, import_node_crypto49.randomUUID)(), input.siteId, input.crmPersonRef]
+      [(0, import_node_crypto50.randomUUID)(), input.siteId, input.crmPersonRef]
     );
     const personId = person.rows[0].id;
     const signals = [];
@@ -77797,7 +78441,7 @@ async function linkAnalyticsFormIdentity(input) {
         `INSERT INTO analytics_identity_nodes(id, site_id, kind, value_hmac) VALUES ($1,$2,$3,$4)
          ON CONFLICT(site_id, kind, value_hmac) DO UPDATE SET last_seen_at = now() RETURNING id`,
         [
-          (0, import_node_crypto49.randomUUID)(),
+          (0, import_node_crypto50.randomUUID)(),
           input.siteId,
           signal.kind,
           identityHmac(signal.kind, signal.value)
@@ -77808,7 +78452,7 @@ async function linkAnalyticsFormIdentity(input) {
          VALUES ($1,$2,$3,$4,$5,$6)
          ON CONFLICT(person_id, identity_node_id, evidence_kind) DO UPDATE SET last_seen_at = now(), confidence = greatest(analytics_identity_edges.confidence, EXCLUDED.confidence)`,
         [
-          (0, import_node_crypto49.randomUUID)(),
+          (0, import_node_crypto50.randomUUID)(),
           input.siteId,
           personId,
           node.rows[0].id,
@@ -77906,7 +78550,7 @@ async function createAnalyticsCrmImport(input) {
   const db = getAnalyticsPool();
   await requireEditor(db, input.siteId, input.userId);
   const client2 = await db.connect();
-  const id = (0, import_node_crypto49.randomUUID)();
+  const id = (0, import_node_crypto50.randomUUID)();
   try {
     await client2.query("BEGIN");
     await client2.query(
@@ -77926,7 +78570,7 @@ async function createAnalyticsCrmImport(input) {
       await client2.query(
         `INSERT INTO analytics_crm_import_rows(id, import_id, crm_person_ref, payload_ciphertext)
          VALUES ($1,$2,$3,$4) ON CONFLICT(import_id, crm_person_ref) DO NOTHING`,
-        [(0, import_node_crypto49.randomUUID)(), id, row.crmPersonRef, row.payloadCiphertext]
+        [(0, import_node_crypto50.randomUUID)(), id, row.crmPersonRef, row.payloadCiphertext]
       );
     }
     await client2.query("COMMIT");
@@ -77965,7 +78609,7 @@ async function createAnalyticsActivationDestination(input) {
     `INSERT INTO analytics_activation_destinations(id, site_id, platform, name, connection_ref, external_dataset_id, event_mapping, created_by_user_id)
      VALUES ($1,$2,$3,$4,$5,$6,$7::jsonb,$8) RETURNING *`,
     [
-      (0, import_node_crypto49.randomUUID)(),
+      (0, import_node_crypto50.randomUUID)(),
       input.siteId,
       input.platform,
       input.name.trim(),
@@ -78017,7 +78661,7 @@ async function queueAnalyticsActivation(input) {
       `INSERT INTO analytics_activation_jobs(id, destination_id, conversion_id, person_id, payload_ciphertext)
        VALUES ($1,$2,$3,$4,$5) ON CONFLICT(destination_id, conversion_id) DO NOTHING`,
       [
-        (0, import_node_crypto49.randomUUID)(),
+        (0, import_node_crypto50.randomUUID)(),
         destination.id,
         input.conversionId,
         input.personId ?? null,
@@ -78029,7 +78673,7 @@ async function queueAnalyticsActivation(input) {
   return queued;
 }
 async function queueAnalyticsFormDelivery(input) {
-  const id = (0, import_node_crypto49.randomUUID)();
+  const id = (0, import_node_crypto50.randomUUID)();
   await getAnalyticsPool().query(
     `INSERT INTO analytics_form_delivery_jobs(id, submission_id, owner_user_id, payload_ciphertext, last_error_code)
      VALUES ($1,$2,$3,$4,$5)`,
@@ -78156,7 +78800,7 @@ async function analyticsHealth(siteId, userId) {
 }
 async function refreshAnalyticsDailyRollups(input) {
   const db = getAnalyticsPool();
-  const runId = (0, import_node_crypto49.randomUUID)();
+  const runId = (0, import_node_crypto50.randomUUID)();
   await db.query(
     `INSERT INTO analytics_rollup_runs(id, window_start, window_end, status) VALUES ($1, $2, $3, 'running')`,
     [runId, input.start, input.end]
@@ -78353,7 +78997,7 @@ async function createAnalyticsExport(input) {
       `Generated ${(/* @__PURE__ */ new Date()).toISOString()} from the governed ${input.report} report contract.`
     ].join("\n");
   }
-  const id = (0, import_node_crypto49.randomUUID)();
+  const id = (0, import_node_crypto50.randomUUID)();
   const inserted = await getAnalyticsPool().query(
     `INSERT INTO analytics_exports(id, site_id, requested_by_user_id, idempotency_key, report, format, filters, content)
      VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8)
@@ -78386,11 +79030,11 @@ async function createAnalyticsExport(input) {
   }
   return describeArtifact(replay.rows[0]);
 }
-var import_node_crypto49, import_pg, AnalyticsRepositoryError, pool2, MAX_ENGAGED_MS, ENGAGED_SESSION_MS, blockedPropertyName, inferredFamilySql, ANALYTICS_CONTENT_SORTS, clickIdKeys;
+var import_node_crypto50, import_pg, AnalyticsRepositoryError, pool2, MAX_ENGAGED_MS, ENGAGED_SESSION_MS, blockedPropertyName, inferredFamilySql, ANALYTICS_CONTENT_SORTS, clickIdKeys;
 var init_analytics_repository = __esm({
   "src/api/analytics-repository.ts"() {
     "use strict";
-    import_node_crypto49 = require("crypto");
+    import_node_crypto50 = require("crypto");
     import_pg = require("pg");
     init_session();
     init_analytics_attribution();
@@ -78629,8 +79273,8 @@ function dashboardCallbackUrl() {
 }
 async function createThorbitConnectUrl(userId) {
   if (!bridgeConfigured()) throw new Error("Thorbit X-Ray account bridge is not configured");
-  const state = (0, import_node_crypto50.randomBytes)(32).toString("base64url");
-  const stateHash = (0, import_node_crypto50.createHash)("sha256").update(state).digest("hex");
+  const state = (0, import_node_crypto51.randomBytes)(32).toString("base64url");
+  const stateHash = (0, import_node_crypto51.createHash)("sha256").update(state).digest("hex");
   await getAnalyticsPool().query(
     `INSERT INTO analytics_thorbit_connect_states(state_hash,user_id,expires_at)
      VALUES ($1,$2,now()+interval '10 minutes')
@@ -78645,9 +79289,9 @@ async function createThorbitConnectUrl(userId) {
 function verifyThorbitAssertion(token6) {
   const [encoded, signature] = token6.split(".");
   if (!encoded || !signature || !bridgeConfigured()) throw new Error("Invalid Thorbit assertion");
-  const expected = (0, import_node_crypto50.createHmac)("sha256", bridgeSecret()).update(encoded).digest();
+  const expected = (0, import_node_crypto51.createHmac)("sha256", bridgeSecret()).update(encoded).digest();
   const actual = Buffer.from(signature, "base64url");
-  if (actual.length !== expected.length || !(0, import_node_crypto50.timingSafeEqual)(actual, expected)) {
