mcp-scraper 0.86.5 → 0.88.0

package/dist/{server-ARMF2IRI.js → server-PD3TDL6Q.js}

@@ -43,7 +43,7 @@ import {
   setExtractJobTotal,
   settleExtractJob,
   terminalExtractJobStatus
-} from "./chunk-KQWVJOVR.js";
+} from "./chunk-IHXAXYIS.js";
 import {
   REQUIRED_LOCATION_STATE_CODES,
   importHostedCensusPlacesCsv,
@@ -105,7 +105,7 @@ import {
   probeNangoConnectionDirect,
   recordNangoConnectionCost,
   settleConnectedUsage
-} from "./chunk-WFGAR4BZ.js";
+} from "./chunk-MZDNZQWT.js";
 import {
   ANALYTICS_ATTRIBUTION_MODELS,
   ANALYTICS_CONTENT_SORTS,
@@ -240,7 +240,7 @@ import {
   serpArrivalUrl,
   validateProviderSessionId,
   withRuntimeUserAgent
-} from "./chunk-NH4QAH3X.js";
+} from "./chunk-S24LFPL7.js";
 import {
   ANALYTICS_REST_GENERIC_EXEMPTIONS,
   ASSISTANT_COMMAND_SCHEMA_VERSION,
@@ -388,7 +388,7 @@ import {
   transcribeMediaUrl,
   transitionAnalyticsExperiment,
   validateAnalyticsRestResponseForRequest
-} from "./chunk-QJJQ4OAZ.js";
+} from "./chunk-2JVZQGSN.js";
 import {
   auditImageUrls,
   auditImages,
@@ -459,7 +459,7 @@ import {
   tierChangeLeavesPrivateOffer,
   tierCreditsPerInterval,
   vendorCostUsdToMc
-} from "./chunk-NKRO2SUO.js";
+} from "./chunk-4QMUF6XM.js";
 import {
   browserServiceApiKey,
   browserServiceProfileName,
@@ -483,7 +483,7 @@ import {
   workflowOutputBaseDir,
   workflowStepCount,
   workflowSupportsSteps
-} from "./chunk-6IOGTFNS.js";
+} from "./chunk-UZPTGUDV.js";
 import {
   csvRecords,
   parseCsv,
@@ -498,7 +498,7 @@ import {
   RawMapsHoursRowSchema,
   RawMapsOverviewSchema,
   RawMapsReviewStatsSchema
-} from "./chunk-OWF2JJKN.js";
+} from "./chunk-GXBZXWXB.js";
 import {
   extractContactEvidence
 } from "./chunk-P7FWOMU7.js";
@@ -509,7 +509,7 @@ import {
 } from "./chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-BA6BPDSP.js";
+} from "./chunk-XIJI34RM.js";
 import {
   CaptchaError,
   MapsSearchIncompletePageError,
@@ -557,7 +557,6 @@ import {
   getInboxMessage,
   getJob,
   getLedger,
-  getMemoryPlan,
   getMemoryProvisioned,
   getOrCreateRunningJob,
   getPageSnapshot,
@@ -566,7 +565,6 @@ import {
   getUserByEmail,
   getUserById,
   getUserByStripeCustomerId,
-  getUserMemoryCreds,
   getUserStats,
   getWorkflowArtifact,
   getWorkflowRun,
@@ -615,7 +613,6 @@ import {
   setPassword,
   setStripeCustomerId,
   setSubscriptionTier,
-  setUserMemoryCreds,
   settleDebitMcIdempotent,
   softDeleteInboxMessage,
   updateHarvestAttemptProviderTelemetry,
@@ -3972,7 +3969,7 @@ async function generateOgImage(post) {
 
 // src/api/server.ts
 import { Resend as Resend3 } from "resend";
-import { createHash as createHash104, randomUUID as randomUUID69 } from "crypto";
+import { createHash as createHash105, randomUUID as randomUUID69 } from "crypto";
 
 // src/api/kpo-extractor.ts
 import TurndownService from "turndown";
@@ -9764,7 +9761,7 @@ var siteExtractFn = inngest.createFunction(
       });
     }) : null;
     const finalized = await step.run("finalize", async () => {
-      const { assembleExtractArtifacts } = await import("./extract-bundle-FALNLKYY.js");
+      const { assembleExtractArtifacts } = await import("./extract-bundle-565SBZCR.js");
       const current = await getExtractJob(jobId2);
       if (!current) throw new Error("extract job disappeared before finalization");
       const stored = await assembleExtractArtifacts(current, { branding, imageAudit });
@@ -15864,10 +15861,41 @@ async function voidScheduledRunAuthorization(args) {
 
 // src/api/memory.ts
 import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "crypto";
-import { provisionDefaultsTool } from "mcpscraper-memory-tools/tools/vaults/provision-defaults";
 import { setScheduleEntitlementTool } from "mcpscraper-memory-tools/tools/schedule/set-schedule-entitlement";
+
+// src/api/oauth-signing.ts
+import { createHash as createHash5, randomUUID as randomUUID5 } from "crypto";
+import { exportJWK, importPKCS8, SignJWT } from "jose";
+var OAUTH_ISSUER = "https://mcpscraper.dev";
+var cachedKeys = null;
+async function getKeys() {
+  if (cachedKeys) return cachedKeys;
+  const raw = process.env.OAUTH_SIGNING_KEY;
+  if (!raw?.trim()) throw new Error("OAUTH_SIGNING_KEY is not set");
+  const pem = raw.includes("BEGIN") ? raw : Buffer.from(raw, "base64").toString("utf8");
+  const privateKey = await importPKCS8(pem, "RS256", { extractable: true });
+  const full = await exportJWK(privateKey);
+  const publicJwk = { kty: full.kty, n: full.n, e: full.e };
+  const kid = createHash5("sha256").update(JSON.stringify({ e: publicJwk.e, kty: publicJwk.kty, n: publicJwk.n })).digest("base64url").slice(0, 16);
+  publicJwk.kid = kid;
+  publicJwk.alg = "RS256";
+  publicJwk.use = "sig";
+  cachedKeys = { privateKey, publicJwk, kid };
+  return cachedKeys;
+}
+async function getOAuthPublicJwk() {
+  return (await getKeys()).publicJwk;
+}
+async function mintOAuthAccessToken(args) {
+  const { privateKey, kid } = await getKeys();
+  return new SignJWT({ scope: args.scope, plan: args.plan }).setProtectedHeader({ alg: "RS256", kid }).setIssuer(OAUTH_ISSUER).setSubject(args.identity).setAudience(args.audience).setIssuedAt().setJti(randomUUID5()).setExpirationTime(`${args.ttlSeconds}s`).sign(privateKey);
+}
+
+// src/api/memory.ts
 var MEMORY_BASE_URL = () => (process.env.MCP_MEMORY_BASE_URL ?? "https://memory.mcpscraper.dev").replace(/\/$/, "");
+var MEMORY_RESOURCE_URL = () => (process.env.MCP_MEMORY_RESOURCE_URL ?? "https://memory.mcpscraper.dev/mcp").replace(/\/$/, "");
 var ADMIN_KEY = () => process.env.MCP_MEMORY_ADMIN_KEY?.trim() ?? "";
+var MEMORY_SERVICE_TOKEN_TTL_SECONDS = 300;
 function parseMemoryRpcBody(text3) {
   const dataLine = text3.split("\n").find((line) => line.startsWith("data:"));
   const payload = dataLine ? dataLine.slice(5).trim() : text3;
@@ -15945,8 +15973,10 @@ function memoryPlanForReads(user) {
 }
 async function provisionMemoryForUser(user) {
   try {
-    const { key: key3 } = await getOrCreateUserMemoryKey(user);
-    if (key3) await setMemoryProvisioned(user.id, true);
+    const { key: key3 } = await getMemoryServiceToken(user);
+    if (!key3) return;
+    const result3 = await memoryCall("listVaultsTool", {}, key3);
+    if (result3.ok) await setMemoryProvisioned(user.id, true);
   } catch {
   }
 }
@@ -15959,40 +15989,32 @@ function resolveEffectiveMemoryPlan(user) {
   if (tierIncludesMemory(user.subscription_tier)) return "pro";
   return user.memory_plan === "pro" ? "pro" : "free";
 }
-async function getOrCreateUserMemoryKey(user) {
-  const creds = await getUserMemoryCreds(user.id);
-  if (creds.memory_key) {
-    const decrypted = decryptMemoryKey(creds.memory_key);
-    if (decrypted) return { key: decrypted };
-  }
-  const admin = ADMIN_KEY();
-  if (!admin) return { key: null, error: "memory not configured (MCP_MEMORY_ADMIN_KEY missing)" };
-  const identity = memoryIdentity(user);
-  const plan = isMemoryOperator(user.email) ? "unlimited" : (await getMemoryPlan(user.id)).plan;
-  const provisioned = await provisionDefaultsTool.execute(
-    { apiKey: admin, granteeIdentity: identity, issueKey: true, plan },
-    {}
-  );
-  if (!provisioned.ok || !provisioned.secret) {
-    return { key: null, error: provisioned.error ?? "failed to provision default vaults" };
+async function getMemoryServiceToken(user, planOverride) {
+  try {
+    const operator = isMemoryOperator(user.email);
+    const plan = operator ? "unlimited" : planOverride ?? resolveEffectiveMemoryPlan(user);
+    const scope = operator ? "memory.read memory.write memory.admin" : "memory.read memory.write";
+    const key3 = await mintOAuthAccessToken({
+      identity: memoryIdentity(user),
+      scope,
+      plan,
+      audience: MEMORY_RESOURCE_URL(),
+      ttlSeconds: MEMORY_SERVICE_TOKEN_TTL_SECONDS
+    });
+    return { key: key3 };
+  } catch (error) {
+    return {
+      key: null,
+      error: error instanceof Error ? error.message : "memory service authorization unavailable"
+    };
   }
-  await setUserMemoryCreds(user.id, encryptMemoryKey(provisioned.secret), identity);
-  return { key: provisioned.secret };
 }
 async function syncMemoryKeyPlan(user, plan) {
   const effectivePlan = isMemoryOperator(user.email) ? "unlimited" : plan;
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user, effectivePlan);
   if (!key3) return { ok: false, error: error ?? "memory unavailable" };
-  const listed = await memoryCall(
-    "listKeysTool",
-    {},
-    key3
-  );
-  if (!listed.ok || !listed.keys?.length) return { ok: false, error: listed.error ?? "no memory keys found" };
-  const target = listed.keys[0];
-  if (target.plan === effectivePlan) return { ok: true };
-  const res = await memoryCall("setScopeTool", { keyId: target.keyId, plan: effectivePlan }, key3);
-  return { ok: res.ok, error: res.error };
+  const listed = await memoryCall("listVaultsTool", {}, key3);
+  return { ok: listed.ok, error: listed.error };
 }
 async function syncScheduledActionCredentials(user) {
   const admin = ADMIN_KEY();
@@ -19616,7 +19638,7 @@ var adminAuth = createMiddleware3(async (c, next) => {
 import { Hono as Hono9 } from "hono";
 
 // src/api/admin-credits.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var MIN_ADJUSTMENT_CREDITS = 1;
 var LARGE_ADJUSTMENT_CREDITS = 1e5;
 var MAX_ADJUSTMENT_CREDITS = 1e7;
@@ -19766,7 +19788,7 @@ async function applyAdjustment(input) {
   const credits = validateCredits(input.credits, input.confirmLarge === true);
   const reason = validateReason(input.reason);
   const actor = validateActor(input.actor);
-  const reference2 = input.reference?.trim() || `adj_${randomUUID5()}`;
+  const reference2 = input.reference?.trim() || `adj_${randomUUID6()}`;
   if (reference2.length > 120) throw new AdminCreditError(400, "reference must be at most 120 characters");
   const db = getDb();
   const existing = await db.execute({
@@ -21336,11 +21358,11 @@ async function runKernelRedditPipeline(apiKey, input, hooks) {
 }
 
 // src/reddit/bright-data-thread-backup.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { chromium as chromium5 } from "playwright";
 
 // src/api/brightdata-session-telemetry.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var DEFAULT_SESSION_API_BASE_URL = "https://api.brightdata.com";
 var DEFAULT_TIMEOUT_MS = 5e3;
 var MAX_PROVIDER_TEXT = 320;
@@ -21517,7 +21539,7 @@ async function enrichPendingBrightDataAttempts(limit = 25, options = {}) {
   return summary;
 }
 function providerSessionHash(sessionId) {
-  return createHash5("sha256").update(sessionId).digest("hex").slice(0, 16);
+  return createHash6("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 async function recordPendingBrightDataRedditUsage(providerSessionId, telemetry) {
   return recordVendorUsage({
@@ -21691,7 +21713,7 @@ function isAcceptedRedditThread(thread, requestedComments) {
   return Boolean(thread.title?.trim()) && thread.comments.length >= redditThreadAcceptanceTarget(thread, requestedComments);
 }
 function hashSessionId(sessionId) {
-  return sessionId ? createHash6("sha256").update(sessionId).digest("hex").slice(0, 16) : null;
+  return sessionId ? createHash7("sha256").update(sessionId).digest("hex").slice(0, 16) : null;
 }
 async function reconcileSession(sessionId) {
   if (!sessionId) return null;
@@ -22288,11 +22310,11 @@ configurePostRoute({
 });
 
 // src/api/gmail-routes.ts
-import { createHash as createHash9, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash10, timingSafeEqual as timingSafeEqual3 } from "crypto";
 import { Hono as Hono13 } from "hono";
 
 // src/api/gmail-memory-ingest-repository.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 var GmailImportRepositoryError = class extends Error {
   constructor(code, message, status = 400) {
     super(message);
@@ -22363,7 +22385,7 @@ async function createOrGetGmailImportPlan(ownerId3, data, now = /* @__PURE__ */
   const planFingerprint = gmailFingerprint(data);
   const existing = await getDb().execute({ sql: `SELECT * FROM gmail_import_plans WHERE owner_identity = ? AND plan_fingerprint = ? AND expires_at > ? LIMIT 1`, args: [ownerId3, planFingerprint, now.toISOString()] });
   if (existing.rows[0]) return planFromRow(existing.rows[0]);
-  const plan = { ...data, importPlanId: `gplan_${randomUUID6().replace(/-/g, "")}`, ownerId: ownerId3, planFingerprint, createdAt: now.toISOString(), expiresAt: new Date(now.getTime() + 24 * 60 * 60 * 1e3).toISOString() };
+  const plan = { ...data, importPlanId: `gplan_${randomUUID7().replace(/-/g, "")}`, ownerId: ownerId3, planFingerprint, createdAt: now.toISOString(), expiresAt: new Date(now.getTime() + 24 * 60 * 60 * 1e3).toISOString() };
   await getDb().execute({ sql: `INSERT INTO gmail_import_plans (import_plan_id, owner_identity, plan_fingerprint, plan_json, created_at, expires_at) VALUES (?, ?, ?, ?, ?, ?)`, args: [plan.importPlanId, ownerId3, plan.planFingerprint, JSON.stringify(data), plan.createdAt, plan.expiresAt] });
   return plan;
 }
@@ -22393,7 +22415,7 @@ async function beginOrResumeGmailImport(args) {
   }
   const now = args.now ?? /* @__PURE__ */ new Date();
   const leaseExpiresAt = new Date(now.getTime() + (args.leaseMs ?? 45e3)).toISOString();
-  const job = { ingestId: `ging_${randomUUID6().replace(/-/g, "")}`, ownerId: args.ownerId, importPlanId: args.plan.importPlanId, idempotencyKey: key3, fingerprint: fingerprint5, status: "running", attempts: 0, leaseExpiresAt, progress: { messagesStored: 0, attachmentsStored: 0, attachmentsIndexed: 0, skipped: 0, errors: [], checkpoints: {} }, createdAt: now.toISOString(), updatedAt: now.toISOString() };
+  const job = { ingestId: `ging_${randomUUID7().replace(/-/g, "")}`, ownerId: args.ownerId, importPlanId: args.plan.importPlanId, idempotencyKey: key3, fingerprint: fingerprint5, status: "running", attempts: 0, leaseExpiresAt, progress: { messagesStored: 0, attachmentsStored: 0, attachmentsIndexed: 0, skipped: 0, errors: [], checkpoints: {} }, createdAt: now.toISOString(), updatedAt: now.toISOString() };
   await getDb().execute({ sql: `INSERT INTO gmail_import_jobs (ingest_id, owner_identity, import_plan_id, idempotency_key, fingerprint, status, attempts, lease_expires_at, progress_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, args: [job.ingestId, job.ownerId, job.importPlanId, job.idempotencyKey, job.fingerprint, job.status, job.attempts, job.leaseExpiresAt, JSON.stringify(job.progress), job.createdAt, job.updatedAt] });
   return { job, acquired: true };
 }
@@ -22425,7 +22447,7 @@ async function getGmailImportStatus(ownerId3, ingestId) {
 }
 
