mcp-scraper 0.69.1 → 0.72.1

package/CHANGELOG.md

@@ -4,10 +4,66 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ## [Unreleased]
 
+## [0.72.1] - 2026-08-27
+
+### Fixed
+
+- The Vercel API migration gate now keeps a cold-start invocation open long enough for additive remote database migrations to finish, preventing the five-second gate from repeatedly freezing a still-pending migration and returning `503` after deployment.
+
+## [0.72.0] - 2026-08-27
+
+### Added
+
+- Added ten Gmail workflow tools for complete message and attachment reads, immutable reviewed selections, full-fidelity exports, replay-safe bulk management and deletion, and resumable Memory imports with durable status receipts.
+- Added owner-bound internal artifact resolution so Memory can retain Gmail attachments without exposing provider credentials, storage keys, or attachment bytes to model context.
+
+### Changed
+
+- Gmail bulk work now freezes an explicit selection before export, mutation, or Memory import, and Scheduler consumes the same signed main-owned canonical export contract.
+- Complete Gmail reads preserve normalized headers, full MIME structure, raw EML artifacts, inline and ordinary attachment provenance, and visibly untrusted provider content.
+
+### Fixed
+
+- Gmail retries and concurrent resumes now reuse durable selection, action-chunk, export, and import receipts instead of duplicating labels, notes, files, checkpoints, or manifests.
+
+## [0.71.0] - 2026-08-27
+
+### Added
+
+- Added portable `harvest_paa_start` and `harvest_paa_status` tools for durable long-running PAA research, with stable idempotency recovery, progress, attempt provenance, completeness, billing state, and bounded provider telemetry.
+- Added progressive PAA checkpoints that preserve and merge the best unique rows across browser retries and stale-job recovery instead of losing already captured questions when a provider session or caller is interrupted.
+- Added exact Bright Data browser-session identity, sanitized Session Logs enrichment, disconnect attribution, bandwidth usage telemetry, and retryable reconciliation without making provider telemetry a prerequisite for result delivery.
+
+### Changed
+
+- PAA settlement now charges once from the final deduplicated retained rows, including recoverable partial results, while empty interrupted jobs continue to fail and refund.
+- The generated public MCP inventory now reports 320 tools: 219 scraper, browser, workflow, billing, and connected-service tools plus 101 durable-memory tools.
+
+### Fixed
+
+- PAA quality now marks missing answers or source URLs as partial, preserves safe outbound Google citation targets, and keeps genuine no-PAA SERPs distinct from interrupted empty captures.
+- Runtime-injected Nango action definitions now have a portable unit-test shim, allowing clean npm checkouts to execute the existing CRM integration suites without shipping the Nango CLI as a product dependency.
+
+## [0.70.0] - 2026-08-27
+
+### Added
+
+- Added durable scheduled CRM outcome reconciliation and separately controlled outbound Person Summary and Pipeline Event policies, with provisioning, mapping, test, receipt, retry, dead-letter, cancellation, and worker-health evidence.
+- Added MCP operations for CRM outbound policies and receipts, bringing the unified runtime and developer contract to 318 tools with operation-specific schemas.
+
+### Changed
+
+- Confirmed CRM outcomes now resolve through the exact site, provider, connection, and contact mapping; current consent, GPC, withdrawal, deletion, namespace, and candidate-ineligibility boundaries are revalidated before conversion or activation.
+- Eligible confirmed people retain consented advertising click identifiers from their linked first-party sessions and touches for later CRM-stage conversion activation.
+
 ### Fixed
 
+- The production server now owns its strict normalized CRM outcome projection instead of importing from the independently deployed Nango project, so Vercel can build from its intentionally restricted source context.
 - Meta activation asset discovery now resolves the authorized ad account before listing its datasets, so the dashboard can select an actual connected dataset instead of requiring a copied ID.
 - `analytics_test_activation_destination` now accepts and forwards the provider test code required by Meta/TikTok or the test ID required by Reddit, matching the REST and dashboard contracts.
+- Activation delivery now carries only validated provider-specific destination configuration into each claimed job, including the required Google operating account, while malformed or unapproved fields fail closed.
+- Privacy withdrawal and deletion now use statement-specific PostgreSQL parameters, preventing cleanup from failing on sparse placeholder numbering.
+- Confirmed form identity now links prior same-site anonymous sessions and attribution touches without overwriting an existing person, preserving later CRM attribution and activation eligibility.
 