+  if (actual.length !== expected.length || !(0, import_node_crypto51.timingSafeEqual)(actual, expected)) {
     throw new Error("Invalid Thorbit assertion signature");
   }
   const parsed = AssertionSchema.safeParse(
@@ -78659,7 +79303,7 @@ function verifyThorbitAssertion(token6) {
   return parsed.data.entitlement;
 }
 async function consumeThorbitConnectCallback(input) {
-  const stateHash = (0, import_node_crypto50.createHash)("sha256").update(input.state).digest("hex");
+  const stateHash = (0, import_node_crypto51.createHash)("sha256").update(input.state).digest("hex");
   const client2 = await getAnalyticsPool().connect();
   try {
     await client2.query("BEGIN");
@@ -78699,11 +79343,11 @@ async function disconnectAnalyticsEntitlement(userId) {
     [userId]
   );
 }
-var import_node_crypto50, import_zod55, THORBIT_PRODUCT_URL, REFRESH_INTERVAL_MS, ELIGIBLE_GRACE_MS, TRIAL_LENGTH_MS, ThorbitEntitlementSchema, AssertionSchema;
+var import_node_crypto51, import_zod55, THORBIT_PRODUCT_URL, REFRESH_INTERVAL_MS, ELIGIBLE_GRACE_MS, TRIAL_LENGTH_MS, ThorbitEntitlementSchema, AssertionSchema;
 var init_analytics_entitlement = __esm({
   "src/api/analytics-entitlement.ts"() {
     "use strict";
-    import_node_crypto50 = require("crypto");
+    import_node_crypto51 = require("crypto");
     import_zod55 = require("zod");
     init_analytics_repository();
     THORBIT_PRODUCT_URL = "https://thorbit.ai";
@@ -78843,14 +79487,14 @@ function renderPublicForm(form, placementUrl) {
   const brand = form.brand;
   return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><style>:root{font-family:ui-sans-serif,system-ui;color:${escapeHtml8(brand.textColor)};background:${escapeHtml8(brand.backgroundColor)}}*{box-sizing:border-box}body{margin:0;padding:18px}form{display:grid;gap:14px}label{display:grid;gap:6px;font-size:13px;font-weight:650}.check{grid-template-columns:auto 1fr;align-items:center}.check span{grid-column:2}.check input{grid-column:1;grid-row:1}input,textarea,select{width:100%;min-height:44px;padding:10px 12px;border:1px solid #ccd3df;border-radius:${brand.radius}px;background:white;color:inherit;font:inherit}textarea{min-height:110px;resize:vertical}button{min-height:46px;border:0;border-radius:${brand.radius}px;color:white;background:${escapeHtml8(brand.primaryColor)};font:inherit;font-weight:750;cursor:pointer}.consent{margin:0;color:#667085;font-size:11px;line-height:1.45}.notice{display:none;padding:12px;border-radius:${brand.radius}px;background:#edf8f2;color:#17613c}.hp{position:absolute!important;left:-9999px!important}</style></head><body><form id="mcp-form">${fields}<label class="hp">Website<input name="website" autocomplete="off" tabindex="-1"></label>${form.consent_text ? `<p class="consent">${escapeHtml8(form.consent_text)}</p>` : ""}<button>${escapeHtml8(form.submit_label)}</button><div class="notice" role="status"></div></form><script>(()=>{const form=document.querySelector('#mcp-form'),notice=form.querySelector('.notice'),q=new URLSearchParams(location.search);form.addEventListener('submit',async event=>{event.preventDefault();const button=form.querySelector('button');button.disabled=true;const raw=Object.fromEntries(new FormData(form).entries()),website=String(raw.website||''),clickIds={};delete raw.website;for(const k of ['fbclid','gclid','gbraid','wbraid','ttclid','rdt_cid','msclkid']){const v=q.get(k);if(v)clickIds[k]=v}try{const response=await fetch('/analytics/forms/${escapeHtml8(form.public_id)}/submissions',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({data:raw,website,placementUrl:${JSON.stringify(placementUrl)},visitorId:q.get('visitor')||undefined,sessionId:q.get('session')||undefined,source:q.get('source')||undefined,medium:q.get('medium')||undefined,campaign:q.get('campaign')||undefined,clickIds})});if(!response.ok)throw new Error('submit');notice.textContent=${JSON.stringify(form.success_message)};notice.style.display='block';form.reset();${form.redirect_url ? `setTimeout(()=>{top.location.href=${JSON.stringify(form.redirect_url)}},700);` : ""}}catch{notice.textContent='Your response could not be submitted. Please try again.';notice.style.display='block'}finally{button.disabled=false}})})()</script></body></html>`;
 }
-var import_hono34, import_factory6, import_zod56, import_node_crypto51, import_papaparse6, analyticsApp, auth3, entitlementGuard, ThorbitApiKeySchema, ThorbitCallbackSchema, SiteInputSchema, PixelInputSchema, PixelUpdateSchema, EventSchema, IngestionSchema, ConversionSchema, ExportSchema2, CampaignLinkSchema, FormFieldSchema, FormInputSchema, FormSubmissionSchema, CrmImportSchema, ActivationDestinationSchema, BusinessModelSchema, AdSpendSchema;
+var import_hono34, import_factory6, import_zod56, import_node_crypto52, import_papaparse6, analyticsApp, auth3, entitlementGuard, ThorbitApiKeySchema, ThorbitCallbackSchema, SiteInputSchema, PixelInputSchema, PixelUpdateSchema, EventSchema, IngestionSchema, ConversionSchema, ExportSchema2, CampaignLinkSchema, FormFieldSchema, FormInputSchema, FormSubmissionSchema, CrmImportSchema, ActivationDestinationSchema, BusinessModelSchema, AdSpendSchema;
 var init_analytics_routes = __esm({
   "src/api/analytics-routes.ts"() {
     "use strict";
     import_hono34 = require("hono");
     import_factory6 = require("hono/factory");
     import_zod56 = require("zod");
-    import_node_crypto51 = require("crypto");
+    import_node_crypto52 = require("crypto");
     import_papaparse6 = __toESM(require("papaparse"), 1);
     init_api_auth();
     init_db();
@@ -79181,7 +79825,7 @@ var init_analytics_routes = __esm({
       const lastName = typeof data.last_name === "string" ? data.last_name.trim() : "";
       const fullName = [firstName, lastName].filter(Boolean).join(" ") || (typeof data.name === "string" ? data.name.trim() : "") || email || "Website lead";
       const identitySeed = email || `${fullName}:${Date.now()}`;
-      const suffix2 = (0, import_node_crypto51.createHash)("sha256").update(identitySeed).digest("hex").slice(0, 12);
+      const suffix2 = (0, import_node_crypto52.createHash)("sha256").update(identitySeed).digest("hex").slice(0, 12);
       const path6 = `Leads/person-${suffix2}`;
       const { key: memoryKey, error: memoryKeyError } = await getOrCreateUserMemoryKey(user);
       const existing = memoryKey ? await memoryCall("getTool", { vault: "People", path: path6 }, memoryKey) : { ok: false, error: memoryKeyError || "memory_credential_unavailable" };
@@ -79280,9 +79924,9 @@ Submitted the published form.