 // src/api/gmail-memory-ingest.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 var GMAIL_IMPORT_MAX_ATTACHMENTS = 1e4;
 var GMAIL_IMPORT_MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
 var GMAIL_IMPORT_MAX_TOTAL_ATTACHMENT_BYTES = 250 * 1024 * 1024;
@@ -22584,7 +22606,7 @@ var GmailMemoryIngestService = class {
   }
 };
 function canonicalMessageDigest(message) {
-  return createHash7("sha256").update(JSON.stringify({ messageId: message.messageId, threadId: message.threadId, internalDate: message.internalDate, headers: message.headers, labels: message.labels, plainText: message.plainText, sanitizedHtml: message.sanitizedHtml, attachments: message.attachments.map((item) => ({ filename: item.filename, mime: item.declaredMime, size: item.size, partId: item.partId })) })).digest("hex");
+  return createHash8("sha256").update(JSON.stringify({ messageId: message.messageId, threadId: message.threadId, internalDate: message.internalDate, headers: message.headers, labels: message.labels, plainText: message.plainText, sanitizedHtml: message.sanitizedHtml, attachments: message.attachments.map((item) => ({ filename: item.filename, mime: item.declaredMime, size: item.size, partId: item.partId })) })).digest("hex");
 }
 function renderMessageNote(message, attachmentPolicy) {
   const addresses = (values) => values.map((item) => item.name ? `${item.name} <${item.email}>` : item.email).join(", ");
@@ -22611,11 +22633,11 @@ function gmailAttachmentSourceIdentity(messageId, messageDigest, partId, attachm
   return `gmail:${messageId}:${messageDigest}:${partId}:${attachmentDigest}`;
 }
 function gmailAttachmentSaveIdempotencyKey(messageId, messageDigest, partId, attachmentDigest) {
-  return `gmail-attachment:${createHash7("sha256").update(gmailAttachmentSourceIdentity(messageId, messageDigest, partId, attachmentDigest)).digest("hex")}`;
+  return `gmail-attachment:${createHash8("sha256").update(gmailAttachmentSourceIdentity(messageId, messageDigest, partId, attachmentDigest)).digest("hex")}`;
 }
 
 // src/api/scheduler-integration-auth.ts
-import { createHash as createHash8, createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash9, createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var MAX_CLOCK_SKEW_MS = 5 * 60 * 1e3;
 var SchedulerIntegrationAuthError = class extends Error {
   code;
@@ -22631,7 +22653,7 @@ function signingSecret() {
   return secret;
 }
 function schedulerIntegrationSignature(args) {
-  const bodyHash = createHash8("sha256").update(args.body).digest("hex");
+  const bodyHash = createHash9("sha256").update(args.body).digest("hex");
   return createHmac2("sha256", args.secret).update(`${args.method.toUpperCase()}
 ${args.path}
 ${args.timestamp}
@@ -22691,7 +22713,7 @@ var gmailApp = new Hono13();
 var auth = createApiKeyAuth();
 var gmail = new GmailService();
 function ownerId(apiKey) {
-  return createHash9("sha256").update(apiKey).digest("hex").slice(0, 24);
+  return createHash10("sha256").update(apiKey).digest("hex").slice(0, 24);
 }
 function caller(c) {
   const user = c.get("user");
@@ -22899,7 +22921,7 @@ function gmailMemoryAssetToolsForMime(mimeType) {
 }
 async function memoryPort(c) {
   const user = c.get("user");
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   if (!key3) throw new GmailMemoryIngestError("memory_unavailable", error ?? "Memory is unavailable.", 503, true);
   return {
     async validateVault(vault) {
@@ -22931,7 +22953,7 @@ async function memoryPort(c) {
       return { status: "unmatched" };
     },
     async saveNote(args) {
-      const path5 = `gmail/${createHash9("sha256").update(args.sourceKey).digest("hex")}.md`;
+      const path5 = `gmail/${createHash10("sha256").update(args.sourceKey).digest("hex")}.md`;
       const result3 = await memoryCall("putTool", gmailMemoryNoteArguments({ ...args, path: path5 }), key3);
       if (!result3.ok) throw new GmailMemoryIngestError("memory_note_failed", String(result3.error ?? "Memory note write failed."), 503, true);
       return { ...result3, path: path5 };
@@ -23112,7 +23134,7 @@ gmailApp.post("/api/internal/integrations/:connectionId/gmail/selections/prepare
     if (!providerIdentity || body3.purpose !== "scheduled_export") throw new GmailServiceError("invalid_request", "identity and scheduled_export purpose are required.");
     const parsedSource = selectionSource(source);
     if (!parsedSource) throw new GmailServiceError("invalid_request", "A valid Gmail selection source is required.");
-    const internalOwnerId = createHash9("sha256").update(providerIdentity.toLowerCase()).digest("hex").slice(0, 24);
+    const internalOwnerId = createHash10("sha256").update(providerIdentity.toLowerCase()).digest("hex").slice(0, 24);
     const exactRange = string(range.from) && string(range.to) ? { from: String(range.from), to: String(range.to) } : void 0;
     const selection = await gmail.prepareSelection({ ownerId: internalOwnerId, providerIdentity, connectionId: c.req.param("connectionId"), purpose: "scheduled_export", source: parsedSource, ...exactRange ? { exactRange } : {} });
     return c.json({ ok: true, contract: { version: GMAIL_MAIN_CONTRACT_VERSION, hash: GMAIL_MAIN_CONTRACT_HASH }, selection: await selectionReceipt(selection, providerIdentity, true), untrustedContent: true });
@@ -23129,7 +23151,7 @@ gmailApp.post("/api/internal/integrations/:connectionId/gmail/selections/:select
     const selectionSha256 = string(body3.selectionSha256);
     const expectedCount = integer(body3.expectedCount);
     if (!providerIdentity || !selectionSha256 || expectedCount === null) throw new GmailServiceError("invalid_request", "identity and the exact selection receipt are required.");
-    const internalOwnerId = createHash9("sha256").update(providerIdentity.toLowerCase()).digest("hex").slice(0, 24);
+    const internalOwnerId = createHash10("sha256").update(providerIdentity.toLowerCase()).digest("hex").slice(0, 24);
     const exported = await gmail.exportSelection({ ownerId: internalOwnerId, providerIdentity, connectionId: c.req.param("connectionId"), selectionId: c.req.param("selectionId"), selectionSha256, expectedCount });
     return c.json({ ok: true, contract: { version: GMAIL_MAIN_CONTRACT_VERSION, hash: GMAIL_MAIN_CONTRACT_HASH }, export: exported, untrustedContent: true });
   } catch (error) {
@@ -23193,7 +23215,7 @@ function gmailResolvedArtifactHeaders(artifactId, bytes2) {
     decoded = "artifact.bin";
   }
   const filename2 = decoded.replace(/[\r\n]/g, "").slice(0, 500) || "artifact.bin";
-  return { filename: filename2, contentType: sniffResolvedArtifactMime(bytes2, filename2), sha256: createHash9("sha256").update(bytes2).digest("hex") };
+  return { filename: filename2, contentType: sniffResolvedArtifactMime(bytes2, filename2), sha256: createHash10("sha256").update(bytes2).digest("hex") };
 }
 
 // src/api/video-routes.ts
@@ -23218,7 +23240,7 @@ videoApp.post("/analyze", createApiKeyAuth(), async (c) => {
   if (!parsed.success) return c.json(invalidRequest6(parsed.error.issues[0]?.message ?? "invalid request"), 400);
   const body3 = parsed.data;
   const user = c.get("user");
-  const { key: memKey, error: memErr } = await getOrCreateUserMemoryKey(user);
+  const { key: memKey, error: memErr } = await getMemoryServiceToken(user);
   if (!memKey) return c.json({ error_code: "memory_unavailable", message: memErr ?? "memory unavailable" }, 502);
   const requestedFrames = Math.min(Math.max(body3.maxFrames ?? 120, 1), 480);
   const tiers = tiersFor(requestedFrames);
@@ -23252,7 +23274,7 @@ videoApp.post("/status", createApiKeyAuth(), async (c) => {
   const runId = rawBody.runId?.trim();
   if (!runId) return c.json(invalidRequest6("runId is required"), 400);
   const user = c.get("user");
-  const { key: memKey, error: memErr } = await getOrCreateUserMemoryKey(user);
+  const { key: memKey, error: memErr } = await getMemoryServiceToken(user);
   if (!memKey) return c.json({ error_code: "memory_unavailable", message: memErr ?? "memory unavailable" }, 502);
   const st = await memoryCall("videoAnalyzeStatusTool", { runId }, memKey);
   if (!st.ok) return c.json({ error_code: "not_found", message: st.error ?? "run not found" }, 404);
@@ -24071,17 +24093,17 @@ g2App.post("/reviews", createApiKeyAuth(), async (c) => {
 });
 
 // src/api/directory-routes.ts
-import { createHash as createHash10, randomUUID as randomUUID8 } from "crypto";
+import { createHash as createHash11, randomUUID as randomUUID9 } from "crypto";
 import { Hono as Hono18 } from "hono";
 
 // src/api/directory-workflow-dispatch.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 function retryDelaySeconds(attempts) {
   return Math.min(60 * 60, Math.max(15, 15 * 2 ** Math.min(8, Math.max(0, attempts - 1))));
 }
 async function dispatchPendingDirectoryWorkflows(limit = 25) {
   const rows = await claimDirectoryWorkflowOutbox({
-    workerId: `directory-dispatch-${process.pid}-${randomUUID7().slice(0, 8)}`,
+    workerId: `directory-dispatch-${process.pid}-${randomUUID8().slice(0, 8)}`,
     limit
   });
   const result3 = { claimed: rows.length, dispatched: 0, failed: 0 };
@@ -24111,7 +24133,7 @@ function safeOptions(options) {
   return safe;
 }
 function requestFingerprint(options) {
-  return createHash10("sha256").update(JSON.stringify(safeOptions(options))).digest("hex");
+  return createHash11("sha256").update(JSON.stringify(safeOptions(options))).digest("hex");
 }
 function idempotencyKey(raw) {
   if (raw !== void 0) {
@@ -24120,14 +24142,14 @@ function idempotencyKey(raw) {
     if (trimmed.length > 500) return { ok: false, message: "Idempotency-Key must be 500 characters or fewer." };
     return { ok: true, key: trimmed };
   }
-  return { ok: true, key: `directory-${randomUUID8()}` };
+  return { ok: true, key: `directory-${randomUUID9()}` };
 }
 function debitKeyFor(userId, responseKey) {
-  const digest23 = createHash10("sha256").update(String(userId)).update("\0").update(responseKey).digest("hex");
+  const digest23 = createHash11("sha256").update(String(userId)).update("\0").update(responseKey).digest("hex");
   return `directory-workflow:${userId}:${digest23}`;
 }
 function jobId() {
-  return `dir_${randomUUID8().replace(/-/g, "")}`;
+  return `dir_${randomUUID9().replace(/-/g, "")}`;
 }
 function publicStatus(job, result3) {
   if (job.status === "failed") return "failed";
@@ -24236,7 +24258,7 @@ async function runSynchronously(c, user, options, plan, responseKey) {
         const csv2 = renderDirectoryWorkflowCsv(result3);
         const artifact = await createDirectoryCsvArtifact({
           ownerId: String(user.id),
-          jobId: createHash10("sha256").update(debitKey).digest("hex").slice(0, 32),
+          jobId: createHash11("sha256").update(debitKey).digest("hex").slice(0, 32),
           createdAt: result3.extractedAt,
           filename: `${options.state}-${options.query}-directory.csv`,
           csv: csv2,
@@ -24431,17 +24453,17 @@ directoryApp.get("/jobs/:id", createApiKeyAuth(), async (c) => {
 });
 
 // src/api/lead-list-input-routes.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { Hono as Hono19 } from "hono";
 
 // src/api/lead-list-input-artifacts.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { rm } from "fs/promises";
 import { homedir as homedir3 } from "os";
 import { join as join7 } from "path";
 
 // src/api/lead-list-import-repository.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var schemaDb4 = null;
 var schemaPromise3 = null;
 function parseJson3(value, fallback) {
@@ -24507,10 +24529,10 @@ function bounded(value, field, min, max) {
   return normalized;
 }
 function newLeadListUploadId() {
-  return `upl_${randomUUID9().replace(/-/g, "")}`;
+  return `upl_${randomUUID10().replace(/-/g, "")}`;
 }
 function newImportedLeadListId() {
-  return `lst_${randomUUID9().replace(/-/g, "")}`;
+  return `lst_${randomUUID10().replace(/-/g, "")}`;
 }
 async function ensureLeadListImportRepositorySchema() {
   const db = getDb();
@@ -24758,7 +24780,7 @@ function safeFilenameHint(value) {
   return cleaned || null;
 }
 function requestFingerprint2(filenameHint) {
-  return createHash11("sha256").update(JSON.stringify({ filenameHint })).digest("hex");
+  return createHash12("sha256").update(JSON.stringify({ filenameHint })).digest("hex");
 }
 function publicBaseUrl() {
   const configured3 = process.env.MCP_SCRAPER_PUBLIC_BASE_URL?.trim() || process.env.PUBLIC_BASE_URL?.trim() || (process.env.VERCEL_PROJECT_PRODUCTION_URL ? `https://${process.env.VERCEL_PROJECT_PRODUCTION_URL}` : "") || "https://mcpscraper.dev";
@@ -24914,7 +24936,7 @@ async function inspectLeadListUpload(uploadId, ownerId3) {
     maxBytes: LEAD_LIST_UPLOAD_MAX_BYTES
   });
   if (!buffer) return null;
-  const sha2564 = createHash11("sha256").update(buffer).digest("hex");
+  const sha2564 = createHash12("sha256").update(buffer).digest("hex");
   const completed = await completeLeadListUpload({
     id: record7.id,
     ownerId: record7.ownerId,
@@ -25397,7 +25419,7 @@ function canonicalize(value) {
   return `{${Object.keys(object2).sort().map((key3) => `${JSON.stringify(key3)}:${canonicalize(object2[key3])}`).join(",")}}`;
 }
 function fingerprint(value) {
-  return createHash12("sha256").update(canonicalize(value)).digest("hex");
+  return createHash13("sha256").update(canonicalize(value)).digest("hex");
 }
 async function safeJson(c) {
   try {
@@ -25652,17 +25674,17 @@ leadListInputApp.post("/imports", async (c) => {
 });
 
 // src/api/lead-list-enrichment-routes.ts
-import { createHash as createHash13, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash14, randomUUID as randomUUID12 } from "crypto";
 import { Hono as Hono20 } from "hono";
 import { z as z25 } from "zod";
 
