mcp-scraper 0.66.6 → 0.67.0

package/dist/{server-5WPS3LZD.js → server-MFVYRB6I.js}

@@ -10,13 +10,13 @@ import {
   queuedCommonsDocumentCount,
   semanticCommonsEntityScores,
   typeFromMime
-} from "./chunk-DBWWIK7O.js";
+} from "./chunk-LN6N3YLK.js";
 import {
   REQUIRED_LOCATION_STATE_CODES,
   importHostedCensusPlacesCsv,
   importHostedZipGroupsCsv,
   listActiveHostedLocationDatasets
-} from "./chunk-PMCT2YQM.js";
+} from "./chunk-Y46YNQMM.js";
 import {
   cancelPendingLeadListEnrichmentRows,
   claimLeadListEnrichmentOutbox,
@@ -43,7 +43,7 @@ import {
   saveLeadListEnrichmentRowResult,
   setInitializingLeadListEnrichmentConcurrencyLock,
   stableCanonicalJson
-} from "./chunk-ABYBPODM.js";
+} from "./chunk-UL4ZKAWZ.js";
 import {
   ANALYTICS_CONTENT_SORTS,
   AnalyticsRepositoryError,
@@ -108,7 +108,7 @@ import {
   harvestProblemResponse,
   publicErrorBoundary,
   serializeHarvestProblem
-} from "./chunk-CETDPNMZ.js";
+} from "./chunk-2LXTOAKS.js";
 import "./chunk-OZJMVCDK.js";
 import {
   BACKUP_LAST_RESORT_ATTEMPTS,
@@ -127,7 +127,7 @@ import {
   resolveKernelProxyId,
   serpArrivalUrl,
   withRuntimeUserAgent
-} from "./chunk-K7Y27ND3.js";
+} from "./chunk-62LEXS5O.js";
 import {
   ApiErrorResponseSchema,
   ArtifactTemplatePresetKeySchema,
@@ -199,7 +199,7 @@ import {
   resolveDeploymentProfile,
   resolveLocalSourcebookSchemaType,
   transcribeMediaUrl
-} from "./chunk-VMWVEKZT.js";
+} from "./chunk-XOOKZYZG.js";
 import {
   auditImageUrls,
   auditImages,
@@ -210,7 +210,7 @@ import {
   sanitizeAttempts,
   sanitizeHarvestResult,
   sanitizeOutboundDiagnostics
-} from "./chunk-3EYALCYK.js";
+} from "./chunk-2L4C4DAZ.js";
 import {
   browserServiceApiKey,
   browserServiceProfileName,
@@ -220,7 +220,7 @@ import {
   recordKernelSession,
   recordVendorUsage,
   runWithCostContext
-} from "./chunk-3TKKJQB4.js";
+} from "./chunk-ES25GP6C.js";
 import {
   listWorkflowDefinitions,
   runWorkflow,
@@ -256,7 +256,7 @@ import {
 } from "./chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-NLEAYKOC.js";
+} from "./chunk-GT63KEUB.js";
 import {
   SITE_EXTRACT_ARTIFACT_PREFIX,
   abandonExtractSettlement,
@@ -287,7 +287,7 @@ import {
   setExtractJobTotal,
   settleExtractJob,
   terminalExtractJobStatus
-} from "./chunk-KXRWY7DZ.js";
+} from "./chunk-LCGTNWOT.js";
 import {
   createPrivateArtifact,
   privateArtifactOwnerId,
@@ -451,7 +451,7 @@ import {
   softDeleteInboxMessage,
   upsertPageSnapshot,
   verifyPassword
-} from "./chunk-55B3T5L2.js";
+} from "./chunk-65FTMB7G.js";
 
 // src/blog/registry.ts
 var posts = [
@@ -6312,7 +6312,8 @@ function firstJsonLdImage(value) {
   }
   return null;
 }
-function firstContentImage(html) {
+function contentImages(html) {
+  const images = [];
   for (const match of html.matchAll(/<img\b[^>]*>/gi)) {
     const tag = match[0];
     const attr = (name) => tag.match(new RegExp(`\\b${name}\\s*=\\s*(?:"([^"]+)"|'([^']+)'|([^\\s>]+))`, "i"))?.slice(1).find(Boolean) ?? null;
@@ -6323,30 +6324,36 @@ function firstContentImage(html) {
     const width = Number(attr("width") ?? 0);
     const height = Number(attr("height") ?? 0);
     if (width > 0 && width < 200 || height > 0 && height < 120) continue;
-    return candidate;
+    images.push(candidate);
   }
-  return null;
+  return images;
 }
-function resolveFeaturedImage(input) {
+function resolveFeaturedImageCandidates(input) {
   const replay = parseWaybackReplayUrl(input.pageUrl);
   const baseUrl = replay?.originalUrl ?? input.pageUrl;
   const candidates = [
     { value: input.meta["og:image"] ?? input.meta["og:image:url"] ?? input.meta["og:image:secure_url"], source: "og:image" },
     { value: input.meta["twitter:image"] ?? input.meta["twitter:image:src"], source: "twitter:image" },
     { value: firstJsonLdImage(input.schema), source: "json-ld" },
-    { value: firstContentImage(input.html), source: "content-image" }
+    ...contentImages(input.html).map((value) => ({ value, source: "content-image" }))
   ];
+  const seen = /* @__PURE__ */ new Set();
+  const resolved = [];
   for (const candidate of candidates) {
     if (!candidate.value) continue;
     const url = safeHttpUrl(candidate.value, baseUrl);
-    if (!url) continue;
-    return {
+    if (!url || seen.has(url)) continue;
+    seen.add(url);
+    resolved.push({
       url,
       archivedUrl: replay ? buildWaybackReplayUrl(replay.timestamp, url, "im_") : null,
       source: candidate.source
-    };
+    });
   }
-  return null;
+  return resolved;
+}
+function resolveFeaturedImage(input) {
+  return resolveFeaturedImageCandidates(input)[0] ?? null;
 }
 
 // src/api/site-extractor.ts
@@ -9545,7 +9552,7 @@ var siteExtractFn = inngest.createFunction(
       });
     }) : null;
     const finalized = await step.run("finalize", async () => {
-      const { assembleExtractArtifacts } = await import("./extract-bundle-EA5URLXN.js");
+      const { assembleExtractArtifacts } = await import("./extract-bundle-QQIYJSBW.js");
       const current = await getExtractJob(jobId2);
       if (!current) throw new Error("extract job disappeared before finalization");
       const stored = await assembleExtractArtifacts(current, { branding, imageAudit });
@@ -10505,7 +10512,7 @@ async function resolveUsZipsPath(requestedPath) {
 async function loadZipGroups(stateAbbr, requestedPath, warnings, sourceMode) {
   const mode = resolvedLocationDataMode({ zipSource: sourceMode });
   if (mode === "hosted") {
-    const { getHostedZipGroups } = await import("./location-data-repository-WHHQUCUI.js");
+    const { getHostedZipGroups } = await import("./location-data-repository-G72M7DTN.js");
     const hosted = await getHostedZipGroups(stateAbbr);
     if (!hosted.dataset) {
       throw new DirectoryLocationError(
@@ -10568,7 +10575,7 @@ async function resolveDirectoryMarkets(options, config = {}) {
   const sourceUrl = censusStateUrl(state.fips);
   const warnings = [];
   if (resolvedLocationDataMode(config) === "hosted") {
-    const { queryHostedLocationMarkets } = await import("./location-data-repository-WHHQUCUI.js");
+    const { queryHostedLocationMarkets } = await import("./location-data-repository-G72M7DTN.js");
     const hosted = await queryHostedLocationMarkets({
       state: state.abbr,
       minPopulation: options.minPopulation,
@@ -12055,7 +12062,7 @@ function summarizePersistedLeadRows(rows, warnings = []) {
 async function settlePersistedLeadListEnrichment(jobId2) {
   const jobs = await listLeadListEnrichmentJobsNeedingSettlement(100);
   const job = jobs.find((candidate) => candidate.id === jobId2);
-  const { getLeadListEnrichmentJob: getLeadListEnrichmentJob2 } = await import("./lead-list-enrichment-repository-IBXNWM6H.js");
+  const { getLeadListEnrichmentJob: getLeadListEnrichmentJob2 } = await import("./lead-list-enrichment-repository-CXLVIV3R.js");
   const current = job ?? await getLeadListEnrichmentJob2(jobId2);
   if (!current) return null;
   const rows = await listLeadListEnrichmentRows(jobId2);
@@ -12111,7 +12118,7 @@ async function reconcileLeadListEnrichmentSettlements(limit = 25) {
         const persisted = job.result ?? summarizePersistedLeadRows(rows, job.warnings);
         const status = job.cancelRequestedAt ? "cancelled" : persisted.failedRows > 0 && persisted.completeRows > 0 ? "partial" : persisted.failedRows > 0 ? "cancelled" : persisted.rowsWithContacts > 0 ? "complete" : "empty";
         if (persisted.failedRows > 0 && persisted.completeRows === 0 && !job.cancelRequestedAt) {
-          const { failLeadListEnrichmentJob: failLeadListEnrichmentJob2 } = await import("./lead-list-enrichment-repository-IBXNWM6H.js");
+          const { failLeadListEnrichmentJob: failLeadListEnrichmentJob2 } = await import("./lead-list-enrichment-repository-CXLVIV3R.js");
           await failLeadListEnrichmentJob2({
             jobId: job.id,
             errorCode: "lead_list_all_rows_failed",
@@ -16505,6 +16512,350 @@ function findPreferredEntitledSubscription(subscriptions, predicate) {
   return void 0;
 }
 