         occurredAt: (/* @__PURE__ */ new Date()).toISOString()
       });
       const match = {
-        ...email ? { emailSha256: (0, import_node_crypto51.createHash)("sha256").update(email).digest("hex") } : {},
+        ...email ? { emailSha256: (0, import_node_crypto52.createHash)("sha256").update(email).digest("hex") } : {},
         ...phone ? {
-          phoneSha256: (0, import_node_crypto51.createHash)("sha256").update(phone.replace(/\D/g, "")).digest("hex")
+          phoneSha256: (0, import_node_crypto52.createHash)("sha256").update(phone.replace(/\D/g, "")).digest("hex")
         } : {}
       };
       const activationQueued = await queueAnalyticsActivation({
@@ -79710,7 +80354,7 @@ Submitted the published form.
           rejectedCount += 1;
           continue;
         }
-        const digest2 = (0, import_node_crypto51.createHash)("sha256").update(
+        const digest2 = (0, import_node_crypto52.createHash)("sha256").update(
           `${parsed.data.sourceSystem}:${externalId || email || phone || `${fullName}:${index}`}`
         ).digest("hex").slice(0, 16);
         const path6 = `Leads/person-${digest2}`;
@@ -80168,19 +80812,19 @@ var init_analytics_delivery = __esm({
 
 // src/api/scheduled-artifact-owner.ts
 function scheduledArtifactOwnerIdForApiKey(apiKey) {
-  return (0, import_node_crypto52.createHash)("sha256").update(apiKey).digest("hex").slice(0, 24);
+  return (0, import_node_crypto53.createHash)("sha256").update(apiKey).digest("hex").slice(0, 24);
 }
-var import_node_crypto52;
+var import_node_crypto53;
 var init_scheduled_artifact_owner = __esm({
   "src/api/scheduled-artifact-owner.ts"() {
     "use strict";
-    import_node_crypto52 = require("crypto");
+    import_node_crypto53 = require("crypto");
   }
 });
 
 // src/api/scheduled-run-view-links.ts
 async function ensureScheduledRunViewLinksSchema() {
-  if (schemaReady2) return;
+  if (schemaReady3) return;
   const db = getDb();
   await db.execute(`
     CREATE TABLE IF NOT EXISTS scheduled_run_view_links (
@@ -80228,10 +80872,10 @@ async function ensureScheduledRunViewLinksSchema() {
     CREATE INDEX IF NOT EXISTS scheduled_run_view_links_expiry
     ON scheduled_run_view_links(expires_at, revoked_at)
   `);
-  schemaReady2 = true;
+  schemaReady3 = true;
 }
 function tokenHash2(token6) {
-  return (0, import_node_crypto53.createHash)("sha256").update(token6).digest("hex");
+  return (0, import_node_crypto54.createHash)("sha256").update(token6).digest("hex");
 }
 function mapRow(row) {
   return {
@@ -80251,9 +80895,9 @@ function mapRow(row) {
 async function createScheduledRunViewLink(input) {
   await ensureScheduledRunViewLinksSchema();
   const now = input.now ?? /* @__PURE__ */ new Date();
-  const token6 = (0, import_node_crypto53.randomBytes)(32).toString("base64url");
+  const token6 = (0, import_node_crypto54.randomBytes)(32).toString("base64url");
   const record = {
-    shareId: (0, import_node_crypto53.randomUUID)(),
+    shareId: (0, import_node_crypto54.randomUUID)(),
     ownerId: input.ownerId,
     runId: input.runId,
     artifactId: input.artifactId,
@@ -80316,13 +80960,13 @@ async function revokeScheduledRunViewLink(ownerId2, runId, shareId, now = /* @__
   });
   return result.rowsAffected > 0;
 }
-var import_node_crypto53, schemaReady2;
+var import_node_crypto54, schemaReady3;
 var init_scheduled_run_view_links = __esm({
   "src/api/scheduled-run-view-links.ts"() {
     "use strict";
-    import_node_crypto53 = require("crypto");
+    import_node_crypto54 = require("crypto");
     init_db();
-    schemaReady2 = false;
+    schemaReady3 = false;
   }
 });
 
@@ -80386,15 +81030,15 @@ ${section(flags.finalCta && Boolean(finalCta), `<section class="section cta" id=
     html,
     filename: `${input.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "personal-authority"}.html`,
     bytes,
-    sha256: (0, import_node_crypto54.createHash)("sha256").update(html).digest("hex"),
+    sha256: (0, import_node_crypto55.createHash)("sha256").update(html).digest("hex"),
     generatedAt: generatedAtIso
   };
 }
-var import_node_crypto54;
+var import_node_crypto55;
 var init_render2 = __esm({
   "src/personal-authority/render.ts"() {
     "use strict";
-    import_node_crypto54 = require("crypto");
+    import_node_crypto55 = require("crypto");
   }
 });
 
@@ -80497,15 +81141,15 @@ ${section2(flags.finalCta && Boolean(finalCta), `<section class="section cta" id
     html,
     filename: `${input.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "personal-authority"}.html`,
     bytes,
-    sha256: (0, import_node_crypto55.createHash)("sha256").update(html).digest("hex"),
+    sha256: (0, import_node_crypto56.createHash)("sha256").update(html).digest("hex"),
     generatedAt: generatedAtIso
   };
 }
-var import_node_crypto55, FONT_STACKS;
+var import_node_crypto56, FONT_STACKS;
 var init_render_v2 = __esm({
   "src/personal-authority/render-v2.ts"() {
     "use strict";
-    import_node_crypto55 = require("crypto");
+    import_node_crypto56 = require("crypto");
     init_contracts();
     FONT_STACKS = Object.freeze({
       "editorial-serif": "Iowan Old Style, Baskerville, Times New Roman, serif",
@@ -80621,15 +81265,15 @@ body{overflow-x:hidden}.lead-story__body,.lead-support__item,.story-card__body{m
 @media(max-width:620px){.desk-section__grid--panorama,.desk-section__grid--mosaic,.desk-section__grid--tiles{grid-template-columns:1fr}.story-card--panorama{display:block}.story-card--panorama h3,.story-card--mosaic-lead h3{font-size:34px}.story-card--mosaic-lead{grid-column:auto;grid-row:auto}.desk-section__grid--tiles>.story-card:nth-child(3n+2){margin-top:0}}
 </style></head><body data-theme="${escapeHtml11(config.theme)}" id="top" data-scheduled-renderer="newsroom_publisher_v1">${ticker}${masthead}${navigation}<main>${leadGrid}${latest}${sections}${newsletter}${pressRoom}${trustCenter}</main>${trustFooter}</body></html>`;
   const bytes = Buffer.byteLength(html);
-  const sha2565 = (0, import_node_crypto56.createHash)("sha256").update(html).digest("hex");
+  const sha2565 = (0, import_node_crypto57.createHash)("sha256").update(html).digest("hex");
   const filename2 = `${brand.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "newsroom"}-news-site.html`;
   return { html, filename: filename2, bytes, sha256: sha2565, generatedAt: generatedAtIso };
 }
-var import_node_crypto56;
+var import_node_crypto57;
 var init_render3 = __esm({
   "src/newsroom-publisher/render.ts"() {
     "use strict";
-    import_node_crypto56 = require("crypto");
+    import_node_crypto57 = require("crypto");
   }
 });
 
@@ -80721,7 +81365,7 @@ function renderBlogArticleV1(input, config, generatedAt) {