 // src/api/lead-list-enrichment-dispatch.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 function retryDelaySeconds2(attempts) {
   return Math.min(3600, Math.max(15, 15 * 2 ** Math.min(8, Math.max(0, attempts - 1))));
 }
 async function dispatchPendingLeadListEnrichments(limit = 25) {
-  const rows = await claimLeadListEnrichmentOutbox({ workerId: `lead-list-dispatch-${process.pid}-${randomUUID10().slice(0, 8)}`, limit });
+  const rows = await claimLeadListEnrichmentOutbox({ workerId: `lead-list-dispatch-${process.pid}-${randomUUID11().slice(0, 8)}`, limit });
   const result3 = { claimed: rows.length, dispatched: 0, failed: 0 };
   for (const row of rows) {
     if (!row.claimToken) continue;
@@ -25710,15 +25732,15 @@ function idempotencyKey2(raw) {
   return { ok: true, value };
 }
 function newJobId() {
-  return `lle_${randomUUID11().replace(/-/g, "")}`;
+  return `lle_${randomUUID12().replace(/-/g, "")}`;
 }
 function debitKeyFor2(userId, key3) {
-  const digest23 = createHash13("sha256").update(String(userId)).update("\0").update(key3).digest("hex");
+  const digest23 = createHash14("sha256").update(String(userId)).update("\0").update(key3).digest("hex");
   return `lead-list-enrichment:${userId}:${digest23}`;
 }
 function inlineSourceDigest(headers, rows) {
   const values = rows.map((row) => headers.map((header) => row[header] ?? null));
-  return createHash13("sha256").update(stableCanonicalJson({ headers, values })).digest("hex");
+  return createHash14("sha256").update(stableCanonicalJson({ headers, values })).digest("hex");
 }
 function issueMessage(error) {
   const issue = error.issues[0];
@@ -26992,6 +27014,40 @@ function flatFromRecord(record7, seedQuery) {
     extracted_at: record7.observedAt
   };
 }
+function mergePaaProgressMaterial(existing, incoming) {
+  if (!existing) return structuredClone(incoming);
+  const merged = structuredClone(incoming);
+  const keepOrganic = existing.pagination?.page2Status === "captured" && incoming.pagination?.page2Status !== "captured" || existing.pagination?.page2Status === incoming.pagination?.page2Status && existing.organicResults.length > incoming.organicResults.length || existing.organicResults.length > 0 && incoming.organicResults.length === 0;
+  if (keepOrganic) {
+    merged.organicResults = structuredClone(existing.organicResults);
+    merged.pagination = existing.pagination ? structuredClone(existing.pagination) : incoming.pagination;
+  }
+  const resolvedLinks = /* @__PURE__ */ new Map();
+  for (const row of [...existing.organicResults, ...incoming.organicResults]) {
+    if (row.resolutionStatus !== "resolved" || !row.resolvedUrl) continue;
+    for (const identity of [row.rawUrl, row.url, row.resolvedUrl]) {
+      if (identity) resolvedLinks.set(identity, row);
+    }
+  }
+  merged.organicResults = merged.organicResults.map((row) => {
+    if (row.resolutionStatus !== "unresolved" && row.resolutionStatus !== void 0) return row;
+    const resolved = [row.rawUrl, row.url].filter(Boolean).map((identity) => resolvedLinks.get(identity)).find(Boolean);
+    if (!resolved) return row;
+    return {
+      ...row,
+      url: resolved.url,
+      resolvedUrl: resolved.resolvedUrl,
+      resolutionStatus: resolved.resolutionStatus,
+      domain: resolved.domain
+    };
+  });
+  for (const key3 of ["videos", "forums", "localPack", "whatPeopleSaying"]) {
+    if (!merged[key3].length && existing[key3].length) Object.assign(merged, { [key3]: structuredClone(existing[key3]) });
+  }
+  if (!merged.aiOverview.detected && existing.aiOverview.detected) merged.aiOverview = structuredClone(existing.aiOverview);
+  if (!merged.aiMode.detected && existing.aiMode.detected) merged.aiMode = structuredClone(existing.aiMode);
+  return merged;
+}
 var ProgressivePaaCheckpoint = class {
   constructor(jobId2, durableMetadata, persist, now = Date.now, initialResult) {
     this.jobId = jobId2;
@@ -27061,7 +27117,7 @@ var ProgressivePaaCheckpoint = class {
     this.sequence += 1;
     if (snapshot.lifecycle) this.lifecycle = { ...snapshot.lifecycle };
     if (snapshot.material) {
-      this.material = structuredClone(snapshot.material);
+      this.material = mergePaaProgressMaterial(this.material, snapshot.material);
       this.improvementsSinceWrite += 1;
     }
     for (const question of snapshot.clickedQuestions) if (clean2(question)) this.clickedQuestions.add(clean2(question));
@@ -27166,6 +27222,7 @@ function partialTerminalResult(job, options, maxQuestions, progress, recoveryCou
       resultQuality: "partial",
       degradedResult: false,
       retryRecommended: true,
+      pagination: material?.pagination,
       paaLifecycle: {
         ...progress.lifecycle ?? {
           requestedQuestions: maxQuestions,
@@ -27267,7 +27324,7 @@ async function runPaaHarvestJob(jobId2) {
     };
     const onPaaProgress = async (snapshot) => {
       progress.accept(snapshot);
-      const force = snapshot.phase === "attempt_ending" || snapshot.phase === "click_observed" || snapshot.phase === "expansion_finished";
+      const force = snapshot.phase === "serp_captured" || snapshot.phase === "attempt_ending" || snapshot.phase === "click_observed" || snapshot.phase === "expansion_finished";
       await progress.flush(snapshot.phase === "attempt_ending" ? "failed" : "expanding", { force });
     };
     const harvestCtx = currentCostContext();
@@ -27279,6 +27336,7 @@ async function runPaaHarvestJob(jobId2) {
         gl: options.gl ?? "us",
         hl: options.hl ?? "en",
         maxQuestions,
+        pages: options.pages ?? 1,
         maxAttempts: DIRECT_PAA_MAX_ATTEMPTS,
         proxyMode: "none",
         forceManagedSerp: true,
@@ -27297,9 +27355,31 @@ async function runPaaHarvestJob(jobId2) {
       })
     );
     const harvestResult = harvested;
+    if (Array.isArray(harvested.organicResults)) {
+      progress.accept({
+        sequence: 0,
+        observedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        clickedQuestions: [],
+        records: [],
+        phase: "attempt_ending",
+        material: {
+          surface: harvested.surface ?? "unknown",
+          organicResults: harvested.organicResults,
+          videos: harvested.videos ?? [],
+          forums: harvested.forums ?? [],
+          localPack: harvested.localPack ?? [],
+          whatPeopleSaying: harvested.whatPeopleSaying ?? [],
+          aiOverview: harvested.aiOverview ?? { detected: false, text: null, citations: [] },
+          aiMode: harvested.aiMode ?? { detected: false, text: null, citations: [] },
+          entityIds: harvested.entityIds ?? { entities: [], kgIds: [], cids: [], gcids: [] },
+          pagination: harvested.diagnostics?.pagination
+        }
+      });
+    }
     progress.mergeTerminalRows(harvestResult.flat, lastAttempt, (/* @__PURE__ */ new Date()).toISOString());
     await progress.flush("captured", { force: true });
     const terminalProgress = progress.checkpoint("captured");
+    const { pagination: terminalPagination, ...terminalMaterial } = terminalProgress.material ?? {};
     const mergedFlat = terminalProgress.records.map((record7) => flatFromRecord(record7, options.query ?? job.query));
     const rawDiagnostics = harvestResult.diagnostics && typeof harvestResult.diagnostics === "object" ? harvestResult.diagnostics : {};
     const rawCompleteness = rawDiagnostics.completeness && typeof rawDiagnostics.completeness === "object" ? rawDiagnostics.completeness : {};
@@ -27312,11 +27392,13 @@ async function runPaaHarvestJob(jobId2) {
     const automaticRetries = recoveryCount + terminalProgress.interruptions.filter((value) => value.willRetry).length;
     const result3 = {
       ...harvestResult,
+      ...terminalMaterial,
       totalQuestions: mergedFlat.length,
       flat: mergedFlat,
       stats: harvestResult.stats && typeof harvestResult.stats === "object" ? { ...harvestResult.stats, totalQuestions: mergedFlat.length } : harvestResult.stats,
       diagnostics: {
         ...rawDiagnostics,
+        pagination: terminalPagination ?? rawDiagnostics.pagination,
         resultQuality: incomplete ? "partial" : "complete",
         degradedResult: false,
         retryRecommended: discoveryStatus === "interrupted" || discoveryStatus === "recovery_exhausted",
@@ -27446,6 +27528,34 @@ function stalePartialResult(result3, records, seedQuery, recoveryCount) {
   const progress = current.progress && typeof current.progress === "object" ? current.progress : {};
   const material = progress.material && typeof progress.material === "object" ? progress.material : {};
   const diagnostics = current.diagnostics && typeof current.diagnostics === "object" ? current.diagnostics : {};
+  const currentPagination = diagnostics.pagination && typeof diagnostics.pagination === "object" ? diagnostics.pagination : {};
+  const materialPagination = material.pagination && typeof material.pagination === "object" ? material.pagination : {};
+  const currentOrganic = Array.isArray(current.organicResults) ? current.organicResults : [];
+  const materialOrganic = Array.isArray(material.organicResults) ? material.organicResults : [];
+  const capturesPageTwo = (pagination, rows) => pagination.requestedPages === 2 && pagination.capturedPages === 2 && pagination.page2Status === "captured" && typeof pagination.page1OrganicCount === "number" && typeof pagination.page2OrganicCount === "number" && pagination.page2OrganicCount > 0 && rows.length >= pagination.page1OrganicCount + pagination.page2OrganicCount;
+  const currentCaptured = capturesPageTwo(currentPagination, currentOrganic);
+  const materialCaptured = capturesPageTwo(materialPagination, materialOrganic);
+  const keepCurrentOrganic = currentCaptured && !materialCaptured || currentCaptured === materialCaptured && currentOrganic.length > materialOrganic.length;
+  const selectedOrganic = keepCurrentOrganic ? currentOrganic : materialOrganic.length ? materialOrganic : currentOrganic;
+  const fallbackOrganic = keepCurrentOrganic ? materialOrganic : currentOrganic;
+  const resolvedByIdentity = /* @__PURE__ */ new Map();
+  for (const row of [...fallbackOrganic, ...selectedOrganic]) {
+    if (row.resolutionStatus !== "resolved" || typeof row.resolvedUrl !== "string" || !row.resolvedUrl) continue;
+    for (const identity of [row.rawUrl, row.url, row.resolvedUrl]) {
+      if (typeof identity === "string" && identity) resolvedByIdentity.set(identity, row);
+    }
+  }
+  const reconciledOrganic = selectedOrganic.map((row) => {
+    if (row.resolutionStatus !== "unresolved" && row.resolutionStatus !== void 0) return row;
+    const resolved = [row.rawUrl, row.url].filter((identity) => typeof identity === "string" && Boolean(identity)).map((identity) => resolvedByIdentity.get(identity)).find(Boolean);
+    return resolved ? {
+      ...row,
+      url: resolved.url,
+      resolvedUrl: resolved.resolvedUrl,
+      resolutionStatus: resolved.resolutionStatus,
+      domain: resolved.domain
+    } : row;
+  });
   const completeness = diagnostics.completeness && typeof diagnostics.completeness === "object" ? diagnostics.completeness : {};
   const flat = records.map((record7) => ({
     seed_query: typeof record7.seed_query === "string" ? record7.seed_query : seedQuery,
@@ -27470,7 +27580,7 @@ function stalePartialResult(result3, records, seedQuery, recoveryCount) {
     tree: Array.isArray(current.tree) ? current.tree : [],
     videos: Array.isArray(material.videos) ? material.videos : current.videos ?? [],
     forums: Array.isArray(material.forums) ? material.forums : current.forums ?? [],
-    organicResults: Array.isArray(material.organicResults) ? material.organicResults : current.organicResults ?? [],
+    organicResults: reconciledOrganic,
     localPack: Array.isArray(material.localPack) ? material.localPack : current.localPack ?? [],
     whatPeopleSaying: Array.isArray(material.whatPeopleSaying) ? material.whatPeopleSaying : current.whatPeopleSaying ?? [],
     aiOverview: material.aiOverview ?? current.aiOverview,
@@ -27480,6 +27590,7 @@ function stalePartialResult(result3, records, seedQuery, recoveryCount) {
     partial: true,
     diagnostics: {
       ...diagnostics,
+      pagination: keepCurrentOrganic ? diagnostics.pagination : material.pagination ?? diagnostics.pagination,
       completionStatus: "paa_found",
       problem: null,
       resultQuality: "partial",
@@ -28292,17 +28403,17 @@ workflowApp.post("/cron/dispatch", async (c) => {
 
 // src/api/serp-intelligence-routes.ts
 import { Hono as Hono24 } from "hono";
-import { createHash as createHash15, randomUUID as randomUUID12 } from "crypto";
+import { createHash as createHash16, randomUUID as randomUUID13 } from "crypto";
 
 // src/serp-intelligence/page-snapshot-extractor.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import pLimit5 from "p-limit";
 var DEFAULT_TIMEOUT_MS2 = 15e3;
 var DEFAULT_MAX_CONCURRENCY = 2;
 var DEFAULT_MAX_CONTENT_CHARS = 25e4;
 function sha256(value) {
   if (!value) return null;
-  return createHash14("sha256").update(value).digest("hex");
+  return createHash15("sha256").update(value).digest("hex");
 }
 function countWords(markdown) {
   const matches = markdown.trim().match(/\b[\p{L}\p{N}][\p{L}\p{N}'-]*\b/gu);
@@ -29078,9 +29189,9 @@ async function logRequestEventBestEffort(input) {
   }
 }
 function captureBillingKeys(userId, suppliedKey, body3) {
-  const responseKey = suppliedKey?.trim() || randomUUID12();
-  const requestFingerprint3 = createHash15("sha256").update(JSON.stringify(body3)).digest("hex");
-  const keyDigest = createHash15("sha256").update(String(userId)).update("\0").update(responseKey).digest("hex");
+  const responseKey = suppliedKey?.trim() || randomUUID13();
+  const requestFingerprint3 = createHash16("sha256").update(JSON.stringify(body3)).digest("hex");
+  const keyDigest = createHash16("sha256").update(String(userId)).update("\0").update(responseKey).digest("hex");
   return {
     responseKey,
     debitKey: `serp-capture:${userId}:${keyDigest}`,
@@ -29408,7 +29519,7 @@ var MemoryMcpToolExecutor = class {
 };
 
 // src/api/image-source-artifacts.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 var IMAGE_SOURCE_ARTIFACT_PREFIX = "image-sources/";
 var IMAGE_SOURCE_ARTIFACT_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var IMAGE_SOURCE_DOWNLOAD_TTL_MS = 15 * 60 * 1e3;
@@ -29439,7 +29550,7 @@ async function createImageSourceArtifact(args) {
   if (args.content.length === 0 || args.content.length > IMAGE_SOURCE_MAX_BYTES) {
     throw new Error("image_source_size_invalid");
   }
-  const id2 = randomUUID13().replaceAll("-", "");
+  const id2 = randomUUID14().replaceAll("-", "");
   return createPrivateArtifact({
     policy: policy3(),
     ownerId: args.ownerId,
@@ -29471,12 +29582,12 @@ var HybridMemoryToolExecutor = class {
   }
   httpExecutor;
   user;
-  mkKeyPromise = null;
-  async resolveMkKey() {
-    if (!this.mkKeyPromise) {
-      this.mkKeyPromise = getOrCreateUserMemoryKey(this.user).then((r) => r.key);
+  serviceTokenPromise = null;
+  async resolveServiceToken() {
+    if (!this.serviceTokenPromise) {
+      this.serviceTokenPromise = getMemoryServiceToken(this.user).then((r) => r.key);
     }
-    return this.mkKeyPromise;
+    return this.serviceTokenPromise;
   }
   async callMemoryTool(upstreamName, args) {
     const accessDenied = memoryScheduleAccessPayload(upstreamName, this.user);
@@ -29530,10 +29641,10 @@ var HybridMemoryToolExecutor = class {
     }
     const handler = CUTOVER.get(upstreamName);
     if (!handler) return this.httpExecutor.callMemoryTool(upstreamName, args);
-    const mkKey = await this.resolveMkKey();
-    if (!mkKey) return { content: [{ type: "text", text: "memory unavailable" }], isError: true };
+    const serviceToken = await this.resolveServiceToken();
+    if (!serviceToken) return { content: [{ type: "text", text: "memory unavailable" }], isError: true };
     try {
-      return await handler(args, mkKey);
+      return await handler(args, serviceToken);
     } catch (err) {
       const message = err instanceof Error ? err.message : `memory ${upstreamName} failed in-process`;
       return { content: [{ type: "text", text: message }], isError: true };
@@ -29906,7 +30017,7 @@ import { getChatLinkTool } from "mcpscraper-memory-tools/tools/access/get-chat-l
 import { revokeChatLinkTool } from "mcpscraper-memory-tools/tools/access/revoke-chat-link";
 import { getVaultAppLinkTool } from "mcpscraper-memory-tools/tools/access/get-vault-app-link";
 import { revokeVaultAppLinkTool } from "mcpscraper-memory-tools/tools/access/revoke-vault-app-link";
-import { provisionDefaultsTool as provisionDefaultsTool2 } from "mcpscraper-memory-tools/tools/vaults/provision-defaults";
+import { provisionDefaultsTool } from "mcpscraper-memory-tools/tools/vaults/provision-defaults";
 import { createSecureVaultTool } from "mcpscraper-memory-tools/tools/vaults/create-secure-vault";
 import { createScheduledActionTool } from "mcpscraper-memory-tools/tools/schedule/create-scheduled-action";
 import { getScheduleStatusTool } from "mcpscraper-memory-tools/tools/schedule/get-schedule-status";
@@ -29956,7 +30067,7 @@ function registerBillingCutovers() {
     return { content: [{ type: "text", text: JSON.stringify(result3 ?? {}) }], structuredContent: result3 ?? {}, isError: false };
   });
   registerCutover("provisionDefaultsTool", async (input, apiKey) => {
-    const result3 = await provisionDefaultsTool2.execute({ ...input, apiKey }, {});
+    const result3 = await provisionDefaultsTool.execute({ ...input, apiKey }, {});
     return { content: [{ type: "text", text: JSON.stringify(result3 ?? {}) }], structuredContent: result3 ?? {}, isError: false };
   });
   registerCutover("createSecureVaultTool", async (input, apiKey) => {
@@ -30184,11 +30295,11 @@ mcpApp.all("/", async (c) => {
 });
 
 // src/api/browser-agent-routes.ts
-import { randomUUID as randomUUID18 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
 import { Hono as Hono26 } from "hono";
 