+// src/api/service-connections.ts
+import { randomUUID as randomUUID6 } from "crypto";
+var schemaReady = null;
+var schemaDb3 = null;
+function ensureServiceConnectionsSchema() {
+  const currentDb = getDb();
+  if (schemaReady && schemaDb3 === currentDb) return schemaReady;
+  schemaDb3 = currentDb;
+  schemaReady = (async () => {
+    const db = currentDb;
+    await db.execute(`
+      CREATE TABLE IF NOT EXISTS service_connections (
+        id                         TEXT PRIMARY KEY,
+        user_id                    INTEGER NOT NULL REFERENCES users(id),
+        provider_config_key        TEXT NOT NULL,
+        provider                   TEXT,
+        transport                  TEXT NOT NULL,
+        upstream_connection_id     TEXT,
+        label                      TEXT,
+        user_label                 TEXT,
+        provider_account_id        TEXT,
+        provider_account_email     TEXT,
+        provider_account_name      TEXT,
+        provider_identity_checked_at TEXT,
+        provider_identity_source_updated_at TEXT,
+        lifecycle_status           TEXT NOT NULL DEFAULT 'pending',
+        operational_status         TEXT NOT NULL DEFAULT 'unknown',
+        reconnect_required         INTEGER NOT NULL DEFAULT 0,
+        actions_enabled            INTEGER NOT NULL DEFAULT 0,
+        read_tools_json            TEXT NOT NULL DEFAULT '[]',
+        action_tools_json          TEXT NOT NULL DEFAULT '[]',
+        tool_revision              TEXT,
+        last_checked_at            TEXT,
+        last_successful_call_at    TEXT,
+        last_failure_at            TEXT,
+        last_failure_code          TEXT,
+        last_failure_retryable     INTEGER,
+        consecutive_failures       INTEGER NOT NULL DEFAULT 0,
+        vault_name                 TEXT,
+        table_name                 TEXT,
+        legacy_owner_identity      TEXT,
+        created_at                 TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at                 TEXT NOT NULL DEFAULT (datetime('now')),
+        UNIQUE(user_id, provider_config_key, upstream_connection_id)
+      )
+    `);
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN user_label TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_id TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_email TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_name TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_checked_at TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_source_updated_at TEXT`);
+    } catch {
+    }
+    await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_user_updated ON service_connections(user_id, updated_at DESC)`);
+    await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_upstream ON service_connections(provider_config_key, upstream_connection_id)`);
+    await db.execute(`
+      CREATE TABLE IF NOT EXISTS service_connection_health_events (
+        id                    TEXT PRIMARY KEY,
+        connection_id         TEXT NOT NULL REFERENCES service_connections(id) ON DELETE CASCADE,
+        operational_status    TEXT NOT NULL,
+        failure_code          TEXT,
+        retryable             INTEGER,
+        evidence_source       TEXT NOT NULL,
+        created_at            TEXT NOT NULL DEFAULT (datetime('now'))
+      )
+    `);
+    await db.execute(`CREATE INDEX IF NOT EXISTS service_connection_health_events_connection ON service_connection_health_events(connection_id, created_at DESC)`);
+    await db.execute(`
+      CREATE TABLE IF NOT EXISTS service_connection_action_audit (
+        id                    TEXT PRIMARY KEY,
+        connection_id         TEXT NOT NULL REFERENCES service_connections(id) ON DELETE CASCADE,
+        user_id               INTEGER NOT NULL REFERENCES users(id),
+        tool                  TEXT NOT NULL,
+        request_id            TEXT NOT NULL,
+        status                TEXT NOT NULL,
+        error_code            TEXT,
+        created_at            TEXT NOT NULL DEFAULT (datetime('now')),
+        UNIQUE(user_id, request_id)
+      )
+    `);
+    try {
+      await db.execute(`ALTER TABLE service_connection_action_audit ADD COLUMN request_digest TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connection_action_audit ADD COLUMN result_json TEXT`);
+    } catch {
+    }
+  })().catch((error) => {
+    schemaReady = null;
+    schemaDb3 = null;
+    throw error;
+  });
+  return schemaReady;
+}
+function parseTools(value) {
+  if (typeof value !== "string") return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function rowToRecord(row) {
+  return {
+    id: String(row.id),
+    userId: Number(row.user_id),
+    providerConfigKey: String(row.provider_config_key),
+    provider: typeof row.provider === "string" ? row.provider : null,
+    transport: row.transport === "remote_mcp" ? "remote_mcp" : "nango",
+    upstreamConnectionId: typeof row.upstream_connection_id === "string" ? row.upstream_connection_id : null,
+    label: typeof row.label === "string" ? row.label : null,
+    userLabel: typeof row.user_label === "string" ? row.user_label : null,
+    providerAccountId: typeof row.provider_account_id === "string" ? row.provider_account_id : null,
+    providerAccountEmail: typeof row.provider_account_email === "string" ? row.provider_account_email : null,
+    providerAccountName: typeof row.provider_account_name === "string" ? row.provider_account_name : null,
+    providerIdentityCheckedAt: typeof row.provider_identity_checked_at === "string" ? row.provider_identity_checked_at : null,
+    providerIdentitySourceUpdatedAt: typeof row.provider_identity_source_updated_at === "string" ? row.provider_identity_source_updated_at : null,
+    lifecycleStatus: String(row.lifecycle_status),
+    operationalStatus: String(row.operational_status),
+    reconnectRequired: Number(row.reconnect_required) === 1,
+    actionsEnabled: Number(row.actions_enabled) === 1,
+    readTools: parseTools(row.read_tools_json),
+    actionTools: parseTools(row.action_tools_json),
+    toolRevision: typeof row.tool_revision === "string" ? row.tool_revision : null,
+    lastCheckedAt: typeof row.last_checked_at === "string" ? row.last_checked_at : null,
+    lastSuccessfulCallAt: typeof row.last_successful_call_at === "string" ? row.last_successful_call_at : null,
+    lastFailureAt: typeof row.last_failure_at === "string" ? row.last_failure_at : null,
+    lastFailureCode: typeof row.last_failure_code === "string" ? row.last_failure_code : null,
+    lastFailureRetryable: row.last_failure_retryable === null || row.last_failure_retryable === void 0 ? null : Number(row.last_failure_retryable) === 1,
+    consecutiveFailures: Number(row.consecutive_failures ?? 0),
+    vaultName: typeof row.vault_name === "string" ? row.vault_name : null,
+    tableName: typeof row.table_name === "string" ? row.table_name : null,
+    createdAt: String(row.created_at),
+    updatedAt: String(row.updated_at)
+  };
+}
+async function userIdForIdentity(identity) {
+  const user = await getUserByEmail(identity.normalize("NFKC").trim().toLowerCase());
+  if (!user) throw new Error("service_connection_user_not_found");
+  return Number(user.id);
+}
+async function reconcileDiscoveredNangoConnections(identity, discovered) {
+  await ensureServiceConnectionsSchema();
+  const db = getDb();
+  const userId = await userIdForIdentity(identity);
+  for (const connection of discovered) {
+    await db.execute({
+      sql: `
+        INSERT INTO service_connections (
+          id, user_id, provider_config_key, provider, transport, upstream_connection_id,
+          label, lifecycle_status, reconnect_required, actions_enabled, legacy_owner_identity, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, 'nango', ?, ?, ?, ?, 1, ?, COALESCE(?, datetime('now')), COALESCE(?, datetime('now')))
+        ON CONFLICT(user_id, provider_config_key, upstream_connection_id) DO UPDATE SET
+          provider = excluded.provider,
+          label = COALESCE(excluded.label, service_connections.label),
+          lifecycle_status = excluded.lifecycle_status,
+          reconnect_required = excluded.reconnect_required,
+          updated_at = excluded.updated_at
+      `,
+      args: [
+        randomUUID6(),
+        userId,
+        connection.providerConfigKey,
+        connection.provider,
+        connection.upstreamConnectionId,
+        connection.label,
+        connection.lifecycleStatus,
+        connection.reconnectRequired ? 1 : 0,
+        identity,
+        connection.createdAt,
+        connection.updatedAt
+      ]
+    });
+  }
+  return listServiceConnections(identity, "nango");
+}
+async function listServiceConnections(identity, transport) {
+  await ensureServiceConnectionsSchema();
+  const userId = await userIdForIdentity(identity);
+  const result = await getDb().execute({
+    sql: `SELECT * FROM service_connections WHERE user_id = ?${transport ? " AND transport = ?" : ""} AND lifecycle_status <> 'disconnected' ORDER BY updated_at DESC`,
+    args: transport ? [userId, transport] : [userId]
+  });
+  return result.rows.map((row) => rowToRecord(row));
+}
+async function getOwnedServiceConnection(identity, connectionId) {
+  await ensureServiceConnectionsSchema();
+  const userId = await userIdForIdentity(identity);
+  const result = await getDb().execute({
+    sql: "SELECT * FROM service_connections WHERE id = ? AND user_id = ? LIMIT 1",
+    args: [connectionId, userId]
+  });
+  const row = result.rows[0];
+  return row ? rowToRecord(row) : null;
+}
+async function updateServiceConnectionTools(connectionId, readTools, actionTools, toolRevision) {
+  await ensureServiceConnectionsSchema();
+  await getDb().execute({
+    sql: `UPDATE service_connections SET read_tools_json = ?, action_tools_json = ?, tool_revision = ?, updated_at = datetime('now') WHERE id = ?`,
+    args: [JSON.stringify(readTools), JSON.stringify(actionTools), toolRevision, connectionId]
+  });
+}
+async function setServiceConnectionProviderIdentity(args) {
+  await ensureServiceConnectionsSchema();
+  await getDb().execute({
+    sql: `
+      UPDATE service_connections SET
+        provider_account_id = ?, provider_account_email = ?, provider_account_name = ?,
+        provider_identity_checked_at = datetime('now'), provider_identity_source_updated_at = ?,
+        updated_at = datetime('now')
+      WHERE id = ?
+    `,
+    args: [
+      args.providerAccountId ?? null,
+      args.providerAccountEmail?.toLowerCase() ?? null,
+      args.providerAccountName ?? null,
+      args.sourceUpdatedAt,
+      args.connectionId
+    ]
+  });
+}
+async function setServiceConnectionUserLabel(identity, connectionId, userLabel) {
+  const connection = await getOwnedServiceConnection(identity, connectionId);
+  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connections SET user_label = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
+    args: [userLabel, connectionId, connection.userId]
+  });
+  return userLabel;
+}
+async function recordServiceConnectionHealth(args) {
+  await ensureServiceConnectionsSchema();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  await getDb().execute({
+    sql: `
+      UPDATE service_connections SET
+        operational_status = ?, last_checked_at = ?,
+        last_successful_call_at = CASE WHEN ? = 'available' THEN ? ELSE last_successful_call_at END,
+        last_failure_at = CASE WHEN ? IN ('degraded', 'unavailable') THEN ? ELSE NULL END,
+        last_failure_code = ?, last_failure_retryable = ?,
+        consecutive_failures = CASE WHEN ? = 'available' THEN 0 ELSE consecutive_failures + 1 END,
+        updated_at = datetime('now')
+      WHERE id = ?
+    `,
+    args: [
+      args.operationalStatus,
+      now,
+      args.operationalStatus,
+      now,
+      args.operationalStatus,
+      now,
+      args.failureCode ?? null,
+      args.retryable == null ? null : args.retryable ? 1 : 0,
+      args.operationalStatus,
+      args.connectionId
+    ]
+  });
+  await getDb().execute({
+    sql: `INSERT INTO service_connection_health_events (id, connection_id, operational_status, failure_code, retryable, evidence_source) VALUES (?, ?, ?, ?, ?, ?)`,
+    args: [randomUUID6(), args.connectionId, args.operationalStatus, args.failureCode ?? null, args.retryable == null ? null : args.retryable ? 1 : 0, args.evidenceSource]
+  });
+}
+async function setServiceConnectionActions(identity, connectionId, enabled) {
+  const connection = await getOwnedServiceConnection(identity, connectionId);
+  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connections SET actions_enabled = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
+    args: [enabled ? 1 : 0, connectionId, connection.userId]
+  });
+  return enabled;
+}
+async function markServiceConnectionDisconnected(identity, connectionId) {
+  const connection = await getOwnedServiceConnection(identity, connectionId);
+  if (!connection) throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connections SET lifecycle_status = 'disconnected', operational_status = 'unknown', reconnect_required = 0, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
+    args: [connectionId, connection.userId]
+  });
+  const remaining = await getDb().execute({
+    sql: `SELECT COUNT(*) AS count FROM service_connections WHERE user_id = ? AND transport = 'nango' AND lifecycle_status = 'connected'`,
+    args: [connection.userId]
+  });
+  return Number(remaining.rows[0]?.count ?? 0);
+}
+async function recordServiceConnectionAction(args) {
+  await ensureServiceConnectionsSchema();
+  const connection = await getOwnedServiceConnection(args.identity, args.connectionId);
+  if (!connection) throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connection_action_audit SET status = ?, error_code = ?, result_json = ? WHERE user_id = ? AND request_id = ? AND connection_id = ?`,
+    args: [args.status, args.errorCode ?? null, args.result === void 0 ? null : JSON.stringify(args.result), connection.userId, args.requestId, connection.id]
+  });
+}
+async function claimServiceConnectionAction(args) {
+  await ensureServiceConnectionsSchema();
+  const connection = await getOwnedServiceConnection(args.identity, args.connectionId);
+  if (!connection) throw new Error("service_connection_not_found");
+  const inserted = await getDb().execute({
+    sql: `INSERT OR IGNORE INTO service_connection_action_audit (id, connection_id, user_id, tool, request_id, status, request_digest) VALUES (?, ?, ?, ?, ?, 'started', ?)`,
+    args: [randomUUID6(), connection.id, connection.userId, args.tool, args.requestId, args.requestDigest]
+  });
+  if (Number(inserted.rowsAffected ?? 0) === 1) return { claimed: true };
+  const existing = await getDb().execute({
+    sql: `SELECT connection_id, tool, status, error_code, request_digest, result_json FROM service_connection_action_audit WHERE user_id = ? AND request_id = ? LIMIT 1`,
+    args: [connection.userId, args.requestId]
+  });
+  const row = existing.rows[0];
+  const conflict = String(row?.connection_id ?? "") !== connection.id || String(row?.tool ?? "") !== args.tool || String(row?.request_digest ?? "") !== args.requestDigest;
+  let result = void 0;
+  if (!conflict && typeof row?.result_json === "string") {
+    try {
+      result = JSON.parse(row.result_json);
+    } catch {
+      result = void 0;
+    }
+  }
+  return {
+    claimed: false,
+    status: String(row?.status ?? "unknown"),
+    errorCode: typeof row?.error_code === "string" ? row.error_code : null,
+    conflict,
+    ...result !== void 0 ? { result } : {}
+  };
+}
+
 // src/api/connected-account-billing.ts
 var DEFAULT_CONNECTED_ACCOUNT_PRICE_ID = "price_1TtYPAS8aAcsk3TGHOgrDZiQ";
 function connectedBillingPeriodStart(now = /* @__PURE__ */ new Date()) {
@@ -16521,6 +16872,87 @@ async function chargedConnectionIds(userId, periodStart) {
   });
   return new Set(result.rows.map((row) => String(row.connection_id)));
 }
+async function inheritDisconnectedConnectionCharge(userId, connectionId, periodStart) {
+  await ensureServiceConnectionsSchema();
+  const normalizedUserId = Number(userId);
+  const db = getDb();
+  await db.batch([
+    {
+      sql: `
+        INSERT OR IGNORE INTO connected_account_charge_transfers (
+          user_id, period_start, from_connection_id, to_connection_id, provider_config_key
+        )
+        SELECT ?, ?, previous.id, replacement.id, replacement.provider_config_key
+        FROM service_connections AS replacement
+        JOIN service_connections AS previous
+          ON previous.user_id = replacement.user_id
+         AND previous.transport = 'nango'
+         AND previous.provider_config_key = replacement.provider_config_key
+         AND previous.lifecycle_status = 'disconnected'
+        JOIN connected_account_charges AS charge
+          ON charge.user_id = previous.user_id
+         AND charge.connection_id = previous.id
+         AND charge.period_start = ?
+        WHERE replacement.id = ?
+          AND replacement.user_id = ?
+          AND replacement.transport = 'nango'
+          AND replacement.lifecycle_status IN ('connected', 'needs_reauth')
+          AND NOT EXISTS (
+            SELECT 1 FROM connected_account_charges AS existing
+            WHERE existing.user_id = replacement.user_id
+              AND existing.connection_id = replacement.id
+              AND existing.period_start = ?
+          )
+        ORDER BY previous.updated_at DESC, previous.id ASC
+        LIMIT 1
+      `,
+      args: [normalizedUserId, periodStart, periodStart, connectionId, normalizedUserId, periodStart]
+    },
+    {
+      sql: `
+        UPDATE connected_account_charges
+        SET connection_id = ?
+        WHERE user_id = ?
+          AND period_start = ?
+          AND connection_id = (
+            SELECT transfer.from_connection_id
+            FROM connected_account_charge_transfers AS transfer
+            JOIN connected_account_charges AS current_charge
+              ON current_charge.user_id = transfer.user_id
+             AND current_charge.period_start = transfer.period_start
+             AND current_charge.connection_id = transfer.from_connection_id
+            WHERE transfer.user_id = ?
+              AND transfer.period_start = ?
+              AND transfer.to_connection_id = ?
+            ORDER BY transfer.transferred_at DESC, transfer.id DESC
+            LIMIT 1
+          )
+          AND NOT EXISTS (
+            SELECT 1 FROM connected_account_charges AS existing
+            WHERE existing.user_id = ?
+              AND existing.connection_id = ?
+              AND existing.period_start = ?
+          )
+      `,
+      args: [
+        connectionId,
+        normalizedUserId,
+        periodStart,
+        normalizedUserId,
+        periodStart,
+        connectionId,
+        normalizedUserId,
+        connectionId,
+        periodStart
+      ]
+    }
+  ], "write");
+  const inherited = await db.execute({
+    sql: "SELECT 1 FROM connected_account_charges WHERE user_id = ? AND connection_id = ? AND period_start = ? LIMIT 1",
+    args: [normalizedUserId, connectionId, periodStart]
+  });
+  return inherited.rows.length > 0;
+}
 async function getConnectedAccountBillingState(userId) {
   const result = await getDb().execute({
     sql: "SELECT * FROM connected_account_billing WHERE user_id = ? LIMIT 1",
@@ -16661,6 +17093,7 @@ async function reconcileConnectedAccountBilling(user, connections) {
     const alreadyCharged = await chargedConnectionIds(user.id, periodStart);
     const unpaid = billableConnectionIds.filter((id) => !alreadyCharged.has(id));
     for (const connectionId of unpaid) {
+      if (await inheritDisconnectedConnectionCharge(user.id, connectionId, periodStart)) continue;
       const feeMc = CONNECTED_ACTIVE_CONNECTION_MONTHLY_MC;
       const debit = await debitMcIdempotent(
         user.id,
@@ -19752,7 +20185,7 @@ var adminAuth = createMiddleware3(async (c, next) => {
 import { Hono as Hono9 } from "hono";
 