 :root{--ink:#10213d;--ink2:#1c355a;--blue:#2563eb;--blue2:#1749b6;--mint:#45d5aa;--paper:#f7f5f0;--line:#dce4ef;--card:#fff;--body:#475569;--serif:Iowan Old Style,Palatino Linotype,Palatino,Georgia,serif;--sans:Inter,Avenir Next,ui-sans-serif,system-ui,sans-serif}body[data-theme="slate"]{--ink:#1e293b;--ink2:#334155;--blue:#475569;--blue2:#1e293b;--mint:#94a3b8;--paper:#f8fafc}body[data-theme="forest"]{--ink:#12352e;--ink2:#23584c;--blue:#147d64;--blue2:#0c5b48;--mint:#79d8bd;--paper:#f4f8f3}*{box-sizing:border-box}html{scroll-behavior:smooth;background:var(--paper)}body{margin:0;color:#252a33;background:var(--paper);font-family:var(--sans);line-height:1.6}a{color:inherit}button{font:inherit}button:focus-visible,a:focus-visible{outline:3px solid var(--mint);outline-offset:3px}.progress{position:fixed;z-index:50;top:0;left:0;height:4px;width:0;background:var(--mint)}.hero{position:relative;overflow:hidden;color:#fff;background:var(--ink)}.hero:after{position:absolute;right:-110px;top:-150px;width:420px;height:420px;border:1px solid #ffffff1a;border-radius:50%;content:""}.hero-inner{position:relative;z-index:1;max-width:1240px;margin:auto;padding:58px 42px 126px}.breadcrumb{display:flex;gap:8px;margin-bottom:34px;color:#dbeafecc;font-size:14px}.eyebrow{display:block;color:var(--blue);font-size:12px;font-weight:800;letter-spacing:.16em;text-transform:uppercase}.hero .eyebrow{color:var(--mint)}h1,h2,h3,p{margin-top:0}.hero h1{max-width:1000px;margin:14px 0 24px;font:700 clamp(44px,6vw,78px)/.98 var(--serif);letter-spacing:-.035em}.hero .dek{max-width:780px;color:#dbeafe;font-size:20px}.contributors{margin-top:30px;color:#eff6ff;font-size:14px}.contributors a{font-weight:800}.meta{display:flex;flex-wrap:wrap;gap:12px;margin-top:6px;color:#dbeafecc}.layout{position:relative;z-index:2;display:grid;grid-template-columns:minmax(0,760px) 290px;gap:64px;max-width:1240px;margin:-78px auto 0;padding:0 42px 80px}.main{min-width:0}.takeaways{padding:38px 44px;border-radius:24px;background:#fff;box-shadow:0 24px 70px #10213d24}.takeaways h2{margin:5px 0 20px;font:700 32px/1.1 var(--serif);color:var(--ink)}.takeaways ul{display:grid;gap:16px;margin:0;padding:0;list-style:none}.takeaways li{position:relative;padding-left:26px;color:var(--body);font-size:17px}.takeaways li:before{position:absolute;left:2px;top:.7em;width:8px;height:8px;border-radius:50%;background:var(--blue);content:""}.intro{padding:40px 0 4px}.intro p,.article-section>p{margin-bottom:22px;color:var(--body);font:400 18px/1.75 var(--sans)}.article-section{scroll-margin-top:28px;padding-top:45px}.article-section h2,.faq h2{margin:6px 0 20px;color:var(--ink);font:700 38px/1.08 var(--serif);letter-spacing:-.02em}.article-section ul{display:grid;gap:10px;margin:22px 0;padding-left:24px;color:var(--body);font-size:17px}.article-section li::marker{color:var(--blue)}.callout{margin:34px 0;padding:24px 28px;border-left:4px solid var(--blue);border-radius:0 16px 16px 0;background:#fff}.callout span{color:var(--blue);font-size:11px;font-weight:800;letter-spacing:.13em;text-transform:uppercase}.callout h3{margin:5px 0 8px;color:var(--ink);font:700 24px/1.15 var(--serif)}.callout p{margin:0;color:var(--body)}.rail{padding-top:0}.sidebar-media{overflow:hidden;margin:0 0 18px;border:1px solid #dbeafe;border-radius:16px;background:#fff}.sidebar-media img,.sidebar-media svg{display:block;width:100%;aspect-ratio:16/9;object-fit:cover}.sidebar-media figcaption{padding:10px 13px;color:#64748b;font-size:11px}.disclosure{margin-bottom:28px;border-top:1px solid #dbeafe;border-bottom:1px solid #dbeafe}.disclosure button{display:flex;width:100%;align-items:center;justify-content:space-between;gap:14px;padding:15px 0;border:0;color:#64748b;background:transparent;text-align:left;font-size:12px;cursor:pointer}.disclosure button b{color:var(--blue);font-size:18px;transition:transform .2s}.disclosure button[aria-expanded="true"] b{transform:rotate(180deg)}.disclosure p{padding:0 0 16px;margin:0;color:#64748b;font-size:12px}.toc{position:sticky;top:30px;padding:22px;border:1px solid var(--line);border-radius:16px;background:#fff;box-shadow:0 2px 5px #10213d12}.toc header{display:flex;align-items:center;justify-content:space-between}.toc header strong{color:var(--ink);font:700 21px/1 var(--serif)}.toc header button{width:34px;height:34px;border:0;border-radius:50%;color:var(--blue);background:transparent;cursor:pointer}.toc nav{display:grid;margin-top:14px}.toc nav a{display:flex;align-items:flex-start;gap:11px;padding:8px 0;color:#64748b;text-decoration:none;font-size:13px;line-height:1.35}.toc nav i{width:8px;height:8px;margin-top:5px;border:2px solid #bfdbfe;border-radius:50%}.toc nav a[aria-current="location"]{color:var(--ink);font-weight:800}.toc nav a[aria-current="location"] i{border-color:var(--blue);background:var(--blue)}.back-top{width:100%;margin-top:18px;padding:16px 0 0;border:0;border-top:1px solid var(--line);color:var(--blue);background:transparent;text-align:right;font-size:13px;font-weight:800;cursor:pointer}.faq{scroll-margin-top:28px;padding-top:64px}.faq>div{border-top:1px solid var(--line);border-bottom:1px solid var(--line)}.faq article+article{border-top:1px solid var(--line)}.faq h3{margin:0}.faq h3 button{display:flex;width:100%;align-items:center;justify-content:space-between;gap:18px;padding:19px 0;border:0;color:var(--ink);background:transparent;text-align:left;font-weight:800;cursor:pointer}.faq h3 b{color:var(--blue);font-size:22px}.faq article>p{padding:0 0 20px;margin:0;color:var(--body);font-size:16px}.author-card{margin-top:64px;padding:32px 36px;border-radius:18px;background:#fff}.article-actions{display:flex;flex-wrap:wrap;justify-content:space-between;gap:14px}.article-actions button{display:inline-flex;min-height:46px;align-items:center;justify-content:center;gap:8px;padding:8px 18px;border:2px solid var(--blue);border-radius:999px;color:var(--ink);background:#fff;font-weight:800;cursor:pointer}.article-actions button:hover{color:#fff;background:var(--blue)}.action-status{min-height:20px;margin:8px 0 0;color:var(--blue);text-align:right;font-size:13px;font-weight:700}.author-grid{display:grid;grid-template-columns:auto 1fr auto;gap:22px;align-items:center;margin-top:24px}.author-portrait{width:88px;height:88px;border-radius:50%;object-fit:cover}.author-initials{display:grid;place-items:center;color:var(--ink);background:#fecdd3;font-size:22px;font-weight:900}.author-grid span{color:#64748b;font-size:13px}.author-grid h2{margin:2px 0;color:var(--ink);font:700 27px/1 var(--serif)}.author-grid h2 a{text-decoration:none}.author-grid p{margin:8px 0;color:#64748b;font-size:14px}.author-grid nav{display:flex;flex-wrap:wrap;gap:14px}.author-grid nav a{color:#64748b;font-size:12px}.author-more{display:inline-flex;min-height:48px;align-items:center;justify-content:center;padding:10px 24px;border:2px solid