 // src/api/browser-agent-db.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 var _ready = false;
 var _migrationPromise = null;
 async function migrateBrowserAgent() {
@@ -30367,7 +30478,7 @@ async function runBrowserAgentMigration() {
 }
 async function createExtensionRow(input) {
   const db = getDb();
-  const id2 = `bext_${randomUUID14().replace(/-/g, "").slice(0, 20)}`;
+  const id2 = `bext_${randomUUID15().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_agent_extensions (id, user_id, name, backend_id, backend_name, source, source_url, size_bytes)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
@@ -30402,7 +30513,7 @@ async function deleteExtensionRow(userId, name) {
 }
 async function createAuthConnectionRow(input) {
   const db = getDb();
-  const connectionId = `authc_${randomUUID14().replace(/-/g, "").slice(0, 20)}`;
+  const connectionId = `authc_${randomUUID15().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_auth_connections (connection_id, user_id, domain, profile, account_email, note, status, browser_agent_session_id)
           VALUES (?, ?, ?, ?, ?, ?, 'NEEDS_AUTH', ?)`,
@@ -30485,7 +30596,7 @@ async function deleteProfileLabel(userId, profile) {
 }
 async function createSessionRow(input) {
   const db = getDb();
-  const id2 = `bas_${randomUUID14().replace(/-/g, "").slice(0, 20)}`;
+  const id2 = `bas_${randomUUID15().replace(/-/g, "").slice(0, 20)}`;
   await db.execute({
     sql: `INSERT INTO browser_agent_sessions (id, runtime_session_id, live_view_url, cdp_ws_url, status, label, user_id, concurrency_lock_id, last_action_at)
           VALUES (?, ?, ?, ?, 'open', ?, ?, ?, datetime('now'))`,
@@ -30563,7 +30674,7 @@ async function recordAction(input) {
     sql: `INSERT INTO browser_agent_actions (id, session_id, type, params_json, ok, error)
           VALUES (?, ?, ?, ?, ?, ?)`,
     args: [
-      `baa_${randomUUID14().replace(/-/g, "").slice(0, 20)}`,
+      `baa_${randomUUID15().replace(/-/g, "").slice(0, 20)}`,
       input.sessionId,
       input.type,
       input.params == null ? null : JSON.stringify(input.params),
@@ -31302,7 +31413,7 @@ async function runFanoutCapture(page3, input) {
 }
 
 // src/services/browser-agent/kernel-browser-runtime.ts
-import { createHmac as createHmac4, randomUUID as randomUUID15 } from "crypto";
+import { createHmac as createHmac4, randomUUID as randomUUID16 } from "crypto";
 import Kernel5 from "@onkernel/sdk";
 import { chromium as playwrightChromium } from "playwright";
 
@@ -31448,7 +31559,7 @@ var KernelBrowserRuntime = class {
         await this.client.browsers.update(browser.session_id, { viewport: input.viewport }).catch(() => void 0);
       }
       const createdAtMs = this.now();
-      const sessionRef = `brs_${randomUUID15()}`;
+      const sessionRef = `brs_${randomUUID16()}`;
       const session = {
         ownerRef,
         profileRef,
@@ -32024,9 +32135,9 @@ async function replayList(runtimeSessionId) {
 }
 
 // src/api/serp-identity-db.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 async function createSerpIdentityRow(input) {
-  const id2 = `serpi_${randomUUID16().replace(/-/g, "").slice(0, 20)}`;
+  const id2 = `serpi_${randomUUID17().replace(/-/g, "").slice(0, 20)}`;
   await getDb().execute({
     sql: `INSERT INTO serp_identities
           (id, user_id, name, kernel_profile_name, kernel_proxy_id, proxy_type, country, status)
@@ -32073,7 +32184,7 @@ async function deleteSerpIdentityRow(userId, name) {
 }
 
 // src/api/serp-identity-service.ts
-import { createHash as createHash16, randomUUID as randomUUID17 } from "crypto";
+import { createHash as createHash17, randomUUID as randomUUID18 } from "crypto";
 import Kernel7 from "@onkernel/sdk";
 var MAX_SERP_IDENTITIES_PER_USER = 3;
 function kernelClient() {
@@ -32082,8 +32193,8 @@ function kernelClient() {
   return new Kernel7({ apiKey });
 }
 function backendName(userId, name, resource) {
-  const digest23 = createHash16("sha256").update(`${userId}:${name}`).digest("hex").slice(0, 16);
-  const nonce = randomUUID17().replace(/-/g, "").slice(0, 8);
+  const digest23 = createHash17("sha256").update(`${userId}:${name}`).digest("hex").slice(0, 16);
+  const nonce = randomUUID18().replace(/-/g, "").slice(0, 8);
   return `mcp-serp-${resource}-${digest23}-${nonce}`;
 }
 function isNotFound3(error) {
@@ -32876,7 +32987,7 @@ function buildBrowserAgentRoutes() {
     }
     const existing = await getExtensionRow(user.id, name);
     if (existing) return c.json({ error: `an extension named "${name}" already exists \u2014 delete it first or pick another name` }, 409);
-    const backendName2 = `u${user.id}_${randomUUID18().replace(/-/g, "")}`;
+    const backendName2 = `u${user.id}_${randomUUID19().replace(/-/g, "")}`;
     try {
       const imported = await importExtensionFromStore(storeUrl, backendName2);
       const row = await createExtensionRow({
@@ -33216,7 +33327,7 @@ function shouldGrantScraperSubscriptionCredits(invoiceHasTierLine, invoiceTotal)
 }
 
 // src/api/analytics-journey.ts
-import { createHash as createHash23, createHmac as createHmac8, generateKeyPairSync, randomUUID as randomUUID23, sign } from "crypto";
+import { createHash as createHash24, createHmac as createHmac8, generateKeyPairSync, randomUUID as randomUUID24, sign } from "crypto";
 import twilio2 from "twilio";
 
 // src/api/analytics-contracts.ts
@@ -33777,11 +33888,11 @@ var AnalyticsEventDefinitionSchema = z32.object({
 });
 
 // src/api/analytics-candidate-associations.ts
-import { createHmac as createHmac5, randomUUID as randomUUID20 } from "crypto";
+import { createHmac as createHmac5, randomUUID as randomUUID21 } from "crypto";
 import ipaddr from "ipaddr.js";
 
 // src/api/analytics-identity-namespace.ts
-import { randomUUID as randomUUID19 } from "crypto";
+import { randomUUID as randomUUID20 } from "crypto";
 async function listAnalyticsIdentityNamespaces(input) {
   const result3 = await getAnalyticsPool().query(
     `SELECT id, site_id, name, status, version, approved_at
@@ -33860,7 +33971,7 @@ async function createAnalyticsIdentityNamespace(input) {
        id, site_id, name, status, approved_hosts, approved_sources, version, approved_by_user_id
      ) VALUES ($1,$2,$3,'draft','[]'::jsonb,'[]'::jsonb,1,$4)
      RETURNING id, site_id, name, status, version, approved_at`,
-      [randomUUID19(), input.siteId, name, input.createdByUserId]
+      [randomUUID20(), input.siteId, name, input.createdByUserId]
     );
     const saved = created.rows[0];
     await client2.query("COMMIT");
@@ -33900,7 +34011,7 @@ async function approveAnalyticsNamespaceSource(input) {
        ON CONFLICT(namespace_id, source_kind, source_ref) DO UPDATE
          SET status='approved', revoked_at=NULL
        RETURNING id, namespace_id, site_id, source_kind, source_ref, status, created_at, revoked_at`,
-      [randomUUID19(), input.namespaceId, input.siteId, storedKind, sourceRef]
+      [randomUUID20(), input.namespaceId, input.siteId, storedKind, sourceRef]
     );
     await client2.query(
       `UPDATE analytics_identity_namespaces
@@ -34061,7 +34172,7 @@ async function promoteAnalyticsCandidateWithDeterministicEvidence(input) {
        ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
        ON CONFLICT(association_id, person_id) DO NOTHING`,
       [
-        randomUUID20(),
+        randomUUID21(),
         input.siteId,
         input.namespaceId,
         input.associationId,
@@ -34080,7 +34191,7 @@ async function promoteAnalyticsCandidateWithDeterministicEvidence(input) {
        ) VALUES ($1,$2,$3,$4,'candidate_promoted',$5,$6,'promoted',$7::jsonb,$8)
        ON CONFLICT(site_id, idempotency_key) DO NOTHING`,
       [
-        randomUUID20(),
+        randomUUID21(),
         input.siteId,
         input.namespaceId,
         input.associationId,
@@ -34099,7 +34210,7 @@ async function promoteAnalyticsCandidateWithDeterministicEvidence(input) {
          'xray.identity-promotion.v1',$11,$12)
        ON CONFLICT(site_id,idempotency_key) DO NOTHING`,
       [
-        randomUUID20(),
+        randomUUID21(),
         input.siteId,
         input.namespaceId,
         input.personId,
@@ -34129,16 +34240,16 @@ async function promoteAnalyticsCandidateWithDeterministicEvidence(input) {
 }
 
 // src/api/analytics-crm-outbound.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 import { z as z33 } from "zod";
 
 // src/api/analytics-crm-repository.ts
-import { createHash as createHash17, randomUUID as randomUUID21 } from "crypto";
+import { createHash as createHash18, randomUUID as randomUUID22 } from "crypto";
 function dbOrDefault(db) {
   return db ?? getAnalyticsPool();
 }
 function analyticsCrmRequestFingerprint(input) {
-  return createHash17("sha256").update(JSON.stringify(input)).digest("hex");
+  return createHash18("sha256").update(JSON.stringify(input)).digest("hex");
 }
 async function requireConnection(input) {
   const result3 = await dbOrDefault(input.db).query(
@@ -34194,7 +34305,7 @@ async function persistAnalyticsCrmProvisioningPlan(input) {
        created_by_user_id,public_plan_id,schema_fingerprint,request_fingerprint,created_at,updated_at
      ) VALUES($1,$2,$3,$4,1,$5,$6::jsonb,'preview',$7,$8,$9,$10,$11,$11)`,
     [
-      randomUUID21(),
+      randomUUID22(),
       input.siteId,
       connectionId,
       plan.provider,
@@ -34248,7 +34359,7 @@ async function persistAnalyticsCrmProvisioningReceipt(input) {
      ) VALUES($1,$2,$3,$4,$5,'[]'::jsonb,$6,$7,$8::jsonb)
      ON CONFLICT (public_receipt_id) WHERE public_receipt_id IS NOT NULL
      DO UPDATE SET operation=EXCLUDED.operation,status=EXCLUDED.status,safe_error_code=EXCLUDED.safe_error_code,receipt=EXCLUDED.receipt`,
-    [randomUUID21(), plan.rows[0].id, operation, status, receipt4.errorCode ?? null, receipt4.occurredAt, receipt4.receiptId, JSON.stringify(receipt4)]
+    [randomUUID22(), plan.rows[0].id, operation, status, receipt4.errorCode ?? null, receipt4.occurredAt, receipt4.receiptId, JSON.stringify(receipt4)]
   );
   await db.query(
     `UPDATE analytics_crm_provisioning_plans
@@ -34374,7 +34485,7 @@ async function scheduleAnalyticsCrmSyncRun(input) {
          next_attempt_at=CASE WHEN analytics_reconciliation_jobs.status='leased'
            THEN analytics_reconciliation_jobs.next_attempt_at ELSE EXCLUDED.next_attempt_at END,
          updated_at=now()`,
-      [randomUUID21(), input.connectionId, input.nextRunAt]
+      [randomUUID22(), input.connectionId, input.nextRunAt]
     );
   }
   return true;
@@ -34446,7 +34557,7 @@ async function completeAnalyticsCrmInboundPage(input) {
     `INSERT INTO analytics_crm_sync_receipts(
        id,site_id,connection_id,direction,operation,subject_ref,external_receipt_id,status,occurred_at
      ) VALUES($1,$2,$3,'inbound','historical_pull',NULL,$4,'accepted',now())`,
-    [randomUUID21(), input.siteId, input.connectionId, input.receiptFingerprint]
+    [randomUUID22(), input.siteId, input.connectionId, input.receiptFingerprint]
   );
 }
 async function deferAnalyticsCrmInboundPage(input) {
@@ -34474,7 +34585,7 @@ async function deferAnalyticsCrmInboundPage(input) {
     `INSERT INTO analytics_crm_sync_receipts(
        id,site_id,connection_id,direction,operation,subject_ref,external_receipt_id,status,safe_error_code,occurred_at
      ) VALUES($1,$2,$3,'inbound','historical_pull',NULL,$4,$5,$6,now())`,
-    [randomUUID21(), input.siteId, input.connectionId, input.receiptFingerprint, status, input.safeErrorCode]
+    [randomUUID22(), input.siteId, input.connectionId, input.receiptFingerprint, status, input.safeErrorCode]
   );
 }
 function projectOutboundPolicy(row) {
@@ -34646,7 +34757,7 @@ async function claimAnalyticsCrmOutboundJobs(input) {
     await dbOrDefault(input.db).query(
       `INSERT INTO analytics_crm_outbound_attempts(id,job_id,attempt,status,started_at)
        VALUES($1,$2,$3,'started',now()) ON CONFLICT(job_id,attempt) DO NOTHING`,
-      [randomUUID21(), row.job_id, Number(row.attempts)]
+      [randomUUID22(), row.job_id, Number(row.attempts)]
     );
   }
   return result3.rows.map((row) => ({
@@ -34749,7 +34860,7 @@ async function settleAnalyticsCrmOutboundJob(input) {
   await db.query(
     `INSERT INTO analytics_crm_outbound_attempts(id,job_id,attempt,status,safe_error_code,completed_at)
      VALUES($1,$2,$3,$4,$5,now()) ON CONFLICT(job_id,attempt) DO UPDATE SET status=EXCLUDED.status,safe_error_code=EXCLUDED.safe_error_code,completed_at=now()`,
-    [randomUUID21(), input.jobId, attempt, input.status === "accepted" ? "accepted" : state2 === "retrying" ? "retrying" : "failed", input.safeErrorCode ?? null]
+    [randomUUID22(), input.jobId, attempt, input.status === "accepted" ? "accepted" : state2 === "retrying" ? "retrying" : "failed", input.safeErrorCode ?? null]
   );
   await db.query(
     `INSERT INTO analytics_crm_outbound_receipts(receipt_id,job_id,status,external_receipt_id,safe_error_code)
@@ -34785,7 +34896,7 @@ async function listAnalyticsCrmOutboundReceipts(input) {
 }
 
 // src/api/analytics-crm-provisioning.ts
-import { createHash as createHash18 } from "crypto";
+import { createHash as createHash19 } from "crypto";
 
 // src/api/analytics-crm-provider-contract.ts
 var ANALYTICS_CRM_PROVIDER_IDS = [
@@ -35156,10 +35267,10 @@ var XRAY_FIELDS = [
   { internalName: "xray_consent_receipt_ref", label: "X-Ray Consent Receipt", type: "string", writable: true }
 ];
 function stableId(prefix, input) {
-  return `${prefix}_${createHash18("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 24)}`;
+  return `${prefix}_${createHash19("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 24)}`;
 }
 function fingerprint2(input) {
-  return createHash18("sha256").update(JSON.stringify(input)).digest("hex");
+  return createHash19("sha256").update(JSON.stringify(input)).digest("hex");
 }
 function analyticsCrmSchemaFingerprint(fields) {
   return fingerprint2([...fields].sort(
@@ -35566,7 +35677,7 @@ var OutboundPayloadSchema = z33.object({
   }).strict().nullable()
 }).strict();
 function id(prefix, input) {
-  return `${prefix}_${createHash19("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 24)}`;
+  return `${prefix}_${createHash20("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 24)}`;
 }
 function pathOnly(value) {
   const normalized = normalizeAnalyticsUrl(value);
@@ -35774,7 +35885,7 @@ async function drainAnalyticsCrmOutbound(limit = 10, deadlineMs = Date.now() + D
 }
 