 // src/api/admin-credits.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 var MIN_ADJUSTMENT_CREDITS = 1;
 var LARGE_ADJUSTMENT_CREDITS = 1e5;
 var MAX_ADJUSTMENT_CREDITS = 1e7;
@@ -19902,7 +20335,7 @@ async function applyAdjustment(input) {
   const credits = validateCredits(input.credits, input.confirmLarge === true);
   const reason = validateReason(input.reason);
   const actor = validateActor(input.actor);
-  const reference = input.reference?.trim() || `adj_${randomUUID6()}`;
+  const reference = input.reference?.trim() || `adj_${randomUUID7()}`;
   if (reference.length > 120) throw new AdminCreditError(400, "reference must be at most 120 characters");
   const db = getDb();
   const existing = await db.execute({
@@ -22509,17 +22942,17 @@ g2App.post("/reviews", createApiKeyAuth(), async (c) => {
 });
 
 // src/api/directory-routes.ts
-import { createHash as createHash5, randomUUID as randomUUID8 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID9 } from "crypto";
 import { Hono as Hono16 } from "hono";
 
 // src/api/directory-workflow-dispatch.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 function retryDelaySeconds(attempts) {
   return Math.min(60 * 60, Math.max(15, 15 * 2 ** Math.min(8, Math.max(0, attempts - 1))));
 }
 async function dispatchPendingDirectoryWorkflows(limit = 25) {
   const rows = await claimDirectoryWorkflowOutbox({
-    workerId: `directory-dispatch-${process.pid}-${randomUUID7().slice(0, 8)}`,
+    workerId: `directory-dispatch-${process.pid}-${randomUUID8().slice(0, 8)}`,
     limit
   });
   const result = { claimed: rows.length, dispatched: 0, failed: 0 };
@@ -22558,14 +22991,14 @@ function idempotencyKey(raw) {
     if (trimmed.length > 500) return { ok: false, message: "Idempotency-Key must be 500 characters or fewer." };
     return { ok: true, key: trimmed };
   }
-  return { ok: true, key: `directory-${randomUUID8()}` };
+  return { ok: true, key: `directory-${randomUUID9()}` };
 }
 function debitKeyFor(userId, responseKey) {
   const digest2 = createHash5("sha256").update(String(userId)).update("\0").update(responseKey).digest("hex");
   return `directory-workflow:${userId}:${digest2}`;
 }
 function jobId() {
-  return `dir_${randomUUID8().replace(/-/g, "")}`;
+  return `dir_${randomUUID9().replace(/-/g, "")}`;
 }
 function publicStatus(job, result) {
   if (job.status === "failed") return "failed";
@@ -22879,8 +23312,8 @@ import { homedir as homedir3 } from "os";
 import { join as join7 } from "path";
 
 // src/api/lead-list-import-repository.ts
-import { randomUUID as randomUUID9 } from "crypto";
-var schemaDb3 = null;
+import { randomUUID as randomUUID10 } from "crypto";
+var schemaDb4 = null;
 var schemaPromise3 = null;
 function parseJson3(value, fallback) {
   if (value == null) return fallback;
@@ -22945,15 +23378,15 @@ function bounded(value, field, min, max) {
   return normalized;
 }
 function newLeadListUploadId() {
-  return `upl_${randomUUID9().replace(/-/g, "")}`;
+  return `upl_${randomUUID10().replace(/-/g, "")}`;
 }
 function newImportedLeadListId() {
-  return `lst_${randomUUID9().replace(/-/g, "")}`;
+  return `lst_${randomUUID10().replace(/-/g, "")}`;
 }
 async function ensureLeadListImportRepositorySchema() {
   const db = getDb();
-  if (schemaDb3 !== db) {
-    schemaDb3 = db;
+  if (schemaDb4 !== db) {
+    schemaDb4 = db;
     schemaPromise3 = null;
   }
   if (!schemaPromise3) {
@@ -24090,17 +24523,17 @@ leadListInputApp.post("/imports", async (c) => {
 });
 
 // src/api/lead-list-enrichment-routes.ts
-import { createHash as createHash8, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash8, randomUUID as randomUUID12 } from "crypto";
 import { Hono as Hono18 } from "hono";
 import { z as z25 } from "zod";
 
 // src/api/lead-list-enrichment-dispatch.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 function retryDelaySeconds2(attempts) {
   return Math.min(3600, Math.max(15, 15 * 2 ** Math.min(8, Math.max(0, attempts - 1))));
 }
 async function dispatchPendingLeadListEnrichments(limit = 25) {
-  const rows = await claimLeadListEnrichmentOutbox({ workerId: `lead-list-dispatch-${process.pid}-${randomUUID10().slice(0, 8)}`, limit });
+  const rows = await claimLeadListEnrichmentOutbox({ workerId: `lead-list-dispatch-${process.pid}-${randomUUID11().slice(0, 8)}`, limit });
   const result = { claimed: rows.length, dispatched: 0, failed: 0 };
   for (const row of rows) {
     if (!row.claimToken) continue;
@@ -24148,7 +24581,7 @@ function idempotencyKey2(raw) {
   return { ok: true, value };
 }
 function newJobId() {
-  return `lle_${randomUUID11().replace(/-/g, "")}`;
+  return `lle_${randomUUID12().replace(/-/g, "")}`;
 }
 function debitKeyFor2(userId, key) {
   const digest2 = createHash8("sha256").update(String(userId)).update("\0").update(key).digest("hex");
@@ -26158,7 +26591,7 @@ workflowApp.post("/cron/dispatch", async (c) => {
 
 // src/api/serp-intelligence-routes.ts
 import { Hono as Hono22 } from "hono";
-import { createHash as createHash10, randomUUID as randomUUID12 } from "crypto";
+import { createHash as createHash10, randomUUID as randomUUID13 } from "crypto";
 