var(--blue);color:var(--blue);text-align:center;text-decoration:none;font-size:13px;font-weight:800}.author-bio{margin:24px 0 0!important;padding-top:20px;border-top:1px solid var(--line);color:var(--body);font-size:16px}dialog{width:min(720px,calc(100% - 30px));max-height:calc(100dvh - 30px);padding:0;border:0;border-radius:18px;color:var(--ink);background:#fff;box-shadow:0 24px 70px #10213d38}dialog::backdrop{background:#0f172a7a;backdrop-filter:blur(2px)}dialog>div{position:relative;padding:30px}dialog h2{margin:0 50px 2px 0;font:700 30px/1.1 var(--serif)}dialog>div>p{color:#64748b}.dialog-close{position:absolute;top:13px;right:13px;width:44px;height:44px;border:0;border-radius:50%;color:var(--blue);background:transparent;font-size:29px;cursor:pointer}dialog section{border-top:1px solid var(--line)}dialog section button{display:block;width:100%;padding:17px 5px;border:0;border-bottom:1px solid var(--line);color:var(--body);background:#fff;text-align:left;line-height:1.65;cursor:pointer}.citation-status{min-height:22px;margin:14px 0 0!important;color:var(--blue)!important;font-size:13px;font-weight:800}.generated{max-width:1156px;margin:-52px auto 50px;padding:0 42px;color:#94a3b8;font-size:11px}@media(max-width:900px){.layout{display:block}.rail{display:none}.hero-inner{padding-bottom:116px}}@media(max-width:620px){.hero-inner{padding:36px 20px 104px}.hero h1{font-size:46px}.hero .dek{font-size:17px}.layout{margin-top:-70px;padding:0 16px 54px}.takeaways{padding:28px 24px}.article-section h2,.faq h2{font-size:32px}.author-card{padding:24px}.article-actions{display:grid;justify-content:start}.author-grid{grid-template-columns:1fr;gap:12px}.author-more{width:100%}dialog>div{padding:24px}.generated{padding:0 20px}}
 </style></head><body data-theme="${escapeHtml12(config.theme)}" data-scheduled-renderer="blog_article_v1"><div class="progress" aria-hidden="true"></div><header class="hero"><div class="hero-inner"><nav class="breadcrumb" aria-label="Breadcrumb"><a href="${safeHref4(input.canonicalUrl)}">${escapeHtml12(input.category)}</a><span>/</span><span>Article</span></nav><span class="eyebrow">${escapeHtml12(input.eyebrow)}</span><h1>${escapeHtml12(input.title)}</h1>${input.dek ? `<p class="dek">${escapeHtml12(input.dek)}</p>` : ""}<div class="contributors">${contributorText}<div class="meta"><time datetime="${escapeHtml12(articleDate)}">Updated ${formatDate2(articleDate)}</time><span>\u2022</span><span>${input.readTimeMinutes} min read</span>${input.reviewer ? "<span>\u2022</span><strong>Expert reviewed</strong>" : ""}</div></div></div></header><main class="layout"><article class="main"><section class="takeaways"><span class="eyebrow">The short answer</span><h2>Key takeaways</h2><ul>${input.keyTakeaways.map((item) => `<li>${escapeHtml12(item)}</li>`).join("")}</ul></section><section class="intro">${input.introduction.map((paragraph) => `<p>${escapeHtml12(paragraph)}</p>`).join("")}</section>${sections}${faq}${author}</article><div class="rail">${media}${disclosure}${toc}</div></main>${config.showGeneratedAt ? `<p class="generated">Rendered ${formatDate2(generatedAtIso)} by MCP Scraper.</p>` : ""}${citationDialog}<script>(()=>{const citations=${jsonForScript(citationValues)};const canonical=${jsonForScript(input.canonicalUrl)};const title=${jsonForScript(input.title)};const progress=document.querySelector('.progress');const tocLinks=[...document.querySelectorAll('.toc nav a')];const targets=tocLinks.map(link=>document.querySelector(link.hash)).filter(Boolean);const update=()=>{const max=document.documentElement.scrollHeight-innerHeight;if(progress)progress.style.width=(max>0?scrollY/max*100:0)+'%';let active=targets[0]?.id;for(const target of targets){if(target.getBoundingClientRect().top<=innerHeight*.55)active=target.id}tocLinks.forEach(link=>link.toggleAttribute('aria-current',link.hash==='#'+active));tocLinks.forEach(link=>{if(link.hash==='#'+active)link.setAttribute('aria-current','location');else link.removeAttribute('aria-current')})};addEventListener('scroll',update,{passive:true});addEventListener('resize',update);update();document.querySelectorAll('.faq h3 button').forEach(button=>button.addEventListener('click',()=>{const panel=document.getElementById(button.getAttribute('aria-controls'));const open=button.getAttribute('aria-expanded')==='true';button.setAttribute('aria-expanded',String(!open));panel.hidden=open;button.querySelector('b').textContent=open?'+':'\u2212'}));const disclosure=document.querySelector('.disclosure button');disclosure?.addEventListener('click',()=>{const panel=document.getElementById(disclosure.getAttribute('aria-controls'));const open=disclosure.getAttribute('aria-expanded')==='true';disclosure.setAttribute('aria-expanded',String(!open));panel.hidden=open});const tocToggle=document.querySelector('.toc header button');tocToggle?.addEventListener('click',()=>{const nav=document.getElementById('toc-links');const open=tocToggle.getAttribute('aria-expanded')==='true';tocToggle.setAttribute('aria-expanded',String(!open));nav.hidden=open;tocToggle.textContent=open?'\u2304':'\u2303'});document.querySelector('.back-top')?.addEventListener('click',()=>scrollTo({top:0,behavior:'smooth'}));const copy=async text=>{try{await navigator.clipboard.writeText(text)}catch{const area=document.createElement('textarea');area.value=text;area.style.position='fixed';area.style.opacity='0';document.body.append(area);area.select();document.execCommand('copy');area.remove()}};const dialog=document.getElementById('citation-dialog');document.querySelector('[data-cite]')?.addEventListener('click',()=>dialog.showModal());document.querySelector('.dialog-close')?.addEventListener('click',()=>dialog.close());dialog?.addEventListener('click',event=>{if(event.target===dialog)dialog.close()});document.querySelectorAll('[data-citation]').forEach(button=>button.addEventListener('click',async()=>{const style=button.dataset.citation;await copy(citations[style]);document.querySelector('.citation-status').textContent=style+' citation copied to clipboard.'}));document.querySelector('[data-share]')?.addEventListener('click',async()=>{const status=document.querySelector('.action-status');if(navigator.share){try{await navigator.share({title,url:canonical});status.textContent='Sharing options opened.';return}catch(error){if(error.name==='AbortError')return}}await copy(canonical);status.textContent='Article link copied to clipboard.'})})()</script></body></html>`;
   const bytes = Buffer.byteLength(html);
-  const sha2565 = (0, import_node_crypto57.createHash)("sha256").update(html).digest("hex");
+  const sha2565 = (0, import_node_crypto58.createHash)("sha256").update(html).digest("hex");
   return {
     html,
     filename: "blog-article.html",
@@ -80731,11 +81375,11 @@ function renderBlogArticleV1(input, config, generatedAt) {