 // src/api/analytics-lead-scoring.ts
-import { createHash as createHash20, randomUUID as randomUUID22 } from "crypto";
+import { createHash as createHash21, randomUUID as randomUUID23 } from "crypto";
 import { z as z34 } from "zod";
 var SafeIdentifierSchema = z34.string().trim().min(1).max(160).regex(/^[a-zA-Z0-9_.:-]+$/);
 var PropertyNameSchema = z34.string().trim().min(1).max(160).regex(/^[a-zA-Z][a-zA-Z0-9_.:-]*$/);
@@ -35892,11 +36003,11 @@ function predicateEvidence(predicate, facts, evaluatedAt) {
 }
 function stableFingerprint(value) {
   const normalize = (input) => Array.isArray(input) ? input.map(normalize) : input && typeof input === "object" ? Object.fromEntries(Object.entries(input).sort(([a], [b]) => a.localeCompare(b)).map(([property, nested]) => [property, normalize(nested)])) : input;
-  return createHash20("sha256").update(JSON.stringify(normalize(value))).digest("hex");
+  return createHash21("sha256").update(JSON.stringify(normalize(value))).digest("hex");
 }
 function createAnalyticsLeadScore(input) {
   const parsed = ScoreDefinitionInputSchema.parse(input.definition);
-  const id2 = input.id ?? randomUUID22();
+  const id2 = input.id ?? randomUUID23();
   if (input.tables.definitions.has(key(parsed.namespaceId, id2))) throw new AnalyticsLeadScoringError("analytics_score_exists", "A lead score with this ID already exists.");
   const timestamp5 = nowIso(input.now);
   const definition = { id: id2, ...parsed, groups: parsed.groups.map((group) => ({ ...group, predicates: group.predicates.map((predicate) => ({ ...predicate })) })), version: 1, createdAt: timestamp5, updatedAt: timestamp5 };
@@ -35932,7 +36043,7 @@ function evaluateAnalyticsLeadScore(input) {
   const idempotencyKey4 = stableFingerprint({ namespaceId: input.namespaceId, scoreId: input.scoreId, version: definition.version, subjectRef: input.subjectRef, identityTier: input.identityTier, components, value });
   const existing = input.tables.evaluations.get(idempotencyKey4);
   if (existing) return { ...existing, components: existing.components.map((component) => ({ ...component, evidenceRefs: [...component.evidenceRefs] })), evidenceRefs: [...existing.evidenceRefs] };
-  const evaluation = { id: randomUUID22(), namespaceId: input.namespaceId, subjectRef: input.subjectRef, identityTier: input.identityTier, scoreId: definition.id, scoreVersion: definition.version, scoreKind: definition.kind, value, components, evidenceRefs, evaluatedAt, idempotencyKey: idempotencyKey4, providerEligible: input.identityTier === "confirmed" };
+  const evaluation = { id: randomUUID23(), namespaceId: input.namespaceId, subjectRef: input.subjectRef, identityTier: input.identityTier, scoreId: definition.id, scoreVersion: definition.version, scoreKind: definition.kind, value, components, evidenceRefs, evaluatedAt, idempotencyKey: idempotencyKey4, providerEligible: input.identityTier === "confirmed" };
   input.tables.evaluations.set(idempotencyKey4, evaluation);
   input.tables.evaluationHistory.push(evaluation);
   return { ...evaluation, components: evaluation.components.map((component) => ({ ...component, evidenceRefs: [...component.evidenceRefs] })), evidenceRefs: [...evaluation.evidenceRefs] };
@@ -36164,7 +36275,7 @@ function normalizeTwilioWebhook(input) {
 }
 
 // src/api/analytics-session-reports.ts
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHash as createHash21, createHmac as createHmac7 } from "crypto";
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHash as createHash22, createHmac as createHmac7 } from "crypto";
 var prefixes = {
   session: "xrs_",
   visitor: "xrv_",
@@ -36173,7 +36284,7 @@ var prefixes = {
   candidate: "xri_"
 };
 function reportKey(purpose) {
-  return createHash21("sha256").update(`xray-report:${purpose}:`).update(getSessionSecret()).digest();
+  return createHash22("sha256").update(`xray-report:${purpose}:`).update(getSessionSecret()).digest();
 }
 function createAnalyticsReportReference(kind, siteId, value) {
   const key3 = reportKey("reference");
@@ -36880,7 +36991,7 @@ async function analyticsInferenceReview(input, db = getAnalyticsPool()) {
 }
 
 // src/api/analytics-providers/crm.ts
-import { createHash as createHash22, createVerify, verify } from "crypto";
+import { createHash as createHash23, createVerify, verify } from "crypto";
 function verifyHubSpotWebhook(input) {
   if (!webhookTimestampFresh(input.timestamp, input.now)) return false;
   const source = `${input.method.toUpperCase()}${input.url}${input.rawBody}${input.timestamp}`;
@@ -36919,7 +37030,7 @@ function verifyHighLevelWebhook(input) {
 function crmStageToExternalEvent(event2) {
   return {
     schemaVersion: 1,
-    eventId: `crm_${createHash22("sha256").update(`${event2.source}:${event2.sourceEventId}`).digest("hex").slice(0, 24)}`,
+    eventId: `crm_${createHash23("sha256").update(`${event2.source}:${event2.sourceEventId}`).digest("hex").slice(0, 24)}`,
     sourceEventId: event2.sourceEventId,
     source: event2.source,
     sourceAccountRef: event2.sourceAccountRef,
@@ -37158,7 +37269,7 @@ async function createAnalyticsEventDefinition(input) {
        status=EXCLUDED.status, version=analytics_event_definitions.version+1, updated_at=now()
      RETURNING id, name, event_name, trigger_kind, definition, version, status, created_at, updated_at`,
     [
-      randomUUID23(),
+      randomUUID24(),
       input.siteId,
       definition.name,
       definition.eventName,
@@ -37340,7 +37451,7 @@ async function createAnalyticsConnection(input) {
        (secret_ciphertext IS NOT NULL) AS webhook_secret_configured,
        created_at, updated_at`,
     [
-      randomUUID23(),
+      randomUUID24(),
       input.siteId,
       input.provider.trim().toLowerCase().slice(0, 80),
       input.name.trim().slice(0, 120),
@@ -37554,7 +37665,7 @@ async function describeAnalyticsConnectionReconciliation(input) {
   };
 }
 async function recordAnalyticsWebhookReceipt(input) {
-  const id2 = randomUUID23();
+  const id2 = randomUUID24();
   const payloadCiphertext = input.rawBody ? encryptAnalyticsRestricted(input.rawBody, "webhook-payload") : null;
   const result3 = await getAnalyticsPool().query(
     `INSERT INTO analytics_webhook_receipts(
@@ -37642,7 +37753,7 @@ async function createAnalyticsConversionRule(input) {
        updated_at = now()
      RETURNING *`,
     [
-      randomUUID23(),
+      randomUUID24(),
       input.siteId,
       parsed.name,
       parsed.conversionKind,
@@ -38028,7 +38139,7 @@ async function recordAnalyticsExternalEvent(input) {
        ON CONFLICT(site_id, source, source_account_ref, source_event_id) DO NOTHING
        RETURNING id`,
       [
-        randomUUID23(),
+        randomUUID24(),
         input.siteId,
         // This FK targets analytics_webhook_receipts. Consent receipts are
         // separate evidence and remain in eligibility/activation payloads.
@@ -38101,7 +38212,7 @@ async function recordAnalyticsExternalEvent(input) {
       const storedValueMinor = resolvedValue.valueMinor ?? 0;
       const storedCurrency = (resolvedValue.currency || rule.default_currency || "USD").toUpperCase();
       const valueSource = resolvedValue.provenance.resolution === "absent" ? "absent" : resolvedValue.provenance.resolution === "fallback" ? "dynamic" : resolvedValue.provenance.resolution;
-      const conversionId = randomUUID23();
+      const conversionId = randomUUID24();
       const result3 = await client2.query(
         `INSERT INTO analytics_conversions(
            id, source_event_id, site_id, session_id, conversion_kind,
@@ -38173,7 +38284,7 @@ async function recordAnalyticsExternalEvent(input) {
              id, destination_id, conversion_id, person_id, payload_ciphertext
            ) VALUES ($1,$2,$3,$4,$5)
            ON CONFLICT(destination_id, conversion_id) DO NOTHING`,
-          [randomUUID23(), destination.id, result3.rows[0].id, personId, payload]
+          [randomUUID24(), destination.id, result3.rows[0].id, personId, payload]
         );
       }
     }
@@ -38742,9 +38853,8 @@ async function resolveUser2(customerId, emailFallback) {
 // src/api/oauth-routes.ts
 import { Hono as Hono28 } from "hono";
 import { getCookie, setCookie } from "hono/cookie";
-import { createHash as createHash24, randomBytes as randomBytes3, randomUUID as randomUUID24 } from "crypto";
-import { importPKCS8, exportJWK, SignJWT } from "jose";
-var ISSUER = "https://mcpscraper.dev";
+import { createHash as createHash25, randomBytes as randomBytes3 } from "crypto";
+var ISSUER = OAUTH_ISSUER;
 var RESOURCE = () => process.env.MCP_MEMORY_RESOURCE_URL ?? "https://memory.mcpscraper.dev/mcp";
 var SCRAPER_RESOURCE = () => (process.env.MCP_SCRAPER_RESOURCE_URL ?? "https://mcpscraper.dev/mcp").replace(/\/$/, "");
 var MEMORY_SCOPES = ["memory.read", "memory.write", "memory.admin"];
@@ -38791,22 +38901,6 @@ var sessionCookieOptions = {
   maxAge: 60 * 60 * 24 * 30,
   sameSite: "Lax"
 };
-var cachedKeys = null;
-async function getKeys() {
-  if (cachedKeys) return cachedKeys;
-  const raw = process.env.OAUTH_SIGNING_KEY;
-  if (!raw?.trim()) throw new Error("OAUTH_SIGNING_KEY is not set");
-  const pem = raw.includes("BEGIN") ? raw : Buffer.from(raw, "base64").toString("utf8");
-  const privateKey = await importPKCS8(pem, "RS256", { extractable: true });
-  const full = await exportJWK(privateKey);
-  const publicJwk = { kty: full.kty, n: full.n, e: full.e };
-  const kid = createHash24("sha256").update(JSON.stringify({ e: publicJwk.e, kty: publicJwk.kty, n: publicJwk.n })).digest("base64url").slice(0, 16);
-  publicJwk.kid = kid;
-  publicJwk.alg = "RS256";
-  publicJwk.use = "sig";
-  cachedKeys = { privateKey, publicJwk, kid };
-  return cachedKeys;
-}
 function isAllowedRedirect(uri) {
   let u;
   try {
@@ -38992,7 +39086,7 @@ oauthApp.get("/.well-known/openid-configuration/*", (c) => {
   return c.json(openidConfiguration());
 });
 oauthApp.get("/.well-known/jwks.json", async (c) => {
-  const { publicJwk } = await getKeys();
+  const publicJwk = await getOAuthPublicJwk();
   c.header("Cache-Control", "public, max-age=3600");
   return c.json({ keys: [publicJwk] });
 });
@@ -39122,12 +39216,11 @@ oauthApp.post("/oauth/authorize", async (c) => {
 });
 function pkceMatches(verifier, challenge) {
   if (!verifier) return false;
-  const computed = createHash24("sha256").update(verifier).digest("base64url");
+  const computed = createHash25("sha256").update(verifier).digest("base64url");
   return computed === challenge;
 }
 async function mintAccessToken(identity, scope, plan, audience) {
-  const { privateKey, kid } = await getKeys();
-  return new SignJWT({ scope, plan }).setProtectedHeader({ alg: "RS256", kid }).setIssuer(ISSUER).setSubject(identity).setAudience(audience).setIssuedAt().setJti(randomUUID24()).setExpirationTime(`${ACCESS_TTL_SECONDS}s`).sign(privateKey);
+  return mintOAuthAccessToken({ identity, scope, plan, audience, ttlSeconds: ACCESS_TTL_SECONDS });
 }
 function tokenErrorResponse(c, error, description, status) {
   return c.json({ error, error_description: description }, status);
@@ -40602,7 +40695,7 @@ import { Hono as Hono32 } from "hono";
 import { Resend } from "resend";
 
 // src/api/resend-support-thread.ts
-import { createHash as createHash25 } from "crypto";
+import { createHash as createHash26 } from "crypto";
 var SUPPORT_TAGS = [
   {
     tag: "support",
@@ -40642,7 +40735,7 @@ function quoteUntrusted(value) {
   return clean3.split("\n").map((line) => `> ${line}`).join("\n");
 }
 function shortHash(value, length = 24) {
-  return createHash25("sha256").update(value).digest("hex").slice(0, length);
+  return createHash26("sha256").update(value).digest("hex").slice(0, length);
 }
 function safePathPart(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "contact";
@@ -42141,7 +42234,7 @@ import { Hono as Hono34 } from "hono";
 import { z as z36 } from "zod";
 
 // src/editorial-reading-room/render.ts
-import { createHash as createHash26 } from "crypto";
+import { createHash as createHash27 } from "crypto";
 import { readFileSync as readFileSync3 } from "fs";
 import { dirname as dirname3, join as join8, resolve } from "path";
 import { Marked, Renderer } from "marked";
@@ -42302,7 +42395,7 @@ function renderEditorialReadingRoom(input, now = /* @__PURE__ */ new Date()) {
     articleCount: articles.length,
     wordCount: totalWordCount,
     bytes: bytes2,
-    sha256: createHash26("sha256").update(html).digest("hex"),
+    sha256: createHash27("sha256").update(html).digest("hex"),
     warnings
   };
 }
@@ -42385,7 +42478,7 @@ ${provenance}`;
     ...rendered,
     html,
     bytes: Buffer.byteLength(html),
-    sha256: createHash26("sha256").update(html).digest("hex")
+    sha256: createHash27("sha256").update(html).digest("hex")
   };
 }
 
@@ -42508,10 +42601,10 @@ import { Hono as Hono35 } from "hono";
 import { z as z37 } from "zod";
 
 // src/api/commons-repository.ts
-import { createHash as createHash29, randomUUID as randomUUID26 } from "crypto";
+import { createHash as createHash30, randomUUID as randomUUID26 } from "crypto";
 
 // src/api/commons-image-store.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 import { lookup as dnsLookup } from "dns/promises";
 import { isIP } from "net";
 var COMMONS_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
@@ -42841,7 +42934,7 @@ async function hostCommonsImage(input) {
       415
     );
   }
-  const digest23 = createHash27("sha256").update(bytes2).digest("hex");
+  const digest23 = createHash28("sha256").update(bytes2).digest("hex");
   const existing = await getDb().execute({
     sql: "SELECT id, url, content_type, bytes, source_url FROM commons_images WHERE digest = ? LIMIT 1",
     args: [digest23]
@@ -42973,7 +43066,7 @@ async function schemaObjectsPresent(names) {
 }
 
 // src/api/commons-linksets.ts
-import { createHash as createHash28 } from "crypto";
+import { createHash as createHash29 } from "crypto";
 var COMMONS_LINKSET_MEDIA_TYPE = "application/linkset+json";
 var COMMONS_RELATIONSHIP_PROFILE = "https://mcpscraper.dev/commons/profiles/relationships/v1";
 var REGISTERED_RELATIONS = /* @__PURE__ */ new Set([
@@ -43080,7 +43173,7 @@ function buildCommonsLinkset(entity, claims) {
     context[claim.predicate] = targets;
   }
   const document2 = { linkset: [context] };
-  const etag = `"${createHash28("sha256").update(JSON.stringify(document2)).digest("hex")}"`;
+  const etag = `"${createHash29("sha256").update(JSON.stringify(document2)).digest("hex")}"`;
   return { document: document2, etag, publicUrl, linksetUrl, profile: COMMONS_RELATIONSHIP_PROFILE };
 }
 function commonsLinksetDiscoveryHeader(idOrSlug) {
@@ -44893,7 +44986,7 @@ function commonsIndexDocuments(entity, now) {
   return documents;
 }
 function commonsIndexDocumentId(entityId, documentType, documentKey) {
-  return `commons-index-${createHash29("sha256").update(`${entityId}
+  return `commons-index-${createHash30("sha256").update(`${entityId}
 ${documentType}
 ${documentKey}`).digest("hex").slice(0, 32)}`;
 }
@@ -45471,7 +45564,7 @@ var CommonsRepositoryError = class extends Error {
 };
 
 // src/api/commons-publication-repository.ts
-import { createHash as createHash30, randomUUID as randomUUID27 } from "crypto";
+import { createHash as createHash31, randomUUID as randomUUID27 } from "crypto";
 
 // src/editorial-reading-room/article-page.ts
 function escapeHtml6(value) {
@@ -45760,7 +45853,7 @@ async function publishCommonsEditorial(input, user) {
         JSON.stringify(editionInput.articles),
         html,
         rendered.filename,
-        createHash30("sha256").update(html).digest("hex"),
+        createHash31("sha256").update(html).digest("hex"),
         rendered.articleCount,
         rendered.wordCount,
         Buffer.byteLength(html),
@@ -45842,7 +45935,7 @@ async function updateCommonsEditorialArticle(input, user) {
         JSON.stringify(nextArticles),
         html,
         rendered.filename,
-        createHash30("sha256").update(html).digest("hex"),
+        createHash31("sha256").update(html).digest("hex"),
         rendered.articleCount,
         rendered.wordCount,
         Buffer.byteLength(html),
@@ -46665,11 +46758,11 @@ function xmlEscape(value) {
 import { Hono as Hono36 } from "hono";
 import { createMiddleware as createMiddleware4 } from "hono/factory";
 import { z as z43 } from "zod";
-import { createHash as createHash43, randomUUID as randomUUID38 } from "crypto";
+import { createHash as createHash44, randomUUID as randomUUID38 } from "crypto";
 import Papa5 from "papaparse";
 