 // src/serp-intelligence/page-snapshot-extractor.ts
 import { createHash as createHash9 } from "crypto";
@@ -26944,7 +27377,7 @@ async function logRequestEventBestEffort(input) {
   }
 }
 function captureBillingKeys(userId, suppliedKey, body) {
-  const responseKey = suppliedKey?.trim() || randomUUID12();
+  const responseKey = suppliedKey?.trim() || randomUUID13();
   const requestFingerprint3 = createHash10("sha256").update(JSON.stringify(body)).digest("hex");
   const keyDigest = createHash10("sha256").update(String(userId)).update("\0").update(responseKey).digest("hex");
   return {
@@ -27274,7 +27707,7 @@ var MemoryMcpToolExecutor = class {
 };
 
 // src/api/image-source-artifacts.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 var IMAGE_SOURCE_ARTIFACT_PREFIX = "image-sources/";
 var IMAGE_SOURCE_ARTIFACT_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var IMAGE_SOURCE_DOWNLOAD_TTL_MS = 15 * 60 * 1e3;
@@ -27305,7 +27738,7 @@ async function createImageSourceArtifact(args) {
   if (args.content.length === 0 || args.content.length > IMAGE_SOURCE_MAX_BYTES) {
     throw new Error("image_source_size_invalid");
   }
-  const id = randomUUID13().replaceAll("-", "");
+  const id = randomUUID14().replaceAll("-", "");
   return createPrivateArtifact({
     policy: policy3(),
     ownerId: args.ownerId,
@@ -28050,11 +28483,11 @@ mcpApp.all("/", async (c) => {
 });
 
 // src/api/browser-agent-routes.ts
-import { randomUUID as randomUUID17 } from "crypto";
+import { randomUUID as randomUUID18 } from "crypto";
 import { Hono as Hono24 } from "hono";
 
 // src/api/browser-agent-db.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 var _ready = false;
 var _migrationPromise = null;
 async function migrateBrowserAgent() {
@@ -28185,7 +28618,7 @@ async function runBrowserAgentMigration() {
 }
 async function createExtensionRow(input) {
   const db = getDb();
-  const id = `bext_${randomUUID14().replace(/-/g, "").slice(0, 20)}`;
+  const id = `bext_${randomUUID15().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_agent_extensions (id, user_id, name, backend_id, backend_name, source, source_url, size_bytes)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
@@ -28220,7 +28653,7 @@ async function deleteExtensionRow(userId, name) {
 }
 async function createAuthConnectionRow(input) {
   const db = getDb();
-  const connectionId = `authc_${randomUUID14().replace(/-/g, "").slice(0, 20)}`;
+  const connectionId = `authc_${randomUUID15().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_auth_connections (connection_id, domain, profile, account_email, note, status, browser_agent_session_id)
           VALUES (?, ?, ?, ?, ?, 'NEEDS_AUTH', ?)`,
@@ -28305,7 +28738,7 @@ async function deleteProfileLabel(userId, profile) {
 }
 async function createSessionRow(input) {
   const db = getDb();
-  const id = `bas_${randomUUID14().replace(/-/g, "").slice(0, 20)}`;
+  const id = `bas_${randomUUID15().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_agent_sessions (id, runtime_session_id, live_view_url, cdp_ws_url, status, label, user_id, concurrency_lock_id, last_action_at)
           VALUES (?, ?, ?, ?, 'open', ?, ?, ?, datetime('now'))`,
@@ -28383,7 +28816,7 @@ async function recordAction(input) {
     sql: `INSERT INTO browser_agent_actions (id, session_id, type, params_json, ok, error)
           VALUES (?, ?, ?, ?, ?, ?)`,
     args: [
-      `baa_${randomUUID14().replace(/-/g, "").slice(0, 20)}`,
+      `baa_${randomUUID15().replace(/-/g, "").slice(0, 20)}`,
       input.sessionId,
       input.type,
       input.params == null ? null : JSON.stringify(input.params),
@@ -29494,9 +29927,9 @@ async function replayList(runtimeSessionId) {
 }
 
 // src/api/serp-identity-db.ts
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 async function createSerpIdentityRow(input) {
-  const id = `serpi_${randomUUID15().replace(/-/g, "").slice(0, 20)}`;
+  const id = `serpi_${randomUUID16().replace(/-/g, "").slice(0, 20)}`;
   await getDb().execute({
     sql: `INSERT INTO serp_identities
           (id, user_id, name, kernel_profile_name, kernel_proxy_id, proxy_type, country, status)
@@ -29543,7 +29976,7 @@ async function deleteSerpIdentityRow(userId, name) {
 }
 
 // src/api/serp-identity-service.ts
-import { createHash as createHash11, randomUUID as randomUUID16 } from "crypto";
+import { createHash as createHash11, randomUUID as randomUUID17 } from "crypto";
 import Kernel5 from "@onkernel/sdk";
 var MAX_SERP_IDENTITIES_PER_USER = 3;
 function kernelClient() {
@@ -29553,7 +29986,7 @@ function kernelClient() {
 }
 function backendName(userId, name, resource) {
   const digest2 = createHash11("sha256").update(`${userId}:${name}`).digest("hex").slice(0, 16);
-  const nonce = randomUUID16().replace(/-/g, "").slice(0, 8);
+  const nonce = randomUUID17().replace(/-/g, "").slice(0, 8);
   return `mcp-serp-${resource}-${digest2}-${nonce}`;
 }
 function isNotFound2(error) {
@@ -30339,7 +30772,7 @@ function buildBrowserAgentRoutes() {
     }
     const existing = await getExtensionRow(user.id, name);
     if (existing) return c.json({ error: `an extension named "${name}" already exists \u2014 delete it first or pick another name` }, 409);
-    const backendName2 = `u${user.id}_${randomUUID17().replace(/-/g, "")}`;
+    const backendName2 = `u${user.id}_${randomUUID18().replace(/-/g, "")}`;
     try {
       const imported = await importExtensionFromStore(storeUrl, backendName2);
       const row = await createExtensionRow({
@@ -30892,7 +31325,7 @@ async function resolveUser3(customerId, emailFallback) {
 // src/api/oauth-routes.ts
 import { Hono as Hono26 } from "hono";
 import { getCookie, setCookie } from "hono/cookie";
-import { createHash as createHash12, randomBytes as randomBytes3, randomUUID as randomUUID18 } from "crypto";
+import { createHash as createHash12, randomBytes as randomBytes3, randomUUID as randomUUID19 } from "crypto";
 import { importPKCS8, exportJWK, SignJWT } from "jose";
 var ISSUER = "https://mcpscraper.dev";
 var RESOURCE = () => process.env.MCP_MEMORY_RESOURCE_URL ?? "https://memory.mcpscraper.dev/mcp";
@@ -31277,7 +31710,7 @@ function pkceMatches(verifier, challenge) {
 }
 async function mintAccessToken(identity, scope, plan, audience) {
   const { privateKey, kid } = await getKeys();
-  return new SignJWT({ scope, plan }).setProtectedHeader({ alg: "RS256", kid }).setIssuer(ISSUER).setSubject(identity).setAudience(audience).setIssuedAt().setJti(randomUUID18()).setExpirationTime(`${ACCESS_TTL_SECONDS}s`).sign(privateKey);
+  return new SignJWT({ scope, plan }).setProtectedHeader({ alg: "RS256", kid }).setIssuer(ISSUER).setSubject(identity).setAudience(audience).setIssuedAt().setJti(randomUUID19()).setExpirationTime(`${ACCESS_TTL_SECONDS}s`).sign(privateKey);
 }
 function tokenErrorResponse(c, error, description, status) {
   return c.json({ error, error_description: description }, status);
@@ -33727,7 +34160,7 @@ function renderWorkshopFieldNotesBody() {
 }
 
 // src/api/workshop-registration-repository.ts
-import { randomUUID as randomUUID19 } from "crypto";
+import { randomUUID as randomUUID20 } from "crypto";
 function rowToRegistration(row) {
   return {
     id: String(row.id),
@@ -33796,7 +34229,7 @@ async function claimWorkshopRegistration(input) {
       ) < ?
     `,
     args: [
-      randomUUID19(),
+      randomUUID20(),
       input.eventSlug,
       input.email,
       input.firstName,
@@ -33813,7 +34246,7 @@ async function claimWorkshopRegistration(input) {
         id, event_slug, email, first_name, last_name, status
       ) VALUES (?, ?, ?, ?, ?, 'waitlisted')
     `,
-    args: [randomUUID19(), input.eventSlug, input.email, input.firstName, input.lastName || null]
+    args: [randomUUID20(), input.eventSlug, input.email, input.firstName, input.lastName || null]
   });
   const waitlisted = await getWorkshopRegistration(input.eventSlug, input.email);
   if (!waitlisted) throw new Error("workshop registration could not be claimed");
@@ -33828,7 +34261,7 @@ async function registerWorkshopInterest(input) {
         id, event_slug, email, first_name, last_name, status
       ) VALUES (?, ?, ?, ?, ?, 'interested')
     `,
-    args: [randomUUID19(), input.eventSlug, input.email, input.firstName, input.lastName || null]
+    args: [randomUUID20(), input.eventSlug, input.email, input.firstName, input.lastName || null]
   });
   const registration = await getWorkshopRegistration(input.eventSlug, input.email);
   if (!registration) throw new Error("workshop interest could not be recorded");
@@ -34631,7 +35064,7 @@ import { Hono as Hono33 } from "hono";
 import { z as z33 } from "zod";
 
 // src/api/commons-repository.ts
-import { createHash as createHash17, randomUUID as randomUUID20 } from "crypto";
+import { createHash as createHash17, randomUUID as randomUUID21 } from "crypto";
 