 ## [0.69.0] - 2026-08-27
 
@@ -28,7 +84,8 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ### Fixed
 
-- Activation readiness now persists accepted provider evidence without UUID/text casting failures and unwraps typed connected-service receipts before verification.
+- Activation readiness transitions now cast evidence IDs separately for UUID comparisons and text receipt storage, preventing PostgreSQL from rejecting accepted test and delivery receipts during verification.
+- X-Ray now unwraps typed provider receipts returned through the connected-service MCP envelope, so one accepted Meta test event persists its evidence and verifies the destination instead of remaining configured and unverified.
 - Public catalog mirrors, provider inventories, readiness guards, and release contracts now agree on the 315-tool and 329-action production surfaces.
 
 ## [0.68.0] - 2026-08-26
@@ -1191,7 +1248,11 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Write actions remain unavailable until the account owner explicitly enables them.
 - Provider-specific connection data is normalized into one agent-facing contract.
 
-[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.69.0...HEAD
+[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.72.1...HEAD
+[0.72.1]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.72.0...v0.72.1
+[0.72.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.71.0...v0.72.0
+[0.71.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.70.0...v0.71.0
+[0.70.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.69.0...v0.70.0
 [0.69.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.68.0...v0.69.0
 [0.68.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.67.1...v0.68.0
 [0.67.1]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.67.0...v0.67.1

package/README.md

@@ -159,7 +159,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.69.1`, SHA-256 `21d4e7c0dc0e4a44c0f4af293e864b16aafb09d184282203ee2618380fbf8c0f`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.72.1`, SHA-256 `3f74c6b05ba0828f35525832d7e71d2b928839db0f7cfa3a02106da219930d6d`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 
@@ -257,6 +257,10 @@ env = { MCP_SCRAPER_API_KEY = "sk_live_your_key" }
 
 ### Connected-account tools
 
+- `gmail_search_messages`, `gmail_get_message`, and `gmail_get_attachment` — search Gmail, read one complete normalized message (including full MIME and raw EML artifacts), and retrieve external or inline attachment bytes through owner-scoped artifact pointers. Gmail content is always treated as untrusted data.
+- `gmail_prepare_selection` and `gmail_export_selection` — freeze an exact reviewed set of up to 5,000 messages for 24 hours, then export full-fidelity JSONL/EML without silently substituting the first provider page.
+- `gmail_bulk_manage_messages` and `gmail_bulk_delete_messages` — apply replay-safe label, read-state, archive, Inbox, Trash, or restore changes to one unchanged selection. Permanent delete is a separate destructive tool, requires literal confirmation plus the broader Gmail scope, and should be tested only with a purpose-created disposable message.
+- `gmail_prepare_memory_import`, `gmail_import_to_memory`, and `gmail_import_status` — preview vault and attachment routing, start or resume a checkpointed import, and inspect progress without advancing it. Source archives default to Library; relationship Communications are opt-in and require one exact existing identity. Safe attachments are retained as private files with truthful `search_ready`, `stored_not_indexed`, `skipped`, `refused`, or `failed` status.
 - `list_service_connections` — list this caller's tenant-owned Nango OAuth and official remote MCP connections, including verified provider-side account email/name when exposed, exact live reads, gated actions, permanently blocked administrative tools, credential transport, and schema-discovery metadata. Provider identity is distinct from the MCP Scraper login, and connections are never shared between customers.
 - `describe_service_connection_tool` — fetch the sanitized live MCP Tool definition for one tool listed on one tenant-owned connection, including its current callability, input schema, optional output schema, safe annotations, and schema hash. Use this before constructing provider-native arguments; provider functions stay behind the generic bridges instead of becoming dozens of permanent top-level tools.
 - `export_connected_service_data` — fetch a fresh Gmail, Google Calendar, Google Search Console, Zoom, Slack, Resend, or Meta dataset in one MCP call. Slack's `slack_channel_messages` dataset accepts a `channelId`, paginates top-level history, fetches threaded replies in bounded parallel batches, preserves file metadata, honors retry delays, and supports `allTime:true`; it never joins or changes the channel. Zoom's `zoom_transcripts` dataset resolves VTT files from recording metadata and downloads them through the authenticated connection without looping the separately rate-limited `get-meeting-transcript` function. Search Console's `search_console_performance` dataset walks accessible properties and bounded live Search Analytics pages with continuation. Small exports return inline; larger exports become private JSONL retained for seven days with exact `report_artifact_read` arguments plus an optional 15-minute human download URL. For relationship work, gather source evidence first: inspect existing People records, resolve the exact provider account, preserve provider provenance when writing a linked Communication, and never treat an export as permission to mutate the source account.
@@ -317,7 +321,7 @@ The `mcp-scraper` server (and the MCPB bundle, which runs it) exposes both secti
 