 // src/api/analytics-manual-imports.ts
-import { createHash as createHash31 } from "crypto";
+import { createHash as createHash32 } from "crypto";
 import Papa4 from "papaparse";
 import { z as z38 } from "zod";
 var AnalyticsManualImportMappingSchema = z38.object({
@@ -46764,7 +46857,7 @@ function previewAnalyticsManualImport(input) {
       continue;
     }
     identities.add(identityKey2);
-    const digest23 = createHash31("sha256").update(`${parsedInput.sourceSystem}:${stableIdentity}`).digest("hex");
+    const digest23 = createHash32("sha256").update(`${parsedInput.sourceSystem}:${stableIdentity}`).digest("hex");
     const crmEntityId = `${digest23.slice(0, 8)}-${digest23.slice(8, 12)}-5${digest23.slice(13, 16)}-${(Number.parseInt(digest23.slice(16, 18), 16) & 63 | 128).toString(16)}${digest23.slice(18, 20)}-${digest23.slice(20, 32)}`;
     rows.push({
       row: rowNumber,
@@ -46786,7 +46879,7 @@ function previewAnalyticsManualImport(input) {
     });
   }
   const headers = parsed.meta.fields ?? [];
-  const fingerprint5 = createHash31("sha256").update(canonical({ sourceSystem: parsedInput.sourceSystem, filename: parsedInput.filename, mapping: parsedInput.mapping, rows })).digest("hex");
+  const fingerprint5 = createHash32("sha256").update(canonical({ sourceSystem: parsedInput.sourceSystem, filename: parsedInput.filename, mapping: parsedInput.mapping, rows })).digest("hex");
   return {
     schemaVersion: 1,
     fingerprint: fingerprint5,
@@ -46801,7 +46894,7 @@ function previewAnalyticsManualImport(input) {
   };
 }
 function deterministicAnalyticsManualImportId(input) {
-  const hex = createHash31("sha256").update(`${input.siteId}:${input.userId}:${input.idempotencyKey}:${input.fingerprint}`).digest("hex");
+  const hex = createHash32("sha256").update(`${input.siteId}:${input.userId}:${input.idempotencyKey}:${input.fingerprint}`).digest("hex");
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
 }
 
@@ -46971,7 +47064,7 @@ function consumeAnalyticsLinkerToken(input) {
 }
 
 // src/api/nango-control.ts
-import { createHash as createHash32, randomUUID as randomUUID29 } from "crypto";
+import { createHash as createHash33, randomUUID as randomUUID29 } from "crypto";
 
 // src/api/connected-data-export.ts
 import { randomUUID as randomUUID28 } from "crypto";
@@ -48352,8 +48445,8 @@ async function setScheduleConnectionActionsEnabled(identity, connectionId, enabl
   return data.connection.actionsEnabled === true;
 }
 async function callScheduleConnectionAction(identity, connectionId, input, tool, idempotencyKey4) {
-  const requestId = `main-connected-action:${createHash32("sha256").update(identity).update("\0").update(idempotencyKey4?.trim() || randomUUID29()).digest("hex")}`;
-  const requestDigest2 = createHash32("sha256").update(connectionId).update("\0").update(tool?.trim() ?? "").update("\0").update(canonicalJson(input)).digest("hex");
+  const requestId = `main-connected-action:${createHash33("sha256").update(identity).update("\0").update(idempotencyKey4?.trim() || randomUUID29()).digest("hex")}`;
+  const requestDigest2 = createHash33("sha256").update(connectionId).update("\0").update(tool?.trim() ?? "").update("\0").update(canonicalJson(input)).digest("hex");
   if (mainOwnsIntegrations()) {
     const selectedTool = tool?.trim();
     if (!selectedTool) throw new NangoControlError("An action tool is required.", 400, "invalid_request", false);
@@ -48504,7 +48597,7 @@ function canonicalJson(value) {
   return JSON.stringify(value);
 }
 function projectedToolSchemaHash(tool) {
-  return createHash32("sha256").update(canonicalJson(tool)).digest("hex");
+  return createHash33("sha256").update(canonicalJson(tool)).digest("hex");
 }
 async function describeNangoTool(identity, connectionId, tool, fresh) {
   if (mainOwnsIntegrations()) {
@@ -48695,9 +48788,9 @@ async function callMainOwnedExportPage(identity, input) {
     });
   }
   if (connection.providerConfigKey === "google-mail" && input.dataset === "emails") {
-    const { GmailService: GmailService2 } = await import("./gmail-service-BUSU4BVX.js");
+    const { GmailService: GmailService2 } = await import("./gmail-service-E6ALS7JG.js");
     const service = new GmailService2();
-    const ownerId3 = createHash32("sha256").update(identity.toLowerCase()).digest("hex").slice(0, 24);
+    const ownerId3 = createHash33("sha256").update(identity.toLowerCase()).digest("hex").slice(0, 24);
     const after = Math.floor(Date.parse(input.from) / 1e3);
     const before = Math.ceil(Date.parse(input.to) / 1e3);
     if (!Number.isFinite(after) || !Number.isFinite(before) || after >= before) throw new NangoControlError("Gmail export range is invalid.", 400, "invalid_request", false);
@@ -48938,7 +49031,7 @@ async function discoverAnalyticsActivationAssets(input) {
 
 // src/api/analytics-entitlement.ts
 import {
-  createHash as createHash33,
+  createHash as createHash34,
   createHmac as createHmac10,
   randomBytes as randomBytes4,
   timingSafeEqual as timingSafeEqual6
@@ -49153,7 +49246,7 @@ function dashboardCallbackUrl() {
 async function createThorbitConnectUrl(userId) {
   if (!bridgeConfigured()) throw new Error("Thorbit X-Ray account bridge is not configured");
   const state2 = randomBytes4(32).toString("base64url");
-  const stateHash = createHash33("sha256").update(state2).digest("hex");
+  const stateHash = createHash34("sha256").update(state2).digest("hex");
   await getAnalyticsPool().query(
     `INSERT INTO analytics_thorbit_connect_states(state_hash,user_id,expires_at)
      VALUES ($1,$2,now()+interval '10 minutes')
@@ -49182,7 +49275,7 @@ function verifyThorbitAssertion(token7) {
   return parsed.data.entitlement;
 }
 async function consumeThorbitConnectCallback(input) {
-  const stateHash = createHash33("sha256").update(input.state).digest("hex");
+  const stateHash = createHash34("sha256").update(input.state).digest("hex");
   const client2 = await getAnalyticsPool().connect();
   try {
     await client2.query("BEGIN");
@@ -49224,7 +49317,7 @@ async function disconnectAnalyticsEntitlement(userId) {
 }
 
 // src/api/analytics-onboarding.ts
-import { createHash as createHash34 } from "crypto";
+import { createHash as createHash35 } from "crypto";
 var MINIMUM = "minimum_setup";
 var PRODUCTION = "production_readiness";
 var ADVANCED = "advanced_optimization";
@@ -49425,7 +49518,7 @@ var DEFAULT_PRESENTATION = {
 };
 function safeRef(kind, value) {
   if (typeof value !== "string" || !value) return null;
-  return `${kind}:${createHash34("sha256").update(value).digest("hex").slice(0, 16)}`;
+  return `${kind}:${createHash35("sha256").update(value).digest("hex").slice(0, 16)}`;
 }
 function asIso(value) {
   if (!value) return null;
@@ -50011,11 +50104,11 @@ async function analyticsFunnel(input) {
 }
 
 // src/api/analytics-site-setup.ts
-import { createHash as createHash38, randomUUID as randomUUID31 } from "crypto";
+import { createHash as createHash39, randomUUID as randomUUID31 } from "crypto";
 import { load } from "cheerio";
 
 // src/services/analytics-site-setup/action-candidates.ts
-import { createHash as createHash35 } from "crypto";
+import { createHash as createHash36 } from "crypto";
 var FORBIDDEN_KEYS = /email|phone|name|address|message|query|token|secret|password|visitor|session|person|ip/i;
 var SENSITIVE_VALUE = /@|\b(?:\+?\d[\d\s().-]{7,}\d)\b|bearer\s|api[_-]?key/i;
 function slug3(value) {
@@ -50051,7 +50144,7 @@ function buildAnalyticsActionCandidates(inputs) {
     const exclusionReason = context.rejected ? "sensitive_context" : occurrenceOnly ? "occurrence_only" : input.confidence < 0.7 ? "low_confidence" : void 0;
     return {
       ...input,
-      candidateId: `candidate_${createHash35("sha256").update(stableKey).digest("hex").slice(0, 20)}`,
+      candidateId: `candidate_${createHash36("sha256").update(stableKey).digest("hex").slice(0, 20)}`,
       eventName: slug3(`${input.action}_${input.destination ?? input.label}`),
       disposition: exclusionReason ? exclusionReason === "occurrence_only" ? "proposed" : "excluded" : "recommended",
       rationale: input.sourceComponent ? `Instrument the shared ${input.sourceComponent} component instead of repeated route instances.` : `Instrument the meaningful ${input.action} action at its owned source boundary.`,
@@ -50104,10 +50197,10 @@ function buildAnalyticsFirstAnswers(evidence, readiness2, thresholds = DEFAULT_F
 }
 
 // src/services/analytics-site-setup/improvement-loop.ts
-import { createHash as createHash36 } from "crypto";
+import { createHash as createHash37 } from "crypto";
 function nextAnalyticsImprovement(input) {
   const eligible = input.backlog.filter((item) => item.revision === input.revision && !item.applied && !item.skipped).sort((a, b) => a.rank - b.rank || a.id.localeCompare(b.id))[0] ?? null;
-  const proposalId = `improve_${createHash36("sha256").update(`${input.setupId}:${input.revision}:${eligible?.id ?? "none"}`).digest("hex").slice(0, 20)}`;
+  const proposalId = `improve_${createHash37("sha256").update(`${input.setupId}:${input.revision}:${eligible?.id ?? "none"}`).digest("hex").slice(0, 20)}`;
   if (!eligible) return { proposalId, revision: input.revision, action: "none", item: null, confirmationRequired: false, nextAction: "No eligible improvement remains on the active revision." };
   if (eligible.kind === "runtime_rule") return { proposalId, revision: input.revision, action: "publish_runtime_rule", item: eligible, confirmationRequired: true, nextAction: `Approve one bounded runtime-rule change for ${eligible.surfaceId ?? "the measured surface"}, then verify manifest convergence.` };
   if (eligible.kind === "selector_repair") return { proposalId, revision: input.revision, action: "repair_selector", item: eligible, confirmationRequired: true, nextAction: "Confirm the repaired selector, publish one manifest revision, then verify its bounded match count." };
@@ -50262,9 +50355,9 @@ function recommendAnalyticsOutcomePlan(evidence, preferred) {
 }
 
 // src/services/analytics-site-setup/site-inventory.ts
-import { createHash as createHash37 } from "crypto";
+import { createHash as createHash38 } from "crypto";
 function stableFingerprint2(value) {
-  return createHash37("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash38("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function buildAnalyticsSiteInventory(input) {
   const diagnoses = [];
@@ -50372,7 +50465,7 @@ async function captureAnalyticsSiteSetupEvidence(input) {
     const requestedUrl = urls[index];
     const parsed = new URL(result3.finalUrl || requestedUrl, root);
     const path5 = parsed.pathname || "/";
-    const evidenceId = `live:${createHash38("sha256").update(`${requestedUrl}:${result3.status ?? "unreachable"}:${result3.html ? createHash38("sha256").update(result3.html).digest("hex") : "none"}`).digest("hex").slice(0, 24)}`;
+    const evidenceId = `live:${createHash39("sha256").update(`${requestedUrl}:${result3.status ?? "unreachable"}:${result3.html ? createHash39("sha256").update(result3.html).digest("hex") : "none"}`).digest("hex").slice(0, 24)}`;
     if (result3.via === "browser") browserFallbacks += 1;
     if (!result3.html) {
       routes.push({ path: path5, canonicalUrl: parsed.href, surfaceId: "primary-unknown", reachable: false, pixelScripts: 0, pageViewsOnFirstLoad: 0, semanticTags: 0, evidenceIds: [evidenceId], pixelPublicIds: [], duplicatePageViewSource: false, consentMode: "unknown" });
@@ -50464,7 +50557,7 @@ async function captureAnalyticsSiteSetupEvidence(input) {
 }
 var ZERO_BILLING = { billingClass: "xray_entitlement", mcpScraperCreditsCharged: 0, providerCosts: [] };
 function fingerprint3(value) {
-  return createHash38("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash39("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function receipt(record7, operation, occurredAt, providerCosts = [], externalRef) {
   return {
@@ -50675,7 +50768,7 @@ var AnalyticsSiteSetupService = class {
 };
 
 // src/api/analytics-survey-attribution.ts
-import { createHash as createHash39, randomBytes as randomBytes5, randomUUID as randomUUID32 } from "crypto";
+import { createHash as createHash40, randomBytes as randomBytes5, randomUUID as randomUUID32 } from "crypto";
 var CREDIT_SCALE = 1e6;
 var REPORTED_IMPACT_METHODOLOGY_VERSION = "xray_observed_plus_reported_equal_selected_v1";
 var TOKEN_BYTES = 32;
@@ -50742,10 +50835,10 @@ function stable(value) {
   return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key3, item]) => [key3, stable(item)]));
 }
 function fingerprint4(value) {
-  return createHash39("sha256").update(JSON.stringify(stable(value))).digest("hex");
+  return createHash40("sha256").update(JSON.stringify(stable(value))).digest("hex");
 }
 function tokenDigest(value) {
-  return createHash39("sha256").update(value).digest("hex");
+  return createHash40("sha256").update(value).digest("hex");
 }
 function opaqueToken(prefix) {
   return `${prefix}_${randomBytes5(TOKEN_BYTES).toString("base64url")}`;
@@ -51274,7 +51367,7 @@ function buildObservedPlusReportedImpact(input) {
 }
 
 // src/api/analytics-provider-view-evidence.ts
-import { createHash as createHash40, randomUUID as randomUUID33 } from "crypto";
+import { createHash as createHash41, randomUUID as randomUUID33 } from "crypto";
 var ANALYTICS_VIEW_EVIDENCE_RESEARCH_DATE = "2026-09-01";
 var ANALYTICS_VIEW_EVIDENCE_PROVIDERS = [
   "meta",
@@ -51448,7 +51541,7 @@ var PostgresAnalyticsSiteSetupStore = class {
 };
 
 // src/api/analytics-product-health.ts
-import { createHash as createHash41, randomUUID as randomUUID34 } from "crypto";
+import { createHash as createHash42, randomUUID as randomUUID34 } from "crypto";
 var ANALYTICS_PRODUCT_MILESTONES = [
   "xray_opened",
   "setup_started",
@@ -51475,7 +51568,7 @@ function asIso2(value) {
 }
 function safeReference(kind, value) {
   if (!value) return null;
-  return `${kind}:${createHash41("sha256").update(value).digest("hex").slice(0, 16)}`;
+  return `${kind}:${createHash42("sha256").update(value).digest("hex").slice(0, 16)}`;
 }
 function numberValue(value) {
   const number = Number(value ?? 0);
@@ -52744,7 +52837,7 @@ async function drainAnalyticsPrivacyLifecycle(input = {}) {
 }
 