 // src/api/commons-image-store.ts
 import { createHash as createHash15 } from "crypto";
@@ -34640,20 +35073,29 @@ import { isIP } from "net";
 var COMMONS_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
 var COMMONS_IMAGE_MAX_REDIRECTS = 3;
 var COMMONS_IMAGE_FETCH_TIMEOUT_MS = 2e4;
+var COMMONS_IMAGE_PAGE_MAX_BYTES = 2 * 1024 * 1024;
+var COMMONS_IMAGE_MAX_PAGE_CANDIDATES = 12;
+var COMMONS_IMAGE_RETRY_GUIDANCE = "Call commons_host_image with imageBase64, an owner-authorized artifactId, a public HTTPS image URL, or a public HTTPS webpage containing a usable featured image. Replace featuredImage.url with the returned permanent URL, validate again, then retry commons_submit_entity with the same idempotency key.";
 var CommonsImageError = class extends Error {
-  constructor(code, message, httpStatus = 400) {
+  constructor(code, message, httpStatus = 400, retryable = false, retryGuidance = COMMONS_IMAGE_RETRY_GUIDANCE) {
     super(message);
     this.code = code;
     this.httpStatus = httpStatus;
+    this.retryable = retryable;
+    this.retryGuidance = retryGuidance;
     this.name = "CommonsImageError";
   }
   code;
   httpStatus;
+  retryable;
+  retryGuidance;
 };
 var imageSchemaReady = false;
+var imageSchemaDb = null;
 async function ensureCommonsImageSchema() {
-  if (imageSchemaReady) return;
-  await getDb().execute(`
+  const db = getDb();
+  if (imageSchemaReady && imageSchemaDb === db) return;
+  await db.execute(`
     CREATE TABLE IF NOT EXISTS commons_images (
       id           TEXT    PRIMARY KEY,
       user_id      INTEGER NOT NULL,
@@ -34669,8 +35111,9 @@ async function ensureCommonsImageSchema() {
       created_at   TEXT    NOT NULL DEFAULT (datetime('now'))
     )
   `);
-  await getDb().execute(`CREATE UNIQUE INDEX IF NOT EXISTS commons_images_digest ON commons_images(digest)`);
+  await db.execute(`CREATE UNIQUE INDEX IF NOT EXISTS commons_images_digest ON commons_images(digest)`);
   imageSchemaReady = true;
+  imageSchemaDb = db;
 }
 function sniffImageFormat(bytes) {
   if (bytes.length < 12) return null;
@@ -34700,44 +35143,85 @@ async function assertPublicHttpsUrl(rawUrl) {
   try {
     url = new URL(rawUrl);
   } catch {
-    throw new CommonsImageError("image_url_invalid", `"${rawUrl}" is not a valid URL.`);
+    throw new CommonsImageError("image_url_invalid", "The image source is not a valid URL.");
   }
   if (url.protocol !== "https:") {
     throw new CommonsImageError("image_url_not_https", "Commons image sources must be https URLs.");
   }
+  if (url.username || url.password) {
+    throw new CommonsImageError("image_url_invalid", "Commons image source URLs cannot contain embedded credentials.");
+  }
   const hostname = url.hostname.replace(/^\[|\]$/g, "");
   const addresses = isIP(hostname) ? [{ address: hostname }] : await dnsLookup(hostname, { all: true }).catch(() => []);
   if (!addresses.length) {
-    throw new CommonsImageError("image_host_unresolvable", `Could not resolve ${url.hostname}.`);
+    throw new CommonsImageError("image_host_unresolvable", "The image source host could not be resolved.");
   }
   if (addresses.some((entry) => isBlockedAddress(entry.address))) {
     throw new CommonsImageError("image_host_blocked", "Commons image sources cannot resolve to private or loopback addresses.");
   }
   return url;
 }
-async function downloadImage(sourceUrl) {
+async function readResponseBytes(response, maxBytes) {
+  const declaredLength = Number(response.headers.get("content-length") ?? "0");
+  if (declaredLength > maxBytes) {
+    throw new CommonsImageError("image_too_large", `Source exceeds the ${maxBytes} byte limit.`, 413);
+  }
+  if (!response.body) return Buffer.alloc(0);
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => void 0);
+      throw new CommonsImageError("image_too_large", `Source exceeds the ${maxBytes} byte limit.`, 413);
+    }
+    chunks.push(Buffer.from(value));
+  }
+  return Buffer.concat(chunks, total);
+}
+async function downloadPublicSource(sourceUrl) {
   let current = sourceUrl;
   for (let redirect = 0; redirect <= COMMONS_IMAGE_MAX_REDIRECTS; redirect += 1) {
     const url = await assertPublicHttpsUrl(current);
-    const response = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(COMMONS_IMAGE_FETCH_TIMEOUT_MS) });
+    let response;
+    try {
+      response = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(COMMONS_IMAGE_FETCH_TIMEOUT_MS) });
+    } catch (error) {
+      if (error instanceof CommonsImageError) throw error;
+      throw new CommonsImageError(
+        "image_source_unavailable",
+        "The image source could not be reached by Commons.",
+        422,
+        true
+      );
+    }
     if (response.status >= 300 && response.status < 400) {
       const location2 = response.headers.get("location");
       if (!location2) throw new CommonsImageError("image_redirect_invalid", "Image source redirected without a destination.");
-      current = new URL(location2, url).toString();
+      try {
+        current = new URL(location2, url).toString();
+      } catch {
+        throw new CommonsImageError("image_redirect_invalid", "Image source redirected to an invalid destination.");
+      }
       continue;
     }
     if (!response.ok) {
-      throw new CommonsImageError("image_source_unavailable", `Image source returned HTTP ${response.status}.`, 422);
-    }
-    const declaredLength = Number(response.headers.get("content-length") ?? "0");
-    if (declaredLength > COMMONS_IMAGE_MAX_BYTES) {
-      throw new CommonsImageError("image_too_large", `Image exceeds the ${COMMONS_IMAGE_MAX_BYTES} byte limit.`, 413);
-    }
-    const bytes = Buffer.from(await response.arrayBuffer());
-    if (bytes.length > COMMONS_IMAGE_MAX_BYTES) {
-      throw new CommonsImageError("image_too_large", `Image exceeds the ${COMMONS_IMAGE_MAX_BYTES} byte limit.`, 413);
+      const retryable = response.status === 408 || response.status === 425 || response.status === 429 || response.status >= 500;
+      throw new CommonsImageError(
+        "image_source_unavailable",
+        `The image source returned HTTP ${response.status} and could not be hosted.`,
+        422,
+        retryable
+      );
     }
-    return bytes;
+    return {
+      bytes: await readResponseBytes(response, COMMONS_IMAGE_MAX_BYTES),
+      finalUrl: url.toString(),
+      contentType: (response.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase()
+    };
   }
   throw new CommonsImageError("image_redirect_limit", "Image source exceeded the redirect limit.");
 }
@@ -34750,21 +35234,161 @@ function decodeBase64Image(value) {
   }
   return bytes;
 }
+function safeProvenanceUrl(rawUrl) {
+  try {
+    const url = new URL(rawUrl);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+function looksLikeHtml(bytes, declaredType) {
+  if (declaredType === "text/html" || declaredType === "application/xhtml+xml") return true;
+  const prefix = bytes.subarray(0, 512).toString("utf8").trimStart().toLowerCase();
+  return prefix.startsWith("<!doctype html") || prefix.startsWith("<html") || prefix.startsWith("<head");
+}
+async function resolveCommonsImageSource(input) {
+  const supplied = [input.sourceUrl, input.imageBase64, input.artifactId].filter((value) => Boolean(value)).length;
+  if (supplied === 0) {
+    throw new CommonsImageError("image_source_missing", "Provide exactly one of sourceUrl, imageBase64, or artifactId.");
+  }
+  if (supplied !== 1) {
+    throw new CommonsImageError("image_source_ambiguous", "Provide only one image source: sourceUrl, imageBase64, or artifactId.");
+  }
+  if (input.sourceUrl && input.sourceType) {
+    throw new CommonsImageError("image_source_type_invalid", "sourceType applies only to imageBase64 or artifactId, not sourceUrl.");
+  }
+  if (input.imageBase64) {
+    return {
+      bytes: decodeBase64Image(input.imageBase64),
+      sourceUrl: null,
+      sourcePageUrl: null,
+      sourceKind: input.sourceType ?? "uploaded",
+      selectionSource: "provided_bytes"
+    };
+  }
+  if (input.artifactId) {
+    const bytes = await readOwnedImageSourceArtifact({ artifactId: input.artifactId, ownerId: String(input.userId) });
+    if (!bytes) {
+      throw new CommonsImageError("image_artifact_not_found", "The image artifact was not found, expired, or is not owned by this account.", 422);
+    }
+    if (bytes.length > COMMONS_IMAGE_MAX_BYTES) {
+      throw new CommonsImageError("image_too_large", `Image exceeds the ${COMMONS_IMAGE_MAX_BYTES} byte limit.`, 413);
+    }
+    return {
+      bytes,
+      sourceUrl: null,
+      sourcePageUrl: null,
+      sourceKind: input.sourceType ?? "artifact",
+      selectionSource: "artifact"
+    };
+  }
+  const requestedUrl = String(input.sourceUrl);
+  const downloaded = await downloadPublicSource(requestedUrl);
+  if (sniffImageFormat(downloaded.bytes)) {
+    return {
+      bytes: downloaded.bytes,
+      sourceUrl: safeProvenanceUrl(downloaded.finalUrl),
+      sourcePageUrl: null,
+      sourceKind: "direct_url",
+      selectionSource: "direct_url"
+    };
+  }
+  if (!looksLikeHtml(downloaded.bytes, downloaded.contentType)) {
+    throw new CommonsImageError(
+      "image_format_unsupported",
+      "The supplied URL returned neither a supported image nor an HTML webpage with a discoverable image.",
+      415
+    );
+  }
+  if (downloaded.bytes.length > COMMONS_IMAGE_PAGE_MAX_BYTES) {
+    throw new CommonsImageError("image_page_too_large", `Webpage exceeds the ${COMMONS_IMAGE_PAGE_MAX_BYTES} byte discovery limit.`, 413);
+  }
+  const html = downloaded.bytes.toString("utf8");
+  const document2 = loadHtmlDocument(html);
+  const candidates = resolveFeaturedImageCandidates({
+    html,
+    meta: document2.meta,
+    schema: document2.schema,
+    pageUrl: downloaded.finalUrl
+  }).slice(0, COMMONS_IMAGE_MAX_PAGE_CANDIDATES);
+  if (!candidates.length) {
+    throw new CommonsImageError("page_image_not_found", "The webpage did not expose a usable featured or content image.", 422);
+  }
+  let sawRetryableFailure = false;
+  for (const candidate of candidates) {
+    try {
+      const image = await downloadPublicSource(candidate.url);
+      if (!sniffImageFormat(image.bytes)) continue;
+      return {
+        bytes: image.bytes,
+        sourceUrl: safeProvenanceUrl(image.finalUrl),
+        sourcePageUrl: safeProvenanceUrl(downloaded.finalUrl),
+        sourceKind: "webpage",
+        selectionSource: candidate.source
+      };
+    } catch (error) {
+      if (error instanceof CommonsImageError && error.retryable) sawRetryableFailure = true;
+    }
+  }
+  throw new CommonsImageError(
+    "page_image_candidates_unusable",
+    "The webpage exposed image candidates, but none returned supported public image bytes.",
+    422,
+    sawRetryableFailure
+  );
+}
 function commonsImageBlobStore() {
   const token6 = process.env.COMMONS_IMAGE_READ_WRITE_TOKEN?.trim() || process.env.COMMONS_IMAGE_BLOB_READ_WRITE_TOKEN?.trim() || process.env.BLOB_READ_WRITE_TOKEN?.trim();
   return token6 ? new VercelBlobStore(token6) : getBlobStore();
 }
-function isCommonsHostedImageUrl(url) {
-  return /^https:\/\/[^/]*(\.public\.blob\.vercel-storage\.com|blob\.vercel-storage\.com)\//i.test(url);
+function normalizeCommonsImageUrl(rawUrl) {
+  try {
+    const url = new URL(rawUrl.trim());
+    if (url.protocol !== "https:") return null;
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+async function findCommonsHostedImageByUrl(rawUrl) {
+  const url = normalizeCommonsImageUrl(rawUrl);
+  if (!url) return null;