     generatedAt: generatedAtIso
   };
 }
-var import_node_crypto57;
+var import_node_crypto58;
 var init_render4 = __esm({
   "src/blog-article/render.ts"() {
     "use strict";
-    import_node_crypto57 = require("crypto");
+    import_node_crypto58 = require("crypto");
   }
 });
 
@@ -81066,7 +81710,7 @@ function policy6() {
   };
 }
 function runStorageSegment(runId) {
-  return /^[a-zA-Z0-9_-]{1,160}$/.test(runId) ? runId : `run-${(0, import_node_crypto58.createHash)("sha256").update(runId).digest("hex").slice(0, 32)}`;
+  return /^[a-zA-Z0-9_-]{1,160}$/.test(runId) ? runId : `run-${(0, import_node_crypto59.createHash)("sha256").update(runId).digest("hex").slice(0, 32)}`;
 }
 async function createScheduledRunArtifact(args) {
   if (args.rendered.bytes > SCHEDULED_RUN_ARTIFACT_MAX_BYTES) {
@@ -81107,12 +81751,12 @@ async function readScheduledRunArtifact(args) {
   if (!window2 || window2.nextOffset !== null || window2.totalBytes > SCHEDULED_RUN_ARTIFACT_MAX_BYTES) return null;
   return window2.text;
 }
-var import_node_crypto58, SCHEDULED_RUN_ARTIFACT_PREFIX, SCHEDULED_RUN_ARTIFACT_DOWNLOAD_TTL_MS, SCHEDULED_RUN_ARTIFACT_MAX_BYTES;
+var import_node_crypto59, SCHEDULED_RUN_ARTIFACT_PREFIX, SCHEDULED_RUN_ARTIFACT_DOWNLOAD_TTL_MS, SCHEDULED_RUN_ARTIFACT_MAX_BYTES;
 var init_scheduled_run_artifact_store = __esm({
   "src/scheduled-artifacts/scheduled-run-artifact-store.ts"() {
     "use strict";
     init_private_artifacts();
-    import_node_crypto58 = require("crypto");
+    import_node_crypto59 = require("crypto");
     SCHEDULED_RUN_ARTIFACT_PREFIX = "scheduled-run-artifacts/";
     SCHEDULED_RUN_ARTIFACT_DOWNLOAD_TTL_MS = 15 * 60 * 1e3;
     SCHEDULED_RUN_ARTIFACT_MAX_BYTES = 2e6;
@@ -81190,357 +81834,6 @@ var init_public_scheduled_result_routes = __esm({
   }
 });
 
-// src/api/service-connections.ts
-function ensureServiceConnectionsSchema() {
-  const currentDb = getDb();
-  if (schemaReady3 && schemaDb6 === currentDb) return schemaReady3;
-  schemaDb6 = currentDb;
-  schemaReady3 = (async () => {
-    const db = currentDb;
-    await db.execute(`
-      CREATE TABLE IF NOT EXISTS service_connections (
-        id                         TEXT PRIMARY KEY,
-        user_id                    INTEGER NOT NULL REFERENCES users(id),
-        provider_config_key        TEXT NOT NULL,
-        provider                   TEXT,
-        transport                  TEXT NOT NULL,
-        upstream_connection_id     TEXT,
-        label                      TEXT,
-        user_label                 TEXT,
-        provider_account_id        TEXT,
-        provider_account_email     TEXT,
-        provider_account_name      TEXT,
-        provider_identity_checked_at TEXT,
-        provider_identity_source_updated_at TEXT,
-        lifecycle_status           TEXT NOT NULL DEFAULT 'pending',
-        operational_status         TEXT NOT NULL DEFAULT 'unknown',
-        reconnect_required         INTEGER NOT NULL DEFAULT 0,
-        actions_enabled            INTEGER NOT NULL DEFAULT 0,
-        read_tools_json            TEXT NOT NULL DEFAULT '[]',
-        action_tools_json          TEXT NOT NULL DEFAULT '[]',
-        tool_revision              TEXT,
-        last_checked_at            TEXT,
-        last_successful_call_at    TEXT,
-        last_failure_at            TEXT,
-        last_failure_code          TEXT,
-        last_failure_retryable     INTEGER,
-        consecutive_failures       INTEGER NOT NULL DEFAULT 0,
-        vault_name                 TEXT,
-        table_name                 TEXT,
-        legacy_owner_identity      TEXT,
-        created_at                 TEXT NOT NULL DEFAULT (datetime('now')),
-        updated_at                 TEXT NOT NULL DEFAULT (datetime('now')),
-        UNIQUE(user_id, provider_config_key, upstream_connection_id)
-      )
-    `);
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN user_label TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_id TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_email TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_name TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_checked_at TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_source_updated_at TEXT`);
-    } catch {
-    }
-    await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_user_updated ON service_connections(user_id, updated_at DESC)`);
-    await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_upstream ON service_connections(provider_config_key, upstream_connection_id)`);
-    await db.execute(`
-      CREATE TABLE IF NOT EXISTS service_connection_health_events (
-        id                    TEXT PRIMARY KEY,
-        connection_id         TEXT NOT NULL REFERENCES service_connections(id) ON DELETE CASCADE,
-        operational_status    TEXT NOT NULL,
-        failure_code          TEXT,
-        retryable             INTEGER,
-        evidence_source       TEXT NOT NULL,
-        created_at            TEXT NOT NULL DEFAULT (datetime('now'))
-      )
-    `);
-    await db.execute(`CREATE INDEX IF NOT EXISTS service_connection_health_events_connection ON service_connection_health_events(connection_id, created_at DESC)`);
-    await db.execute(`
-      CREATE TABLE IF NOT EXISTS service_connection_action_audit (
-        id                    TEXT PRIMARY KEY,
-        connection_id         TEXT NOT NULL REFERENCES service_connections(id) ON DELETE CASCADE,
-        user_id               INTEGER NOT NULL REFERENCES users(id),
-        tool                  TEXT NOT NULL,
-        request_id            TEXT NOT NULL,
-        status                TEXT NOT NULL,
-        error_code            TEXT,
-        created_at            TEXT NOT NULL DEFAULT (datetime('now')),
-        UNIQUE(user_id, request_id)
-      )
-    `);
-    try {
-      await db.execute(`ALTER TABLE service_connection_action_audit ADD COLUMN request_digest TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connection_action_audit ADD COLUMN result_json TEXT`);
-    } catch {
-    }
-  })().catch((error) => {
-    schemaReady3 = null;
-    schemaDb6 = null;
-    throw error;
-  });
-  return schemaReady3;
-}
-function parseTools(value) {
-  if (typeof value !== "string") return [];
-  try {
-    const parsed = JSON.parse(value);
-    return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
-  } catch {
-    return [];
-  }
-}
-function rowToRecord(row) {
-  return {
-    id: String(row.id),
-    userId: Number(row.user_id),
-    providerConfigKey: String(row.provider_config_key),
-    provider: typeof row.provider === "string" ? row.provider : null,
-    transport: row.transport === "remote_mcp" ? "remote_mcp" : "nango",
-    upstreamConnectionId: typeof row.upstream_connection_id === "string" ? row.upstream_connection_id : null,