 // src/api/analytics-crm-sync.ts
-import { createHash as createHash42 } from "crypto";
+import { createHash as createHash43 } from "crypto";
 var VERIFIED_READ_SCOPES = Object.freeze({
   hubspot: ["crm.objects.deals.read"],
   salesforce: ["api"],
@@ -52810,7 +52903,7 @@ async function previewAnalyticsCrmSync(input) {
   };
 }
 function stableId2(prefix, input) {
-  return `${prefix}_${createHash42("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 24)}`;
+  return `${prefix}_${createHash43("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 24)}`;
 }
 function isRecord5(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -53175,7 +53268,7 @@ function analyticsSiteSetupService() {
     publishManifest: async ({ record: record7, idempotencyKey: idempotencyKey4 }) => {
       const hostname = new URL(record7.startUrl).hostname.toLowerCase().replace(/\.$/, "");
       const uuidFor = (value) => {
-        const hex = createHash43("sha256").update(`${record7.siteId}:${value}`).digest("hex").slice(0, 32).split("");
+        const hex = createHash44("sha256").update(`${record7.siteId}:${value}`).digest("hex").slice(0, 32).split("");
         hex[12] = "4";
         hex[16] = ["8", "9", "a", "b"][Number.parseInt(hex[16], 16) % 4];
         return `${hex.slice(0, 8).join("")}-${hex.slice(8, 12).join("")}-${hex.slice(12, 16).join("")}-${hex.slice(16, 20).join("")}-${hex.slice(20).join("")}`;
@@ -53314,7 +53407,7 @@ function isRecord6(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function analyticsPrivacyRequestFingerprint(siteId, operation, body3) {
-  return createHash43("sha256").update(canonicalRequest({ siteId, operation, body: { ...body3, idempotencyKey: void 0 } })).digest("hex");
+  return createHash44("sha256").update(canonicalRequest({ siteId, operation, body: { ...body3, idempotencyKey: void 0 } })).digest("hex");
 }
 function privacyIdempotency(c, body3, siteId, operation) {
   const header = c.req.header("Idempotency-Key")?.trim();
@@ -54122,7 +54215,7 @@ analyticsApp.get("/v1/pixels/:publicPixelId/event-definitions", async (c) => {
   });
 });
 function deterministicRuntimeManifestId(siteId) {
-  const hex = createHash43("sha256").update(`xray-runtime-manifest:${siteId}`).digest("hex").slice(0, 32).split("");
+  const hex = createHash44("sha256").update(`xray-runtime-manifest:${siteId}`).digest("hex").slice(0, 32).split("");
   hex[12] = "4";
   hex[16] = ["8", "9", "a", "b"][Number.parseInt(hex[16], 16) % 4];
   return `${hex.slice(0, 8).join("")}-${hex.slice(8, 12).join("")}-${hex.slice(12, 16).join("")}-${hex.slice(16, 20).join("")}-${hex.slice(20).join("")}`;
@@ -54500,7 +54593,7 @@ analyticsApp.post("/v1/events", async (c) => {
             if (rule.condition.eventName && rule.condition.eventName !== event2.eventName) continue;
             const tags = Array.isArray(event2.properties?.tags) ? event2.properties.tags.map(String) : [];
             if ((rule.condition.excludedTags ?? []).some((tag) => tags.includes(tag))) continue;
-            const sourceEventId = `browser-rule:${rule.id}:${createHash43("sha256").update(event2.eventId).digest("hex").slice(0, 32)}`;
+            const sourceEventId = `browser-rule:${rule.id}:${createHash44("sha256").update(event2.eventId).digest("hex").slice(0, 32)}`;
             const valueMinor = Number(rule.default_value_minor ?? 0);
             await createAnalyticsConversion({
               userId: ownerUserId2,
@@ -54659,7 +54752,7 @@ analyticsApp.post("/v1/webhooks/:provider/:connectionId", async (c) => {
       connectionId: connection.id,
       provider,
       sourceAccountRef: connection.sourceAccountRef,
-      sourceEventId: `invalid:${createHash43("sha256").update(rawBody).digest("hex")}`,
+      sourceEventId: `invalid:${createHash44("sha256").update(rawBody).digest("hex")}`,
       signatureStatus: "invalid"
     });
     await setAnalyticsConnectionReadiness({
@@ -55022,7 +55115,7 @@ function surveyPublicHeaders(c) {
 }
 function surveyRateLimit(c) {
   const networkRef = c.req.header("cf-connecting-ip") ?? c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-  const key3 = createHash43("sha256").update(`survey-exchange:${networkRef}`).digest("hex");
+  const key3 = createHash44("sha256").update(`survey-exchange:${networkRef}`).digest("hex");
   const now = Date.now();
   const window2 = surveyExchangeRateWindows.get(key3);
   if (!window2 || now - window2.startedAt >= 6e4) {
@@ -55045,7 +55138,7 @@ function surveyCookie(c) {
   return { siteId, sessionToken };
 }
 async function approvedSurveyExchangeSite(exchangeCode, origin) {
-  const digest23 = createHash43("sha256").update(exchangeCode).digest("hex");
+  const digest23 = createHash44("sha256").update(exchangeCode).digest("hex");
   const hostname = normalizeAnalyticsHostname(new URL(origin).hostname);
   const result3 = await getAnalyticsPool().query(
     `SELECT invite.site_id
@@ -55084,7 +55177,7 @@ analyticsApp.post("/survey/exchange", async (c) => {
   return c.redirect("/analytics/survey/session", 303);
 });
 async function readPublicSurveySession(siteId, sessionToken) {
-  const digest23 = createHash43("sha256").update(sessionToken).digest("hex");
+  const digest23 = createHash44("sha256").update(sessionToken).digest("hex");
   const session = await getAnalyticsPool().query(
     `SELECT invite.survey_id,invite.survey_revision,invite.conversion_id,invite.session_expires_at,
             survey.state,survey.name,survey.question,survey.selection_mode,survey.eligible_outcome_families,
@@ -55251,10 +55344,10 @@ analyticsApp.post("/v1/conversions", auth4, async (c) => {
         clickIds: clickIds ?? {},
         match: {
           ...normalizedEmail ? {
-            emailSha256: createHash43("sha256").update(normalizedEmail).digest("hex")
+            emailSha256: createHash44("sha256").update(normalizedEmail).digest("hex")
           } : {},
           ...normalizedPhone ? {
-            phoneSha256: createHash43("sha256").update(normalizedPhone).digest("hex")
+            phoneSha256: createHash44("sha256").update(normalizedPhone).digest("hex")
           } : {}
         }
       }),
@@ -55783,7 +55876,7 @@ analyticsApp.post("/sites/:siteId/crm-imports", auth4, async (c) => {
       rejectedCount += 1;
       continue;
     }
-    const digest23 = createHash43("sha256").update(
+    const digest23 = createHash44("sha256").update(
       `${parsed.data.sourceSystem}:${externalId || email || phone || `${fullName}:${index}`}`
     ).digest("hex").slice(0, 16);
     const path5 = `Leads/person-${digest23}`;
@@ -56531,7 +56624,7 @@ analyticsApp.post("/sites/:siteId/consent/withdrawals", auth4, async (c) => {
   try {
     await client2.query("BEGIN");
     await client2.query(`INSERT INTO analytics_privacy_audits(id,site_id,subject_ref,action,idempotency_key,request_fingerprint,actor_user_id,result_code)
-      VALUES($1,$2,$3,'withdrawal_applied',$4,$5,$6,'running') ON CONFLICT(site_id,idempotency_key) DO NOTHING`, [randomUUID38(), siteId, `subject:${createHash43("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId]);
+      VALUES($1,$2,$3,'withdrawal_applied',$4,$5,$6,'running') ON CONFLICT(site_id,idempotency_key) DO NOTHING`, [randomUUID38(), siteId, `subject:${createHash44("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId]);
     const claimed = await client2.query("SELECT request_fingerprint,result_code,affected_counts FROM analytics_privacy_audits WHERE site_id=$1 AND idempotency_key=$2 FOR UPDATE", [siteId, idem.key]);
     assertAnalyticsPrivacyIdempotencyFingerprint(claimed.rows[0], idem.fingerprint);
     if (claimed.rows[0].result_code === "completed") {
@@ -56789,7 +56882,7 @@ analyticsApp.post("/sites/:siteId/crm/outbound-policies", auth4, async (c) => {
     selectedEvents: z43.array(z43.string().regex(/^[a-z][a-z0-9_]{1,79}$/)).max(100),
     purpose: z43.enum(["necessary_form_fulfillment", "site_analytics", "advertising_measurement"])
   }).strict());
-  const policyId = `crmpolicy_${createHash43("sha256").update(JSON.stringify({
+  const policyId = `crmpolicy_${createHash44("sha256").update(JSON.stringify({
     siteId,
     connectionId: body3.connectionId,
     kind: body3.kind,
@@ -57216,7 +57309,7 @@ analyticsApp.post("/sites/:siteId/privacy/subject/export", auth4, async (c) => {
   await getAnalyticsPool().query(
     `INSERT INTO analytics_privacy_audits(id,site_id,subject_ref,action,idempotency_key,request_fingerprint,actor_user_id,result_code,affected_counts,completed_at)
      VALUES($1,$2,$3,'export_completed',$4,$5,$6,'completed',$7::jsonb,now()) ON CONFLICT(site_id,idempotency_key) DO NOTHING`,
-    [randomUUID38(), siteId, `person:${createHash43("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId, JSON.stringify({ export: { schemaVersion: 1, subject: person.rows[0], restrictedIdentityExcluded: true } })]
+    [randomUUID38(), siteId, `person:${createHash44("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId, JSON.stringify({ export: { schemaVersion: 1, subject: person.rows[0], restrictedIdentityExcluded: true } })]
   );
   const persisted = await getAnalyticsPool().query("SELECT request_fingerprint,affected_counts FROM analytics_privacy_audits WHERE site_id=$1 AND idempotency_key=$2", [siteId, idem.key]);
   assertAnalyticsPrivacyIdempotencyFingerprint(persisted.rows[0], idem.fingerprint);
@@ -57230,7 +57323,7 @@ analyticsApp.post("/sites/:siteId/privacy/subject/delete", auth4, async (c) => {
   try {
     await client2.query("BEGIN");
     await client2.query(`INSERT INTO analytics_privacy_audits(id,site_id,subject_ref,action,idempotency_key,request_fingerprint,actor_user_id,result_code)
-      VALUES($1,$2,$3,'deletion_requested',$4,$5,$6,'running') ON CONFLICT(site_id,idempotency_key) DO NOTHING`, [randomUUID38(), siteId, `subject:${createHash43("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId]);
+      VALUES($1,$2,$3,'deletion_requested',$4,$5,$6,'running') ON CONFLICT(site_id,idempotency_key) DO NOTHING`, [randomUUID38(), siteId, `subject:${createHash44("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId]);
     const claim = await client2.query("SELECT request_fingerprint,result_code,affected_counts FROM analytics_privacy_audits WHERE site_id=$1 AND idempotency_key=$2 FOR UPDATE", [siteId, idem.key]);
     assertAnalyticsPrivacyIdempotencyFingerprint(claim.rows[0], idem.fingerprint);
     if (claim.rows[0].result_code === "deleted") {
@@ -57248,7 +57341,7 @@ analyticsApp.post("/sites/:siteId/privacy/subject/delete", auth4, async (c) => {
       db: client2
     });
     const counts = { ...deletion.affectedCounts };
-    await client2.query(`UPDATE analytics_privacy_audits SET namespace_ref=$3,subject_ref=$4,action='deletion_completed',result_code='deleted',affected_counts=$5::jsonb,completed_at=now() WHERE site_id=$1 AND idempotency_key=$2`, [siteId, idem.key, `namespace:${locked.rows[0].namespace_id}`, `deleted:${createHash43("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, JSON.stringify(counts)]);
+    await client2.query(`UPDATE analytics_privacy_audits SET namespace_ref=$3,subject_ref=$4,action='deletion_completed',result_code='deleted',affected_counts=$5::jsonb,completed_at=now() WHERE site_id=$1 AND idempotency_key=$2`, [siteId, idem.key, `namespace:${locked.rows[0].namespace_id}`, `deleted:${createHash44("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, JSON.stringify(counts)]);
     await client2.query("COMMIT");
     return c.json({ ok: true, deleted: true, counts }, 200, noStore);
   } catch (error) {
@@ -57292,7 +57385,7 @@ analyticsApp.post("/sites/:siteId/privacy/namespace/delete", auth4, async (c) =>
     await client2.query(
       `INSERT INTO analytics_privacy_audits(id,site_id,namespace_ref,action,idempotency_key,actor_user_id,result_code,affected_counts,completed_at)
        VALUES($1,$2,$3,'deletion_completed',$4,$5,'deleted',$6::jsonb,now()) ON CONFLICT(site_id,idempotency_key) DO NOTHING`,
-      [randomUUID38(), siteId, `deleted:${createHash43("sha256").update(body3.namespaceId).digest("hex").slice(0, 16)}`, body3.idempotencyKey, userId, JSON.stringify(counts)]
+      [randomUUID38(), siteId, `deleted:${createHash44("sha256").update(body3.namespaceId).digest("hex").slice(0, 16)}`, body3.idempotencyKey, userId, JSON.stringify(counts)]
     );
     await client2.query("COMMIT");
     return c.json({ ok: true, deleted: true, counts }, 200, noStore);
@@ -57759,7 +57852,7 @@ function resultStatus(result3) {
   return 502;
 }
 async function keyFor(c) {
-  const { key: key3, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  const { key: key3, error } = await getMemoryServiceToken(c.get("user"));
   if (!key3) return c.json(safeFailure2(error ?? "Memory is unavailable."), 503);
   return key3;
 }
@@ -58112,7 +58205,7 @@ crmApp.post("/deals/:dealId/transitions", async (c) => {
 });
 
 // src/api/crm-bridge-service.ts
-import { createHash as createHash44 } from "crypto";
+import { createHash as createHash45 } from "crypto";
 var CrmBridgeError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -58122,7 +58215,7 @@ var CrmBridgeError = class extends Error {
   code;
 };
 function stableChildId(parentId, suffix2) {
-  const bytes2 = Buffer.from(createHash44("sha256").update(`${parentId}:${suffix2}`).digest().subarray(0, 16));
+  const bytes2 = Buffer.from(createHash45("sha256").update(`${parentId}:${suffix2}`).digest().subarray(0, 16));
   bytes2[6] = bytes2[6] & 15 | 80;
   bytes2[8] = bytes2[8] & 63 | 128;
   const hex = bytes2.toString("hex");
@@ -58242,7 +58335,7 @@ async function deliverPendingAnalyticsForms(limit = 10, dependencies = {}) {
       deferred += 1;
       continue;
     }
-    const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+    const { key: key3, error } = await getMemoryServiceToken(user);
     if (!key3) {
       await deferAnalyticsFormDelivery(job.id, job.attempts, safeDeliveryError(error));
       deferred += 1;
@@ -58324,7 +58417,7 @@ async function deliverPendingAnalyticsCrmImports(limit = 10) {
       deferred += 1;
       continue;
     }
-    const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+    const { key: key3, error } = await getMemoryServiceToken(user);
     const result3 = key3 ? await memoryCall("putTool", payload, key3) : { ok: false, error };
     if (result3.ok) {
       await completeAnalyticsCrmImportRow(row.id, row.importId);
@@ -58802,7 +58895,7 @@ async function pollPendingGoogleActivationDiagnostics(limit = 10, deadlineMs = D
 }
 
 // src/api/analytics-reconciliation.ts
-import { createHash as createHash45, randomUUID as randomUUID41 } from "crypto";
+import { createHash as createHash46, randomUUID as randomUUID41 } from "crypto";
 var RECONCILIATION_INTERVAL_SECONDS = 15 * 60;
 var WEBHOOK_ONLY_RECHECK_SECONDS = 24 * 60 * 60;
 var LEASE_SECONDS = 90;
@@ -58929,14 +59022,14 @@ function crmReadInput(provider, sourceAccountRef, cursorValue, now) {
   }
 }
 function crmOutcomeSourceEventId(outcome) {
-  const digest23 = createHash45("sha256").update(`${outcome.provider}:${outcome.sourceRecordId}:${outcome.updatedAt}:${outcome.tombstone}`).digest("hex").slice(0, 40);
+  const digest23 = createHash46("sha256").update(`${outcome.provider}:${outcome.sourceRecordId}:${outcome.updatedAt}:${outcome.tombstone}`).digest("hex").slice(0, 40);
   return `crm:${outcome.provider}:${digest23}`;
 }
 function analyticsCrmOutcomeToExternalEvent(outcome, sourceAccountRef) {
   const sourceEventId = crmOutcomeSourceEventId(outcome);
   return {
     schemaVersion: 1,
-    eventId: `crm_${createHash45("sha256").update(sourceEventId).digest("hex").slice(0, 24)}`,
+    eventId: `crm_${createHash46("sha256").update(sourceEventId).digest("hex").slice(0, 24)}`,
     sourceEventId,
     source: outcome.provider,
     sourceAccountRef,
@@ -59236,7 +59329,7 @@ async function deferAnalyticsReconciliationJob(input) {
       connectionId: input.connectionId,
       safeErrorCode: errorCode2,
       nextRunAt: new Date(Date.now() + delaySeconds * 1e3).toISOString(),
-      receiptFingerprint: createHash45("sha256").update(`${input.jobId}:${input.attempts}:${errorCode2}`).digest("hex")
+      receiptFingerprint: createHash46("sha256").update(`${input.jobId}:${input.attempts}:${errorCode2}`).digest("hex")
     });
   }
 }
@@ -59347,7 +59440,7 @@ async function reconcileAnalyticsConnection(job, dependencies = defaultDependenc
           deduplicated: duplicates,
           rejected: page3.rejected,
           hasMore: page3.hasMore,
-          receiptFingerprint: createHash45("sha256").update(`${job.id}:${JSON.stringify(page3.nextCursor)}:${replayed}:${duplicates}`).digest("hex"),
+          receiptFingerprint: createHash46("sha256").update(`${job.id}:${JSON.stringify(page3.nextCursor)}:${replayed}:${duplicates}`).digest("hex"),
           scheduleConfigured: Boolean(scope.sync_id),
           scheduleIntervalSeconds: scope.sync_interval_seconds ?? null
         }
@@ -59564,13 +59657,13 @@ import { Hono as Hono38 } from "hono";
 import { z as z46 } from "zod";
 
 // src/api/scheduled-artifact-owner.ts
-import { createHash as createHash46 } from "crypto";
+import { createHash as createHash47 } from "crypto";
 function scheduledArtifactOwnerIdForApiKey(apiKey) {
-  return createHash46("sha256").update(apiKey).digest("hex").slice(0, 24);
+  return createHash47("sha256").update(apiKey).digest("hex").slice(0, 24);
 }
 
 // src/api/scheduled-run-view-links.ts
-import { createHash as createHash47, randomBytes as randomBytes6, randomUUID as randomUUID43 } from "crypto";
+import { createHash as createHash48, randomBytes as randomBytes6, randomUUID as randomUUID43 } from "crypto";
 var schemaReady3 = false;
 async function ensureScheduledRunViewLinksSchema() {
   if (schemaReady3) return;
@@ -59624,7 +59717,7 @@ async function ensureScheduledRunViewLinksSchema() {
   schemaReady3 = true;
 }
 function tokenHash2(token7) {
-  return createHash47("sha256").update(token7).digest("hex");
+  return createHash48("sha256").update(token7).digest("hex");
 }
 function mapRow(row) {
   return {
@@ -59711,7 +59804,7 @@ async function revokeScheduledRunViewLink(ownerId3, runId, shareId, now = /* @__
 }
 