+  await ensureCommonsImageSchema();
+  const result = await getDb().execute({
+    sql: "SELECT id, url, content_type, bytes, digest, source_url FROM commons_images WHERE url = ? LIMIT 1",
+    args: [url]
+  });
+  const row = result.rows[0];
+  if (!row) return null;
+  return {
+    id: String(row.id),
+    url: String(row.url),
+    contentType: String(row.content_type),
+    bytes: Number(row.bytes),
+    digest: String(row.digest),
+    sourceUrl: row.source_url ? String(row.source_url) : null,
+    sourcePageUrl: null,
+    sourceKind: "registered",
+    selectionSource: "registered",
+    reused: true
+  };
 }
 var hostOverride = null;
 async function hostCommonsImage(input) {
   if (hostOverride) return hostOverride(input);
   await ensureCommonsImageSchema();
-  if (!input.sourceUrl && !input.imageBase64) {
-    throw new CommonsImageError("image_source_missing", "Provide either sourceUrl or imageBase64.");
+  if (input.sourceUrl && !input.imageBase64 && !input.artifactId && !input.sourceType) {
+    const registered6 = await findCommonsHostedImageByUrl(input.sourceUrl);
+    if (registered6) return registered6;
   }
-  const bytes = input.imageBase64 ? decodeBase64Image(input.imageBase64) : await downloadImage(String(input.sourceUrl));
+  const resolved = await resolveCommonsImageSource(input);
+  const bytes = resolved.bytes;
   const contentType = sniffImageFormat(bytes);
   if (!contentType) {
     throw new CommonsImageError(
@@ -34786,7 +35410,10 @@ async function hostCommonsImage(input) {
       contentType: String(reusable.content_type),
       bytes: Number(reusable.bytes),
       digest: digest2,
-      sourceUrl: reusable.source_url ? String(reusable.source_url) : null,
+      sourceUrl: resolved.sourceUrl,
+      sourcePageUrl: resolved.sourcePageUrl,
+      sourceKind: resolved.sourceKind,
+      selectionSource: resolved.selectionSource,
       reused: true
     };
   }
@@ -34815,19 +35442,31 @@ async function hostCommonsImage(input) {
       stored.url,
       contentType,
       bytes.length,
-      input.sourceUrl ?? null,
+      resolved.sourceUrl,
       input.alt ?? null,
       input.license ?? null,
       input.attribution ?? null,
       (/* @__PURE__ */ new Date()).toISOString()
     ]
   });
-  return { id, url: stored.url, contentType, bytes: bytes.length, digest: digest2, sourceUrl: input.sourceUrl ?? null, reused: false };
+  return {
+    id,
+    url: stored.url,
+    contentType,
+    bytes: bytes.length,
+    digest: digest2,
+    sourceUrl: resolved.sourceUrl,
+    sourcePageUrl: resolved.sourcePageUrl,
+    sourceKind: resolved.sourceKind,
+    selectionSource: resolved.selectionSource,
+    reused: false
+  };
 }
 async function hostEntityImages(input) {
   const rewrite = { mediaUrls: /* @__PURE__ */ new Map(), dropped: [] };
   const featuredUrl = input.featuredImage?.url;
-  if (featuredUrl && !isCommonsHostedImageUrl(featuredUrl)) {
+  const registeredFeatured = featuredUrl ? await findCommonsHostedImageByUrl(featuredUrl) : null;
+  if (featuredUrl && !registeredFeatured) {
     const hosted = await hostCommonsImage({
       userId: input.userId,
       sourceUrl: featuredUrl,
@@ -34835,17 +35474,19 @@ async function hostEntityImages(input) {
       license: input.featuredImage?.license,
       attribution: input.featuredImage?.sourceUrl
     }).catch((error) => {
-      const message = error instanceof Error ? error.message : String(error);
+      if (error instanceof CommonsImageError) throw error;
       throw new CommonsImageError(
-        error instanceof CommonsImageError ? error.code : "featured_image_unhostable",
-        `The featured image could not be hosted, so this entity would publish with a link that can break: ${message}`,
+        "featured_image_unhostable",
+        "The featured image could not be hosted, so the entity was not persisted with a link that could break.",
         422
       );
     });
     rewrite.featuredImageUrl = hosted.url;
+    rewrite.mediaUrls.set(featuredUrl, hosted.url);
   }
   for (const item of input.media ?? []) {
-    if (!item.url || isCommonsHostedImageUrl(item.url)) continue;
+    if (item.url && rewrite.mediaUrls.has(item.url)) continue;
+    if (!item.url || await findCommonsHostedImageByUrl(item.url)) continue;
     try {
       const hosted = await hostCommonsImage({
         userId: input.userId,
@@ -35213,7 +35854,7 @@ var COMMONS_ENTITY_PROFILES = {
     ]
   }
 };
-var schemaReady = false;
+var schemaReady2 = false;
 var COMMONS_SCHEMA_OBJECTS = [
   "schema_migrations",
   "commons_entities",
@@ -35240,9 +35881,9 @@ var COMMONS_SCHEMA_OBJECTS = [
   "commons_publication_editions_publication_published"
 ];
 async function ensureCommonsSchema() {
-  if (schemaReady) return;
+  if (schemaReady2) return;
   if (await schemaObjectsPresent(COMMONS_SCHEMA_OBJECTS)) {
-    schemaReady = true;
+    schemaReady2 = true;
     return;
   }
   const db = getDb();
@@ -35465,7 +36106,7 @@ async function ensureCommonsSchema() {
       args: [COMMONS_SCHEMA_VERSION]
     }
   ], "write");
-  schemaReady = true;
+  schemaReady2 = true;
 }
 async function searchCommonsEntities(filters = {}, userId) {
   await ensureCommonsSchema();
@@ -35674,7 +36315,7 @@ async function prepareCommonsEntity(input, user) {
       normalizedEntityType: entityType,
       proposedSlug: slug4 || null,
       publicUrl: slug4 ? publicUrlForSlug(slug4) : null,
-      writePath: "commons_prepare_entity -> commons_validate_entity -> commons_submit_entity"
+      writePath: "commons_prepare_entity -> compose the entity -> commons_host_image -> commons_validate_entity -> commons_submit_entity"
     },
     contract,
     billing: {
@@ -35696,8 +36337,8 @@ async function prepareCommonsEntity(input, user) {
       "Search likely duplicates before submitting a new entity. If one matches, edit it with entityId and baseRevision instead of creating another page.",
       "Use the returned profile as a contract, not a rigid empty template: do not include History, Reception, Pricing, Timeline, or similar sections unless source evidence supports them.",
       "Write neutral encyclopedia prose. Do not paste raw scrape Markdown, marketing layout fragments, or empty/filler headings.",
-      "Attach a featured image for auto-publish eligibility, preserve original URL/source byline/relCanonical when republishing, and put media assets in the media array.",
-      "Call commons_validate_entity with the composed payload before commons_submit_entity.",
+      "For a featured image not already hosted by Commons, call commons_host_image and replace featuredImage.url with its returned permanent URL. Preserve original URL/source byline/relCanonical when republishing, and put media assets in the media array.",
+      "Call commons_validate_entity with the composed, image-ready payload before commons_submit_entity.",
       "Validation is free. Submitting a new entity costs 10 Credits; submitting an edit to an existing entity costs 2 Credits."
     ]
   };
@@ -35712,6 +36353,8 @@ async function validateCommonsEntity(input, user) {
   const contract = commonsEntityProfileFor(input.entityType, input.seo?.schemaOrgType);
   const source = normalizeSource(input.source);
   const featuredImage = normalizeFeaturedImage(input.featuredImage);
+  const normalizedFeaturedImageUrl = featuredImage?.url ? normalizeCommonsImageUrl(featuredImage.url) : null;
+  const registeredFeaturedImage = normalizedFeaturedImageUrl ? await findCommonsHostedImageByUrl(normalizedFeaturedImageUrl) : null;
   const bodyMarkdown = safeCandidateBody(input.bodyMarkdown, input.contentSections);
   const headings = extractMarkdownHeadings(bodyMarkdown);
   const placeholderSections = unsupportedPlaceholderSections(bodyMarkdown);
@@ -35749,15 +36392,44 @@ async function validateCommonsEntity(input, user) {
   if (input.reviewPolicy === "always_review") {
     warnings.push("reviewPolicy is always_review, so the proposal will not auto-publish even if the payload is otherwise valid.");
   }
+  if (featuredImage?.url && !registeredFeaturedImage) {
+    warnings.push("The featured image is not registered in permanent Commons image storage. Call commons_host_image, replace featuredImage.url with its returned URL, and validate again before submitting.");
+  }
   if (user?.id == null) warnings.push("No authenticated user was supplied to validation; submit still requires API-key authenticated user context.");
   const valid = errors.length === 0;
-  const autoPublishEligible = valid && input.reviewPolicy !== "always_review";
+  const imageReadyForPublish = Boolean(registeredFeaturedImage);
+  const publishable = valid && imageReadyForPublish;
+  const autoPublishEligible = publishable && input.reviewPolicy !== "always_review";
   const tagVocabulary = await commonsTagVocabulary();
   return {
     ok: true,
     valid,
-    publishable: valid,
+    publishable,
     autoPublishEligible,
+    imageDiagnostics: {
+      featuredImage: registeredFeaturedImage ? {
+        state: "commons_hosted",
+        url: registeredFeaturedImage.url,
+        commonsImageId: registeredFeaturedImage.id,
+        readyForPublish: true,
+        submitWillAttemptAutoHost: false,
+        requiredAction: null
+      } : featuredImage?.url ? {
+        state: "external_unhosted",
+        url: normalizedFeaturedImageUrl,
+        commonsImageId: null,
+        readyForPublish: false,
+        submitWillAttemptAutoHost: true,
+        requiredAction: "Call commons_host_image, replace featuredImage.url with its returned permanent URL, and validate again."
+      } : {
+        state: "missing",
+        url: null,
+        commonsImageId: null,
+        readyForPublish: false,
+        submitWillAttemptAutoHost: false,
+        requiredAction: "Add a featured image by calling commons_host_image, then set featuredImage.url to its returned permanent URL."
+      }
+    },
     errors,
     warnings,
     contract,
@@ -35838,7 +36510,7 @@ async function submitCommonsEntity(input, user) {
   const existingClaims = existing && normalized.claims !== void 0 ? await getCommonsClaimsByEntityId(existing.id) : [];
   const safety = evaluatePublishSafety(normalized, existing);
   const shouldApply = safety.safe && normalized.reviewPolicy !== "always_review";
-  const proposalId = `commons-proposal-${randomUUID20()}`;
+  const proposalId = `commons-proposal-${randomUUID21()}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const entityId = existing?.id ?? normalized.entityId ?? allocateEntityId();
   const proposalStatus = shouldApply ? "accepted" : "pending_review";
@@ -35893,7 +36565,7 @@ async function submitCommonsEntity(input, user) {
         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       `,
       args: [
-        `commons-ledger-${randomUUID20()}`,
+        `commons-ledger-${randomUUID21()}`,
         nextEntity.id,
         proposalId,
         user.id,
@@ -35999,7 +36671,7 @@ async function saveCommonsFilter(input, user) {
     sql: "SELECT id FROM commons_saved_filters WHERE user_id = ? AND name = ? LIMIT 1",
     args: [user.id, name]
   });
-  const id = existing.rows[0]?.id != null ? String(existing.rows[0].id) : `commons-filter-${randomUUID20()}`;
+  const id = existing.rows[0]?.id != null ? String(existing.rows[0].id) : `commons-filter-${randomUUID21()}`;
   await getDb().execute({
     sql: `
       INSERT INTO commons_saved_filters (id, user_id, name, description, filter_json, created_at, updated_at)
@@ -37355,7 +38027,7 @@ var CommonsRepositoryError = class extends Error {
 };
 