 All MCP tools return `structuredContent` with the IDs, URLs, CSV paths, transcripts, browser session handles, replay paths, artifacts, recipe fields, or blueprint fields needed by the next step, plus readable text content for compatibility. Runtime `tools/list` omits output schemas so strict clients can register the complete catalog; the generated developer manifest retains every canonical output schema for validation and typed SDK generation. All tools carry MCP annotations; file-writing tools such as replay downloads and annotations state their filesystem side effects.
 
-The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 315 tools: 214 scraper, browser, workflow, billing, and connected-service tools plus 101 durable-memory tools. The scraper-side inventory includes rendered site-content similarity, governed Local Sourcebook tools, Transparent Commons entity, linkset, and publication tools, direct site-export text and image readers, the searchable News Publisher and Editorial Reading Room template workflow, and 33 X-Ray tools for pixel administration, reporting, attribution journeys, campaign links, exports, and scheduled reports. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
+The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 330 tools: 229 scraper, browser, workflow, billing, and connected-service tools plus 101 durable-memory tools. The scraper-side inventory includes complete Gmail selection, message, attachment, export, bulk-action, and Memory-import workflows; durable PAA starts and status; rendered site-content similarity; governed Local Sourcebook and Transparent Commons workflows; direct site-export reads; Editorial Reading Room and News Publisher templates; and production X-Ray analytics, attribution, CRM policy and receipt, campaign, export, and scheduled-report tools. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
 
 For contract parity, stdio and MCPB memory calls invoke the matching public tool on the hosted MCP Scraper `/mcp` endpoint. The hosted aggregate runtime owns MCP Scraper-specific billing, scheduling, credential, and in-process cutover policy; its internal `/memory/mcp-call` bridge is a fallback to the standalone memory service, not the public stdio execution path. Direct `mcp-memory` OAuth and stdio clients continue to use `memory.mcpscraper.dev` and must be verified as a separate dependent release surface.
 

package/dist/{analytics-repository-62CAZAIP.js → analytics-repository-6YLRSWYO.js}

@@ -77,8 +77,9 @@ import {
   updateAnalyticsPixel,
   upsertAnalyticsAdSpend,
   upsertAnalyticsHostGroup
-} from "./chunk-KO5CK5ZT.js";
-import "./chunk-65FTMB7G.js";
+} from "./chunk-SR7GSLEA.js";
+import "./chunk-PJEEKOUM.js";
+import "./chunk-WEFPBAAG.js";
 export {
   ANALYTICS_CONTENT_SORTS,
   AnalyticsRepositoryError,