-    label: typeof row.label === "string" ? row.label : null,
-    userLabel: typeof row.user_label === "string" ? row.user_label : null,
-    providerAccountId: typeof row.provider_account_id === "string" ? row.provider_account_id : null,
-    providerAccountEmail: typeof row.provider_account_email === "string" ? row.provider_account_email : null,
-    providerAccountName: typeof row.provider_account_name === "string" ? row.provider_account_name : null,
-    providerIdentityCheckedAt: typeof row.provider_identity_checked_at === "string" ? row.provider_identity_checked_at : null,
-    providerIdentitySourceUpdatedAt: typeof row.provider_identity_source_updated_at === "string" ? row.provider_identity_source_updated_at : null,
-    lifecycleStatus: String(row.lifecycle_status),
-    operationalStatus: String(row.operational_status),
-    reconnectRequired: Number(row.reconnect_required) === 1,
-    actionsEnabled: Number(row.actions_enabled) === 1,
-    readTools: parseTools(row.read_tools_json),
-    actionTools: parseTools(row.action_tools_json),
-    toolRevision: typeof row.tool_revision === "string" ? row.tool_revision : null,
-    lastCheckedAt: typeof row.last_checked_at === "string" ? row.last_checked_at : null,
-    lastSuccessfulCallAt: typeof row.last_successful_call_at === "string" ? row.last_successful_call_at : null,
-    lastFailureAt: typeof row.last_failure_at === "string" ? row.last_failure_at : null,
-    lastFailureCode: typeof row.last_failure_code === "string" ? row.last_failure_code : null,
-    lastFailureRetryable: row.last_failure_retryable === null || row.last_failure_retryable === void 0 ? null : Number(row.last_failure_retryable) === 1,
-    consecutiveFailures: Number(row.consecutive_failures ?? 0),
-    vaultName: typeof row.vault_name === "string" ? row.vault_name : null,
-    tableName: typeof row.table_name === "string" ? row.table_name : null,
-    createdAt: String(row.created_at),
-    updatedAt: String(row.updated_at)
-  };
-}
-async function userIdForIdentity(identity) {
-  const user = await getUserByEmail(identity.normalize("NFKC").trim().toLowerCase());
-  if (!user) throw new Error("service_connection_user_not_found");
-  return Number(user.id);
-}
-async function reconcileDiscoveredNangoConnections(identity, discovered) {
-  await ensureServiceConnectionsSchema();
-  const db = getDb();
-  const userId = await userIdForIdentity(identity);
-  for (const connection of discovered) {
-    await db.execute({
-      sql: `
-        INSERT INTO service_connections (
-          id, user_id, provider_config_key, provider, transport, upstream_connection_id,
-          label, lifecycle_status, reconnect_required, actions_enabled, legacy_owner_identity, created_at, updated_at
-        ) VALUES (?, ?, ?, ?, 'nango', ?, ?, ?, ?, 1, ?, COALESCE(?, datetime('now')), COALESCE(?, datetime('now')))
-        ON CONFLICT(user_id, provider_config_key, upstream_connection_id) DO UPDATE SET
-          provider = excluded.provider,
-          label = COALESCE(excluded.label, service_connections.label),
-          lifecycle_status = excluded.lifecycle_status,
-          reconnect_required = excluded.reconnect_required,
-          updated_at = excluded.updated_at
-      `,
-      args: [
-        (0, import_node_crypto59.randomUUID)(),
-        userId,
-        connection.providerConfigKey,
-        connection.provider,
-        connection.upstreamConnectionId,
-        connection.label,
-        connection.lifecycleStatus,
-        connection.reconnectRequired ? 1 : 0,
-        identity,
-        connection.createdAt,
-        connection.updatedAt
-      ]
-    });
-  }
-  return listServiceConnections(identity, "nango");
-}
-async function listServiceConnections(identity, transport) {
-  await ensureServiceConnectionsSchema();
-  const userId = await userIdForIdentity(identity);
-  const result = await getDb().execute({
-    sql: `SELECT * FROM service_connections WHERE user_id = ?${transport ? " AND transport = ?" : ""} AND lifecycle_status <> 'disconnected' ORDER BY updated_at DESC`,
-    args: transport ? [userId, transport] : [userId]
-  });
-  return result.rows.map((row) => rowToRecord(row));
-}
-async function getOwnedServiceConnection(identity, connectionId) {
-  await ensureServiceConnectionsSchema();
-  const userId = await userIdForIdentity(identity);
-  const result = await getDb().execute({
-    sql: "SELECT * FROM service_connections WHERE id = ? AND user_id = ? LIMIT 1",
-    args: [connectionId, userId]
-  });
-  const row = result.rows[0];
-  return row ? rowToRecord(row) : null;
-}
-async function updateServiceConnectionTools(connectionId, readTools, actionTools, toolRevision) {
-  await ensureServiceConnectionsSchema();
-  await getDb().execute({
-    sql: `UPDATE service_connections SET read_tools_json = ?, action_tools_json = ?, tool_revision = ?, updated_at = datetime('now') WHERE id = ?`,
-    args: [JSON.stringify(readTools), JSON.stringify(actionTools), toolRevision, connectionId]
-  });
-}
-async function setServiceConnectionProviderIdentity(args) {
-  await ensureServiceConnectionsSchema();
-  await getDb().execute({
-    sql: `
-      UPDATE service_connections SET
-        provider_account_id = ?, provider_account_email = ?, provider_account_name = ?,
-        provider_identity_checked_at = datetime('now'), provider_identity_source_updated_at = ?,
-        updated_at = datetime('now')
-      WHERE id = ?
-    `,
-    args: [
-      args.providerAccountId ?? null,
-      args.providerAccountEmail?.toLowerCase() ?? null,
-      args.providerAccountName ?? null,
-      args.sourceUpdatedAt,
-      args.connectionId
-    ]
-  });
-}
-async function setServiceConnectionUserLabel(identity, connectionId, userLabel) {
-  const connection = await getOwnedServiceConnection(identity, connectionId);
-  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
-  await getDb().execute({
-    sql: `UPDATE service_connections SET user_label = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
-    args: [userLabel, connectionId, connection.userId]
-  });
-  return userLabel;
-}
-async function recordServiceConnectionHealth(args) {
-  await ensureServiceConnectionsSchema();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  await getDb().execute({
-    sql: `
-      UPDATE service_connections SET
-        operational_status = ?, last_checked_at = ?,
-        last_successful_call_at = CASE WHEN ? = 'available' THEN ? ELSE last_successful_call_at END,
-        last_failure_at = CASE WHEN ? IN ('degraded', 'unavailable') THEN ? ELSE NULL END,
-        last_failure_code = ?, last_failure_retryable = ?,
-        consecutive_failures = CASE WHEN ? = 'available' THEN 0 ELSE consecutive_failures + 1 END,
-        updated_at = datetime('now')
-      WHERE id = ?