 // src/api/commons-publication-repository.ts
-import { createHash as createHash18, randomUUID as randomUUID21 } from "crypto";
+import { createHash as createHash18, randomUUID as randomUUID22 } from "crypto";
 
 // src/editorial-reading-room/article-page.ts
 function escapeHtml6(value) {
@@ -37568,7 +38240,7 @@ async function claimCommonsPublication(input, user) {
   }
   const existingName = await getCommonsPublicationBySubdomain(subdomain);
   if (existingName) throw new CommonsPublicationError("publication_name_unavailable", "That publication name is already claimed.", 409);
-  const id = `tcpub_${randomUUID21()}`;
+  const id = `tcpub_${randomUUID22()}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   try {
     await getDb().execute({
@@ -37620,7 +38292,7 @@ async function publishCommonsEditorial(input, user) {
   const canonicalUrl = editionPublicUrl(subdomain, editionSlug);
   const rendered = renderEditorialReadingRoom(editionInput);
   const html = addPublicMetadata(rendered.html, canonicalUrl, publication.title);
-  const editionId = `tced_${randomUUID21()}`;
+  const editionId = `tced_${randomUUID22()}`;
   const revision = (latest?.revision ?? 0) + 1;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   await getDb().batch([
@@ -37702,7 +38374,7 @@ async function updateCommonsEditorialArticle(input, user) {
   const canonicalUrl = editionPublicUrl(subdomain, editionSlug);
   const rendered = renderEditorialReadingRoom(editionInput);
   const html = addPublicMetadata(rendered.html, canonicalUrl, publication.title);
-  const editionId = `tced_${randomUUID21()}`;
+  const editionId = `tced_${randomUUID22()}`;
   const revision = latest.revision + 1;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   await getDb().batch([
@@ -38222,11 +38894,13 @@ commonsApp.get("/publications/:subdomain", async (c) => {
 var HostImageSchema = z33.object({
   sourceUrl: z33.string().url().optional(),
   imageBase64: z33.string().min(16).optional(),
+  artifactId: z33.string().min(1).max(500).optional(),
+  sourceType: z33.enum(["uploaded", "ai_generated"]).optional(),
   alt: z33.string().max(500).optional(),
   license: z33.string().max(240).optional(),
   attribution: z33.string().max(500).optional()
-}).strict().refine((body) => Boolean(body.sourceUrl || body.imageBase64), {
-  message: "Provide either sourceUrl or imageBase64."
+}).strict().refine((body) => [body.sourceUrl, body.imageBase64, body.artifactId].filter(Boolean).length === 1, {
+  message: "Provide exactly one of sourceUrl, imageBase64, or artifactId."
 });
 commonsApp.post("/images", auth2, async (c) => {
   const parsed = HostImageSchema.safeParse(await c.req.json().catch(() => ({})));
@@ -38236,7 +38910,7 @@ commonsApp.post("/images", auth2, async (c) => {
     return c.json({ ok: true, data: hosted }, hosted.reused ? 200 : 201);
   } catch (error) {
     if (error instanceof CommonsImageError) {
-      return c.json({ ok: false, error: error.code, message: error.message }, error.httpStatus);
+      return imageErrorResponse(c, error);
     }
     throw error;
   }
@@ -38300,7 +38974,14 @@ commonsApp.post("/entities/propose", auth2, async (c) => {
     }
     return c.json({ ok: true, data: result, billing: publicListingWriteBilling(billing) }, 201);
   } catch (error) {
-    if (billing) await refundListingWrite(billing, "Transparent Commons write failed before persistence.").catch(() => null);
+    let chargeStatus = billing ? billing.duplicate ? "not_charged" : "refund_pending" : "not_charged";
+    if (billing && !billing.duplicate) {
+      const settlement = await refundListingWrite(billing, "Transparent Commons write failed before persistence.").catch(() => null);
+      if (settlement) chargeStatus = "refunded";
+    }
+    if (error instanceof CommonsImageError) {
+      return imageErrorResponse(c, error, chargeStatus);
+    }
     if (error instanceof CommonsRepositoryError) {
       return c.json({ ok: false, error: error.code, message: error.message }, repositoryStatus(error));
     }
@@ -38433,6 +39114,18 @@ function repositoryStatus(error) {
   if (error.httpStatus === 409) return 409;
   return 400;
 }
+function imageErrorResponse(c, error, chargeStatus) {
+  return c.json({
+    ok: false,
+    error: error.code,
+    error_code: error.code,
+    error_type: "invalid_request",
+    retryable: error.retryable,
+    ...chargeStatus ? { charge_status: chargeStatus } : {},
+    message: `${error.message} ${error.retryGuidance}`,
+    details: { retry_guidance: error.retryGuidance }
+  }, error.httpStatus);
+}
 async function publicationOperation(c, operation, successStatus = 200) {
   try {
     return c.json({ ok: true, data: await operation() }, successStatus);
@@ -40172,10 +40865,10 @@ function scheduledArtifactOwnerIdForApiKey(apiKey) {
 }
 
 // src/api/scheduled-run-view-links.ts
-import { createHash as createHash22, randomBytes as randomBytes5, randomUUID as randomUUID22 } from "crypto";
-var schemaReady2 = false;
+import { createHash as createHash22, randomBytes as randomBytes5, randomUUID as randomUUID23 } from "crypto";
+var schemaReady3 = false;
 async function ensureScheduledRunViewLinksSchema() {
-  if (schemaReady2) return;
+  if (schemaReady3) return;
   const db = getDb();
   await db.execute(`
     CREATE TABLE IF NOT EXISTS scheduled_run_view_links (
@@ -40223,7 +40916,7 @@ async function ensureScheduledRunViewLinksSchema() {
     CREATE INDEX IF NOT EXISTS scheduled_run_view_links_expiry
     ON scheduled_run_view_links(expires_at, revoked_at)
   `);
-  schemaReady2 = true;
+  schemaReady3 = true;
 }
 function tokenHash2(token6) {
   return createHash22("sha256").update(token6).digest("hex");
@@ -40248,7 +40941,7 @@ async function createScheduledRunViewLink(input) {
   const now = input.now ?? /* @__PURE__ */ new Date();
   const token6 = randomBytes5(32).toString("base64url");
   const record = {
-    shareId: randomUUID22(),
+    shareId: randomUUID23(),
     ownerId: input.ownerId,
     runId: input.runId,
     artifactId: input.artifactId,
@@ -41116,352 +41809,6 @@ import { Hono as Hono37 } from "hono";
 
 // src/api/scheduler-integration-auth.ts
 import { createHash as createHash28, createHmac as createHmac4, timingSafeEqual as timingSafeEqual3 } from "crypto";
-
-// src/api/service-connections.ts
-import { randomUUID as randomUUID23 } from "crypto";
-var schemaReady3 = null;
-var schemaDb4 = null;
-function ensureServiceConnectionsSchema() {
-  const currentDb = getDb();
-  if (schemaReady3 && schemaDb4 === currentDb) return schemaReady3;
-  schemaDb4 = currentDb;
-  schemaReady3 = (async () => {
-    const db = currentDb;
-    await db.execute(`
-      CREATE TABLE IF NOT EXISTS service_connections (
-        id                         TEXT PRIMARY KEY,
-        user_id                    INTEGER NOT NULL REFERENCES users(id),
-        provider_config_key        TEXT NOT NULL,
-        provider                   TEXT,
-        transport                  TEXT NOT NULL,
-        upstream_connection_id     TEXT,
-        label                      TEXT,
-        user_label                 TEXT,
-        provider_account_id        TEXT,
-        provider_account_email     TEXT,
-        provider_account_name      TEXT,
-        provider_identity_checked_at TEXT,
-        provider_identity_source_updated_at TEXT,
-        lifecycle_status           TEXT NOT NULL DEFAULT 'pending',
-        operational_status         TEXT NOT NULL DEFAULT 'unknown',
-        reconnect_required         INTEGER NOT NULL DEFAULT 0,
-        actions_enabled            INTEGER NOT NULL DEFAULT 0,
-        read_tools_json            TEXT NOT NULL DEFAULT '[]',
-        action_tools_json          TEXT NOT NULL DEFAULT '[]',
-        tool_revision              TEXT,
-        last_checked_at            TEXT,
-        last_successful_call_at    TEXT,
-        last_failure_at            TEXT,
-        last_failure_code          TEXT,
-        last_failure_retryable     INTEGER,
-        consecutive_failures       INTEGER NOT NULL DEFAULT 0,
-        vault_name                 TEXT,
-        table_name                 TEXT,
-        legacy_owner_identity      TEXT,
-        created_at                 TEXT NOT NULL DEFAULT (datetime('now')),
-        updated_at                 TEXT NOT NULL DEFAULT (datetime('now')),
-        UNIQUE(user_id, provider_config_key, upstream_connection_id)
-      )
-    `);
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN user_label TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_id TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_email TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_name TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_checked_at TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_source_updated_at TEXT`);
-    } catch {
-    }
-    await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_user_updated ON service_connections(user_id, updated_at DESC)`);
-    await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_upstream ON service_connections(provider_config_key, upstream_connection_id)`);
-    await db.execute(`
-      CREATE TABLE IF NOT EXISTS service_connection_health_events (
-        id                    TEXT PRIMARY KEY,
-        connection_id         TEXT NOT NULL REFERENCES service_connections(id) ON DELETE CASCADE,
-        operational_status    TEXT NOT NULL,
-        failure_code          TEXT,
-        retryable             INTEGER,
-        evidence_source       TEXT NOT NULL,
-        created_at            TEXT NOT NULL DEFAULT (datetime('now'))
-      )
-    `);
-    await db.execute(`CREATE INDEX IF NOT EXISTS service_connection_health_events_connection ON service_connection_health_events(connection_id, created_at DESC)`);
-    await db.execute(`
-      CREATE TABLE IF NOT EXISTS service_connection_action_audit (
-        id                    TEXT PRIMARY KEY,
-        connection_id         TEXT NOT NULL REFERENCES service_connections(id) ON DELETE CASCADE,
-        user_id               INTEGER NOT NULL REFERENCES users(id),
-        tool                  TEXT NOT NULL,
-        request_id            TEXT NOT NULL,
-        status                TEXT NOT NULL,
-        error_code            TEXT,
-        created_at            TEXT NOT NULL DEFAULT (datetime('now')),
-        UNIQUE(user_id, request_id)
-      )
-    `);
-    try {
-      await db.execute(`ALTER TABLE service_connection_action_audit ADD COLUMN request_digest TEXT`);
-    } catch {
-    }
-    try {
-      await db.execute(`ALTER TABLE service_connection_action_audit ADD COLUMN result_json TEXT`);
-    } catch {
-    }
-  })().catch((error) => {
-    schemaReady3 = null;
-    schemaDb4 = null;
-    throw error;
-  });
-  return schemaReady3;
-}
-function parseTools(value) {
-  if (typeof value !== "string") return [];
-  try {
-    const parsed = JSON.parse(value);
-    return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
-  } catch {
-    return [];
-  }
-}
-function rowToRecord(row) {
-  return {
-    id: String(row.id),
-    userId: Number(row.user_id),
-    providerConfigKey: String(row.provider_config_key),
-    provider: typeof row.provider === "string" ? row.provider : null,
-    transport: row.transport === "remote_mcp" ? "remote_mcp" : "nango",
-    upstreamConnectionId: typeof row.upstream_connection_id === "string" ? row.upstream_connection_id : null,
-    label: typeof row.label === "string" ? row.label : null,
-    userLabel: typeof row.user_label === "string" ? row.user_label : null,
-    providerAccountId: typeof row.provider_account_id === "string" ? row.provider_account_id : null,
-    providerAccountEmail: typeof row.provider_account_email === "string" ? row.provider_account_email : null,
-    providerAccountName: typeof row.provider_account_name === "string" ? row.provider_account_name : null,
-    providerIdentityCheckedAt: typeof row.provider_identity_checked_at === "string" ? row.provider_identity_checked_at : null,
-    providerIdentitySourceUpdatedAt: typeof row.provider_identity_source_updated_at === "string" ? row.provider_identity_source_updated_at : null,
-    lifecycleStatus: String(row.lifecycle_status),
-    operationalStatus: String(row.operational_status),
-    reconnectRequired: Number(row.reconnect_required) === 1,
-    actionsEnabled: Number(row.actions_enabled) === 1,
-    readTools: parseTools(row.read_tools_json),
-    actionTools: parseTools(row.action_tools_json),
-    toolRevision: typeof row.tool_revision === "string" ? row.tool_revision : null,
-    lastCheckedAt: typeof row.last_checked_at === "string" ? row.last_checked_at : null,
-    lastSuccessfulCallAt: typeof row.last_successful_call_at === "string" ? row.last_successful_call_at : null,
-    lastFailureAt: typeof row.last_failure_at === "string" ? row.last_failure_at : null,
-    lastFailureCode: typeof row.last_failure_code === "string" ? row.last_failure_code : null,
-    lastFailureRetryable: row.last_failure_retryable === null || row.last_failure_retryable === void 0 ? null : Number(row.last_failure_retryable) === 1,
-    consecutiveFailures: Number(row.consecutive_failures ?? 0),
-    vaultName: typeof row.vault_name === "string" ? row.vault_name : null,
-    tableName: typeof row.table_name === "string" ? row.table_name : null,
-    createdAt: String(row.created_at),
-    updatedAt: String(row.updated_at)
-  };
-}
-async function userIdForIdentity(identity) {
-  const user = await getUserByEmail(identity.normalize("NFKC").trim().toLowerCase());
-  if (!user) throw new Error("service_connection_user_not_found");
-  return Number(user.id);
-}
-async function reconcileDiscoveredNangoConnections(identity, discovered) {
-  await ensureServiceConnectionsSchema();
-  const db = getDb();
-  const userId = await userIdForIdentity(identity);
-  for (const connection of discovered) {
-    await db.execute({
-      sql: `
-        INSERT INTO service_connections (
-          id, user_id, provider_config_key, provider, transport, upstream_connection_id,
-          label, lifecycle_status, reconnect_required, actions_enabled, legacy_owner_identity, created_at, updated_at
-        ) VALUES (?, ?, ?, ?, 'nango', ?, ?, ?, ?, 1, ?, COALESCE(?, datetime('now')), COALESCE(?, datetime('now')))
-        ON CONFLICT(user_id, provider_config_key, upstream_connection_id) DO UPDATE SET
-          provider = excluded.provider,
-          label = COALESCE(excluded.label, service_connections.label),
-          lifecycle_status = excluded.lifecycle_status,
-          reconnect_required = excluded.reconnect_required,
-          updated_at = excluded.updated_at
-      `,
-      args: [
-        randomUUID23(),
-        userId,
-        connection.providerConfigKey,
-        connection.provider,
-        connection.upstreamConnectionId,
-        connection.label,
-        connection.lifecycleStatus,
-        connection.reconnectRequired ? 1 : 0,
-        identity,
-        connection.createdAt,
-        connection.updatedAt
-      ]
-    });
-  }
-  return listServiceConnections(identity, "nango");
-}
-async function listServiceConnections(identity, transport) {
-  await ensureServiceConnectionsSchema();
-  const userId = await userIdForIdentity(identity);
-  const result = await getDb().execute({
-    sql: `SELECT * FROM service_connections WHERE user_id = ?${transport ? " AND transport = ?" : ""} AND lifecycle_status <> 'disconnected' ORDER BY updated_at DESC`,
-    args: transport ? [userId, transport] : [userId]
-  });
-  return result.rows.map((row) => rowToRecord(row));
-}
-async function getOwnedServiceConnection(identity, connectionId) {
-  await ensureServiceConnectionsSchema();
-  const userId = await userIdForIdentity(identity);
-  const result = await getDb().execute({
-    sql: "SELECT * FROM service_connections WHERE id = ? AND user_id = ? LIMIT 1",
-    args: [connectionId, userId]
-  });
-  const row = result.rows[0];
-  return row ? rowToRecord(row) : null;
-}
-async function updateServiceConnectionTools(connectionId, readTools, actionTools, toolRevision) {
-  await ensureServiceConnectionsSchema();
-  await getDb().execute({
-    sql: `UPDATE service_connections SET read_tools_json = ?, action_tools_json = ?, tool_revision = ?, updated_at = datetime('now') WHERE id = ?`,
-    args: [JSON.stringify(readTools), JSON.stringify(actionTools), toolRevision, connectionId]
-  });
-}
-async function setServiceConnectionProviderIdentity(args) {
-  await ensureServiceConnectionsSchema();
-  await getDb().execute({
-    sql: `
-      UPDATE service_connections SET
-        provider_account_id = ?, provider_account_email = ?, provider_account_name = ?,
-        provider_identity_checked_at = datetime('now'), provider_identity_source_updated_at = ?,
-        updated_at = datetime('now')
-      WHERE id = ?
-    `,
-    args: [
-      args.providerAccountId ?? null,
-      args.providerAccountEmail?.toLowerCase() ?? null,
-      args.providerAccountName ?? null,
-      args.sourceUpdatedAt,
-      args.connectionId
-    ]
-  });
-}
-async function setServiceConnectionUserLabel(identity, connectionId, userLabel) {
-  const connection = await getOwnedServiceConnection(identity, connectionId);
-  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
-  await getDb().execute({
-    sql: `UPDATE service_connections SET user_label = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
-    args: [userLabel, connectionId, connection.userId]
-  });
-  return userLabel;
-}
-async function recordServiceConnectionHealth(args) {
-  await ensureServiceConnectionsSchema();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  await getDb().execute({
-    sql: `
-      UPDATE service_connections SET
-        operational_status = ?, last_checked_at = ?,
-        last_successful_call_at = CASE WHEN ? = 'available' THEN ? ELSE last_successful_call_at END,
-        last_failure_at = CASE WHEN ? IN ('degraded', 'unavailable') THEN ? ELSE NULL END,
-        last_failure_code = ?, last_failure_retryable = ?,
-        consecutive_failures = CASE WHEN ? = 'available' THEN 0 ELSE consecutive_failures + 1 END,
-        updated_at = datetime('now')
-      WHERE id = ?
-    `,
-    args: [
-      args.operationalStatus,
-      now,
-      args.operationalStatus,
-      now,
-      args.operationalStatus,
-      now,
-      args.failureCode ?? null,
-      args.retryable == null ? null : args.retryable ? 1 : 0,
-      args.operationalStatus,
-      args.connectionId
-    ]
-  });
-  await getDb().execute({
-    sql: `INSERT INTO service_connection_health_events (id, connection_id, operational_status, failure_code, retryable, evidence_source) VALUES (?, ?, ?, ?, ?, ?)`,
-    args: [randomUUID23(), args.connectionId, args.operationalStatus, args.failureCode ?? null, args.retryable == null ? null : args.retryable ? 1 : 0, args.evidenceSource]
-  });
-}
-async function setServiceConnectionActions(identity, connectionId, enabled) {
-  const connection = await getOwnedServiceConnection(identity, connectionId);
-  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
-  await getDb().execute({
-    sql: `UPDATE service_connections SET actions_enabled = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
-    args: [enabled ? 1 : 0, connectionId, connection.userId]
-  });
-  return enabled;
-}
-async function markServiceConnectionDisconnected(identity, connectionId) {
-  const connection = await getOwnedServiceConnection(identity, connectionId);
-  if (!connection) throw new Error("service_connection_not_found");
-  await getDb().execute({
-    sql: `UPDATE service_connections SET lifecycle_status = 'disconnected', operational_status = 'unknown', reconnect_required = 0, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
-    args: [connectionId, connection.userId]
-  });
-  const remaining = await getDb().execute({
-    sql: `SELECT COUNT(*) AS count FROM service_connections WHERE user_id = ? AND transport = 'nango' AND lifecycle_status = 'connected'`,
-    args: [connection.userId]
-  });
-  return Number(remaining.rows[0]?.count ?? 0);
-}
-async function recordServiceConnectionAction(args) {
-  await ensureServiceConnectionsSchema();
-  const connection = await getOwnedServiceConnection(args.identity, args.connectionId);
-  if (!connection) throw new Error("service_connection_not_found");
-  await getDb().execute({
-    sql: `UPDATE service_connection_action_audit SET status = ?, error_code = ?, result_json = ? WHERE user_id = ? AND request_id = ? AND connection_id = ?`,
-    args: [args.status, args.errorCode ?? null, args.result === void 0 ? null : JSON.stringify(args.result), connection.userId, args.requestId, connection.id]
-  });
-}
-async function claimServiceConnectionAction(args) {
-  await ensureServiceConnectionsSchema();
-  const connection = await getOwnedServiceConnection(args.identity, args.connectionId);
-  if (!connection) throw new Error("service_connection_not_found");
-  const inserted = await getDb().execute({
-    sql: `INSERT OR IGNORE INTO service_connection_action_audit (id, connection_id, user_id, tool, request_id, status, request_digest) VALUES (?, ?, ?, ?, ?, 'started', ?)`,
-    args: [randomUUID23(), connection.id, connection.userId, args.tool, args.requestId, args.requestDigest]
-  });
-  if (Number(inserted.rowsAffected ?? 0) === 1) return { claimed: true };
-  const existing = await getDb().execute({
-    sql: `SELECT connection_id, tool, status, error_code, request_digest, result_json FROM service_connection_action_audit WHERE user_id = ? AND request_id = ? LIMIT 1`,
-    args: [connection.userId, args.requestId]
-  });
-  const row = existing.rows[0];
-  const conflict = String(row?.connection_id ?? "") !== connection.id || String(row?.tool ?? "") !== args.tool || String(row?.request_digest ?? "") !== args.requestDigest;
-  let result = void 0;
-  if (!conflict && typeof row?.result_json === "string") {
-    try {
-      result = JSON.parse(row.result_json);
-    } catch {
-      result = void 0;
-    }
-  }
-  return {
-    claimed: false,
-    status: String(row?.status ?? "unknown"),
-    errorCode: typeof row?.error_code === "string" ? row.error_code : null,
-    conflict,
-    ...result !== void 0 ? { result } : {}
-  };
-}
-
-// src/api/scheduler-integration-auth.ts
 var MAX_CLOCK_SKEW_MS = 5 * 60 * 1e3;
 var SchedulerIntegrationAuthError = class extends Error {
   code;
@@ -49707,7 +50054,7 @@ app.get("/cron/tick", async (c) => {
     return c.json({ error: "Unauthorized" }, 401);
   }
   const startedAt = Date.now();
-  const { drainQueue } = await import("./worker-UTBUWEXQ.js");
+  const { drainQueue } = await import("./worker-JGWV2LID.js");
   const budget = { maxJobs: 10, deadlineMs: startedAt + CRON_TICK_DRAIN_BUDGET_MS };
   const origin = `${new URL(c.req.url).protocol}//${new URL(c.req.url).host}`;
   const unfinished = [];
@@ -49785,8 +50132,8 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
     finishExtractJob: finishExtractJob2,
     terminalExtractJobStatus: terminalExtractJobStatus2,
     extractJobLimitInfo: extractJobLimitInfo2
-  } = await import("./site-extract-repository-NTM4MDQN.js");
-  const { assembleExtractArtifacts } = await import("./extract-bundle-EA5URLXN.js");
+  } = await import("./site-extract-repository-7EP6UX6I.js");
+  const { assembleExtractArtifacts } = await import("./extract-bundle-QQIYJSBW.js");
   const existing = await getExtractJob2(jobId2);
   if (!existing) return c.json({ error: "job not found" }, 404);
   if (existing.status !== "failed") {
@@ -49813,7 +50160,7 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
   if (!updated) return c.json({ error: "job state changed during re-finalization" }, 409);
   let settlement = "already_settled_or_refunded";
   if (job.billedMc == null && job.userId != null) {
-    const { settleExtractJob: settleExtractJob3, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-NTM4MDQN.js");
+    const { settleExtractJob: settleExtractJob3, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-7EP6UX6I.js");
     const heldMc = Number(job.options.heldMc ?? 0);
     const successful = await countSuccessfulPages2(jobId2);
     const usedMc = Math.min(successful * MC_COSTS.page_scrape, heldMc);