-    `,
-    args: [
-      args.operationalStatus,
-      now,
-      args.operationalStatus,
-      now,
-      args.operationalStatus,
-      now,
-      args.failureCode ?? null,
-      args.retryable == null ? null : args.retryable ? 1 : 0,
-      args.operationalStatus,
-      args.connectionId
-    ]
-  });
-  await getDb().execute({
-    sql: `INSERT INTO service_connection_health_events (id, connection_id, operational_status, failure_code, retryable, evidence_source) VALUES (?, ?, ?, ?, ?, ?)`,
-    args: [(0, import_node_crypto59.randomUUID)(), args.connectionId, args.operationalStatus, args.failureCode ?? null, args.retryable == null ? null : args.retryable ? 1 : 0, args.evidenceSource]
-  });
-}
-async function setServiceConnectionActions(identity, connectionId, enabled) {
-  const connection = await getOwnedServiceConnection(identity, connectionId);
-  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
-  await getDb().execute({
-    sql: `UPDATE service_connections SET actions_enabled = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
-    args: [enabled ? 1 : 0, connectionId, connection.userId]
-  });
-  return enabled;
-}
-async function markServiceConnectionDisconnected(identity, connectionId) {
-  const connection = await getOwnedServiceConnection(identity, connectionId);
-  if (!connection) throw new Error("service_connection_not_found");
-  await getDb().execute({
-    sql: `UPDATE service_connections SET lifecycle_status = 'disconnected', operational_status = 'unknown', reconnect_required = 0, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
-    args: [connectionId, connection.userId]
-  });
-  const remaining = await getDb().execute({
-    sql: `SELECT COUNT(*) AS count FROM service_connections WHERE user_id = ? AND transport = 'nango' AND lifecycle_status = 'connected'`,
-    args: [connection.userId]
-  });
-  return Number(remaining.rows[0]?.count ?? 0);
-}
-async function recordServiceConnectionAction(args) {
-  await ensureServiceConnectionsSchema();
-  const connection = await getOwnedServiceConnection(args.identity, args.connectionId);
-  if (!connection) throw new Error("service_connection_not_found");
-  await getDb().execute({
-    sql: `UPDATE service_connection_action_audit SET status = ?, error_code = ?, result_json = ? WHERE user_id = ? AND request_id = ? AND connection_id = ?`,
-    args: [args.status, args.errorCode ?? null, args.result === void 0 ? null : JSON.stringify(args.result), connection.userId, args.requestId, connection.id]
-  });
-}
-async function claimServiceConnectionAction(args) {
-  await ensureServiceConnectionsSchema();
-  const connection = await getOwnedServiceConnection(args.identity, args.connectionId);
-  if (!connection) throw new Error("service_connection_not_found");
-  const inserted = await getDb().execute({
-    sql: `INSERT OR IGNORE INTO service_connection_action_audit (id, connection_id, user_id, tool, request_id, status, request_digest) VALUES (?, ?, ?, ?, ?, 'started', ?)`,
-    args: [(0, import_node_crypto59.randomUUID)(), connection.id, connection.userId, args.tool, args.requestId, args.requestDigest]
-  });
-  if (Number(inserted.rowsAffected ?? 0) === 1) return { claimed: true };
-  const existing = await getDb().execute({
-    sql: `SELECT connection_id, tool, status, error_code, request_digest, result_json FROM service_connection_action_audit WHERE user_id = ? AND request_id = ? LIMIT 1`,
-    args: [connection.userId, args.requestId]
-  });
-  const row = existing.rows[0];
-  const conflict = String(row?.connection_id ?? "") !== connection.id || String(row?.tool ?? "") !== args.tool || String(row?.request_digest ?? "") !== args.requestDigest;
-  let result = void 0;
-  if (!conflict && typeof row?.result_json === "string") {
-    try {
-      result = JSON.parse(row.result_json);
-    } catch {
-      result = void 0;
-    }
-  }
-  return {
-    claimed: false,
-    status: String(row?.status ?? "unknown"),
-    errorCode: typeof row?.error_code === "string" ? row.error_code : null,
-    conflict,
-    ...result !== void 0 ? { result } : {}
-  };
-}
-var import_node_crypto59, schemaReady3, schemaDb6;
-var init_service_connections = __esm({
-  "src/api/service-connections.ts"() {
-    "use strict";
-    import_node_crypto59 = require("crypto");
-    init_db();
-    schemaReady3 = null;
-    schemaDb6 = null;
-  }
-});
-
 // src/api/scheduler-integration-auth.ts
 function signingSecret() {
   const secret2 = process.env.SCHEDULER_INTEGRATION_SIGNING_SECRET?.trim();
@@ -84444,6 +84737,15 @@ function retryAfterMsFromText(value) {
 function normalizeNangoClientError(error) {
   if (error instanceof MainNangoTransportError) return error;
   const detail = nangoClientErrorText(error);
+  const structured = error && typeof error === "object" ? error : null;
+  if (structured?.code === -32001 || structured?.name === "RequestTimeout" || /Request timed out|RequestTimeout|Maximum total timeout exceeded/i.test(detail)) {
+    return new MainNangoTransportError(
+      "The connected service operation timed out before returning a result. Retry failed items or use a smaller batch.",
+      503,
+      "mcp_request_timeout",
+      true
+    );
+  }
   if (/SERVICE_DISABLED|accessNotConfigured/i.test(detail)) {
     return new MainNangoTransportError(
       "The provider API required by this connection is disabled. Enable it in the provider project, wait for propagation, then retry.",
@@ -84474,6 +84776,12 @@ function normalizeNangoClientError(error) {
   }
   return new MainNangoTransportError("The service connection is temporarily unavailable.", 503, "connection_transport_unavailable");
 }
+async function callNangoToolWithBudget(client2, tool, input) {
+  return client2.callTool(
+    { name: tool, arguments: input },
+    { timeout: NANGO_TOOL_CALL_TIMEOUT_MS }
+  );
+}
 function asRecord2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
@@ -84917,7 +85225,7 @@ async function callNangoToolDirect(args) {
   let result;
   let providerError;
   try {
-    result = await withNangoClient(connection, (client2) => client2.callTool({ name: args.tool, arguments: args.input }));
+    result = await withNangoClient(connection, (client2) => callNangoToolWithBudget(client2, args.tool, args.input));
   } catch (error) {
     providerError = error;
   }
@@ -84982,7 +85290,7 @@ async function describeNangoToolDirect(identity, connectionId, toolName) {
     fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-var import_node_crypto68, import_client13, DEFAULT_NANGO_MCP_URL, NANGO_TIMEOUT_MS, NANGO_CONNECTION_PAGE_SIZE, NANGO_CONNECTION_MAX_PAGES, PROVIDER_IDENTITY_RETRY_MS, MAIN_INTEGRATION_CONTRACT_VERSION, MAIN_INTEGRATION_CONTRACT_HASH, MainNangoTransportError, IDENTITY_SUPPORTED_PROVIDERS;
+var import_node_crypto68, import_client13, DEFAULT_NANGO_MCP_URL, NANGO_TIMEOUT_MS, NANGO_TOOL_CALL_TIMEOUT_MS, NANGO_CONNECTION_PAGE_SIZE, NANGO_CONNECTION_MAX_PAGES, PROVIDER_IDENTITY_RETRY_MS, MAIN_INTEGRATION_CONTRACT_VERSION, MAIN_INTEGRATION_CONTRACT_HASH, MainNangoTransportError, IDENTITY_SUPPORTED_PROVIDERS;
 var init_main_nango_transport = __esm({
   "src/api/main-nango-transport.ts"() {
     "use strict";
@@ -84994,6 +85302,7 @@ var init_main_nango_transport = __esm({
     init_connected_tool_policy();
     DEFAULT_NANGO_MCP_URL = "https://api.nango.dev/mcp";
     NANGO_TIMEOUT_MS = 2e4;
+    NANGO_TOOL_CALL_TIMEOUT_MS = 24e4;
     NANGO_CONNECTION_PAGE_SIZE = 100;
     NANGO_CONNECTION_MAX_PAGES = 20;
     PROVIDER_IDENTITY_RETRY_MS = 6 * 60 * 60 * 1e3;