 // src/personal-authority/render.ts
-import { createHash as createHash48 } from "crypto";
+import { createHash as createHash49 } from "crypto";
 function escapeHtml8(value) {
   return value.replace(/[&<>"']/g, (character) => ({
     "&": "&amp;",
@@ -59771,13 +59864,13 @@ ${section(flags.finalCta && Boolean(finalCta), `<section class="section cta" id=
     html,
     filename: `${input.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "personal-authority"}.html`,
     bytes: bytes2,
-    sha256: createHash48("sha256").update(html).digest("hex"),
+    sha256: createHash49("sha256").update(html).digest("hex"),
     generatedAt: generatedAtIso
   };
 }
 
 // src/personal-authority/render-v2.ts
-import { createHash as createHash49 } from "crypto";
+import { createHash as createHash50 } from "crypto";
 var FONT_STACKS = Object.freeze({
   "editorial-serif": "Iowan Old Style, Baskerville, Times New Roman, serif",
   "modern-sans": "Avenir Next, Avenir, Helvetica Neue, Arial, sans-serif",
@@ -59881,13 +59974,13 @@ ${section2(flags.finalCta && Boolean(finalCta), `<section class="section cta" id
     html,
     filename: `${input.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "personal-authority"}.html`,
     bytes: bytes2,
-    sha256: createHash49("sha256").update(html).digest("hex"),
+    sha256: createHash50("sha256").update(html).digest("hex"),
     generatedAt: generatedAtIso
   };
 }
 
 // src/newsroom-publisher/render.ts
-import { createHash as createHash50 } from "crypto";
+import { createHash as createHash51 } from "crypto";
 function escapeHtml10(value) {
   return value.replace(/[&<>"']/g, (character) => ({
     "&": "&amp;",
@@ -59993,13 +60086,13 @@ body{overflow-x:hidden}.lead-story__body,.lead-support__item,.story-card__body{m
 @media(max-width:620px){.desk-section__grid--panorama,.desk-section__grid--mosaic,.desk-section__grid--tiles{grid-template-columns:1fr}.story-card--panorama{display:block}.story-card--panorama h3,.story-card--mosaic-lead h3{font-size:34px}.story-card--mosaic-lead{grid-column:auto;grid-row:auto}.desk-section__grid--tiles>.story-card:nth-child(3n+2){margin-top:0}}
 </style></head><body data-theme="${escapeHtml10(config.theme)}" id="top" data-scheduled-renderer="newsroom_publisher_v1">${ticker}${masthead}${navigation}<main>${leadGrid}${latest}${sections}${newsletter}${pressRoom}${trustCenter}</main>${trustFooter}</body></html>`;
   const bytes2 = Buffer.byteLength(html);
-  const sha2564 = createHash50("sha256").update(html).digest("hex");
+  const sha2564 = createHash51("sha256").update(html).digest("hex");
   const filename2 = `${brand.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "newsroom"}-news-site.html`;
   return { html, filename: filename2, bytes: bytes2, sha256: sha2564, generatedAt: generatedAtIso };
 }
 
 // src/blog-article/render.ts
-import { createHash as createHash51 } from "crypto";
+import { createHash as createHash52 } from "crypto";
 function escapeHtml11(value) {
   return value.replace(
     /[&<>"']/g,
@@ -60087,7 +60180,7 @@ function renderBlogArticleV1(input, config, generatedAt) {
 :root{--ink:#10213d;--ink2:#1c355a;--blue:#2563eb;--blue2:#1749b6;--mint:#45d5aa;--paper:#f7f5f0;--line:#dce4ef;--card:#fff;--body:#475569;--serif:Iowan Old Style,Palatino Linotype,Palatino,Georgia,serif;--sans:Inter,Avenir Next,ui-sans-serif,system-ui,sans-serif}body[data-theme="slate"]{--ink:#1e293b;--ink2:#334155;--blue:#475569;--blue2:#1e293b;--mint:#94a3b8;--paper:#f8fafc}body[data-theme="forest"]{--ink:#12352e;--ink2:#23584c;--blue:#147d64;--blue2:#0c5b48;--mint:#79d8bd;--paper:#f4f8f3}*{box-sizing:border-box}html{scroll-behavior:smooth;background:var(--paper)}body{margin:0;color:#252a33;background:var(--paper);font-family:var(--sans);line-height:1.6}a{color:inherit}button{font:inherit}button:focus-visible,a:focus-visible{outline:3px solid var(--mint);outline-offset:3px}.progress{position:fixed;z-index:50;top:0;left:0;height:4px;width:0;background:var(--mint)}.hero{position:relative;overflow:hidden;color:#fff;background:var(--ink)}.hero:after{position:absolute;right:-110px;top:-150px;width:420px;height:420px;border:1px solid #ffffff1a;border-radius:50%;content:""}.hero-inner{position:relative;z-index:1;max-width:1240px;margin:auto;padding:58px 42px 126px}.breadcrumb{display:flex;gap:8px;margin-bottom:34px;color:#dbeafecc;font-size:14px}.eyebrow{display:block;color:var(--blue);font-size:12px;font-weight:800;letter-spacing:.16em;text-transform:uppercase}.hero .eyebrow{color:var(--mint)}h1,h2,h3,p{margin-top:0}.hero h1{max-width:1000px;margin:14px 0 24px;font:700 clamp(44px,6vw,78px)/.98 var(--serif);letter-spacing:-.035em}.hero .dek{max-width:780px;color:#dbeafe;font-size:20px}.contributors{margin-top:30px;color:#eff6ff;font-size:14px}.contributors a{font-weight:800}.meta{display:flex;flex-wrap:wrap;gap:12px;margin-top:6px;color:#dbeafecc}.layout{position:relative;z-index:2;display:grid;grid-template-columns:minmax(0,760px) 290px;gap:64px;max-width:1240px;margin:-78px auto 0;padding:0 42px 80px}.main{min-width:0}.takeaways{padding:38px 44px;border-radius:24px;background:#fff;box-shadow:0 24px 70px #10213d24}.takeaways h2{margin:5px 0 20px;font:700 32px/1.1 var(--serif);color:var(--ink)}.takeaways ul{display:grid;gap:16px;margin:0;padding:0;list-style:none}.takeaways li{position:relative;padding-left:26px;color:var(--body);font-size:17px}.takeaways li:before{position:absolute;left:2px;top:.7em;width:8px;height:8px;border-radius:50%;background:var(--blue);content:""}.intro{padding:40px 0 4px}.intro p,.article-section>p{margin-bottom:22px;color:var(--body);font:400 18px/1.75 var(--sans)}.article-section{scroll-margin-top:28px;padding-top:45px}.article-section h2,.faq h2{margin:6px 0 20px;color:var(--ink);font:700 38px/1.08 var(--serif);letter-spacing:-.02em}.article-section ul{display:grid;gap:10px;margin:22px 0;padding-left:24px;color:var(--body);font-size:17px}.article-section li::marker{color:var(--blue)}.callout{margin:34px 0;padding:24px 28px;border-left:4px solid var(--blue);border-radius:0 16px 16px 0;background:#fff}.callout span{color:var(--blue);font-size:11px;font-weight:800;letter-spacing:.13em;text-transform:uppercase}.callout h3{margin:5px 0 8px;color:var(--ink);font:700 24px/1.15 var(--serif)}.callout p{margin:0;color:var(--body)}.rail{padding-top:0}.sidebar-media{overflow:hidden;margin:0 0 18px;border:1px solid #dbeafe;border-radius:16px;background:#fff}.sidebar-media img,.sidebar-media svg{display:block;width:100%;aspect-ratio:16/9;object-fit:cover}.sidebar-media figcaption{padding:10px 13px;color:#64748b;font-size:11px}.disclosure{margin-bottom:28px;border-top:1px solid #dbeafe;border-bottom:1px solid #dbeafe}.disclosure button{display:flex;width:100%;align-items:center;justify-content:space-between;gap:14px;padding:15px 0;border:0;color:#64748b;background:transparent;text-align:left;font-size:12px;cursor:pointer}.disclosure button b{color:var(--blue);font-size:18px;transition:transform .2s}.disclosure button[aria-expanded="true"] b{transform:rotate(180deg)}.disclosure p{padding:0 0 16px;margin:0;color:#64748b;font-size:12px}.toc{position:sticky;top:30px;padding:22px;border:1px solid var(--line);border-radius:16px;background:#fff;box-shadow:0 2px 5px #10213d12}.toc header{display:flex;align-items:center;justify-content:space-between}.toc header strong{color:var(--ink);font:700 21px/1 var(--serif)}.toc header button{width:34px;height:34px;border:0;border-radius:50%;color:var(--blue);background:transparent;cursor:pointer}.toc nav{display:grid;margin-top:14px}.toc nav a{display:flex;align-items:flex-start;gap:11px;padding:8px 0;color:#64748b;text-decoration:none;font-size:13px;line-height:1.35}.toc nav i{width:8px;height:8px;margin-top:5px;border:2px solid #bfdbfe;border-radius:50%}.toc nav a[aria-current="location"]{color:var(--ink);font-weight:800}.toc nav a[aria-current="location"] i{border-color:var(--blue);background:var(--blue)}.back-top{width:100%;margin-top:18px;padding:16px 0 0;border:0;border-top:1px solid var(--line);color:var(--blue);background:transparent;text-align:right;font-size:13px;font-weight:800;cursor:pointer}.faq{scroll-margin-top:28px;padding-top:64px}.faq>div{border-top:1px solid var(--line);border-bottom:1px solid var(--line)}.faq article+article{border-top:1px solid var(--line)}.faq h3{margin:0}.faq h3 button{display:flex;width:100%;align-items:center;justify-content:space-between;gap:18px;padding:19px 0;border:0;color:var(--ink);background:transparent;text-align:left;font-weight:800;cursor:pointer}.faq h3 b{color:var(--blue);font-size:22px}.faq article>p{padding:0 0 20px;margin:0;color:var(--body);font-size:16px}.author-card{margin-top:64px;padding:32px 36px;border-radius:18px;background:#fff}.article-actions{display:flex;flex-wrap:wrap;justify-content:space-between;gap:14px}.article-actions button{display:inline-flex;min-height:46px;align-items:center;justify-content:center;gap:8px;padding:8px 18px;border:2px solid var(--blue);border-radius:999px;color:var(--ink);background:#fff;font-weight:800;cursor:pointer}.article-actions button:hover{color:#fff;background:var(--blue)}.action-status{min-height:20px;margin:8px 0 0;color:var(--blue);text-align:right;font-size:13px;font-weight:700}.author-grid{display:grid;grid-template-columns:auto 1fr auto;gap:22px;align-items:center;margin-top:24px}.author-portrait{width:88px;height:88px;border-radius:50%;object-fit:cover}.author-initials{display:grid;place-items:center;color:var(--ink);background:#fecdd3;font-size:22px;font-weight:900}.author-grid span{color:#64748b;font-size:13px}.author-grid h2{margin:2px 0;color:var(--ink);font:700 27px/1 var(--serif)}.author-grid h2 a{text-decoration:none}.author-grid p{margin:8px 0;color:#64748b;font-size:14px}.author-grid nav{display:flex;flex-wrap:wrap;gap:14px}.author-grid nav a{color:#64748b;font-size:12px}.author-more{display:inline-flex;min-height:48px;align-items:center;justify-content:center;padding:10px 24px;border:2px solid var(--blue);color:var(--blue);text-align:center;text-decoration:none;font-size:13px;font-weight:800}.author-bio{margin:24px 0 0!important;padding-top:20px;border-top:1px solid var(--line);color:var(--body);font-size:16px}dialog{width:min(720px,calc(100% - 30px));max-height:calc(100dvh - 30px);padding:0;border:0;border-radius:18px;color:var(--ink);background:#fff;box-shadow:0 24px 70px #10213d38}dialog::backdrop{background:#0f172a7a;backdrop-filter:blur(2px)}dialog>div{position:relative;padding:30px}dialog h2{margin:0 50px 2px 0;font:700 30px/1.1 var(--serif)}dialog>div>p{color:#64748b}.dialog-close{position:absolute;top:13px;right:13px;width:44px;height:44px;border:0;border-radius:50%;color:var(--blue);background:transparent;font-size:29px;cursor:pointer}dialog section{border-top:1px solid var(--line)}dialog section button{display:block;width:100%;padding:17px 5px;border:0;border-bottom:1px solid var(--line);color:var(--body);background:#fff;text-align:left;line-height:1.65;cursor:pointer}.citation-status{min-height:22px;margin:14px 0 0!important;color:var(--blue)!important;font-size:13px;font-weight:800}.generated{max-width:1156px;margin:-52px auto 50px;padding:0 42px;color:#94a3b8;font-size:11px}@media(max-width:900px){.layout{display:block}.rail{display:none}.hero-inner{padding-bottom:116px}}@media(max-width:620px){.hero-inner{padding:36px 20px 104px}.hero h1{font-size:46px}.hero .dek{font-size:17px}.layout{margin-top:-70px;padding:0 16px 54px}.takeaways{padding:28px 24px}.article-section h2,.faq h2{font-size:32px}.author-card{padding:24px}.article-actions{display:grid;justify-content:start}.author-grid{grid-template-columns:1fr;gap:12px}.author-more{width:100%}dialog>div{padding:24px}.generated{padding:0 20px}}
 </style></head><body data-theme="${escapeHtml11(config.theme)}" data-scheduled-renderer="blog_article_v1"><div class="progress" aria-hidden="true"></div><header class="hero"><div class="hero-inner"><nav class="breadcrumb" aria-label="Breadcrumb"><a href="${safeHref4(input.canonicalUrl)}">${escapeHtml11(input.category)}</a><span>/</span><span>Article</span></nav><span class="eyebrow">${escapeHtml11(input.eyebrow)}</span><h1>${escapeHtml11(input.title)}</h1>${input.dek ? `<p class="dek">${escapeHtml11(input.dek)}</p>` : ""}<div class="contributors">${contributorText}<div class="meta"><time datetime="${escapeHtml11(articleDate)}">Updated ${formatDate2(articleDate)}</time><span>\u2022</span><span>${input.readTimeMinutes} min read</span>${input.reviewer ? "<span>\u2022</span><strong>Expert reviewed</strong>" : ""}</div></div></div></header><main class="layout"><article class="main"><section class="takeaways"><span class="eyebrow">The short answer</span><h2>Key takeaways</h2><ul>${input.keyTakeaways.map((item) => `<li>${escapeHtml11(item)}</li>`).join("")}</ul></section><section class="intro">${input.introduction.map((paragraph) => `<p>${escapeHtml11(paragraph)}</p>`).join("")}</section>${sections}${faq}${author}</article><div class="rail">${media}${disclosure}${toc}</div></main>${config.showGeneratedAt ? `<p class="generated">Rendered ${formatDate2(generatedAtIso)} by MCP Scraper.</p>` : ""}${citationDialog}<script>(()=>{const citations=${jsonForScript(citationValues)};const canonical=${jsonForScript(input.canonicalUrl)};const title=${jsonForScript(input.title)};const progress=document.querySelector('.progress');const tocLinks=[...document.querySelectorAll('.toc nav a')];const targets=tocLinks.map(link=>document.querySelector(link.hash)).filter(Boolean);const update=()=>{const max=document.documentElement.scrollHeight-innerHeight;if(progress)progress.style.width=(max>0?scrollY/max*100:0)+'%';let active=targets[0]?.id;for(const target of targets){if(target.getBoundingClientRect().top<=innerHeight*.55)active=target.id}tocLinks.forEach(link=>link.toggleAttribute('aria-current',link.hash==='#'+active));tocLinks.forEach(link=>{if(link.hash==='#'+active)link.setAttribute('aria-current','location');else link.removeAttribute('aria-current')})};addEventListener('scroll',update,{passive:true});addEventListener('resize',update);update();document.querySelectorAll('.faq h3 button').forEach(button=>button.addEventListener('click',()=>{const panel=document.getElementById(button.getAttribute('aria-controls'));const open=button.getAttribute('aria-expanded')==='true';button.setAttribute('aria-expanded',String(!open));panel.hidden=open;button.querySelector('b').textContent=open?'+':'\u2212'}));const disclosure=document.querySelector('.disclosure button');disclosure?.addEventListener('click',()=>{const panel=document.getElementById(disclosure.getAttribute('aria-controls'));const open=disclosure.getAttribute('aria-expanded')==='true';disclosure.setAttribute('aria-expanded',String(!open));panel.hidden=open});const tocToggle=document.querySelector('.toc header button');tocToggle?.addEventListener('click',()=>{const nav=document.getElementById('toc-links');const open=tocToggle.getAttribute('aria-expanded')==='true';tocToggle.setAttribute('aria-expanded',String(!open));nav.hidden=open;tocToggle.textContent=open?'\u2304':'\u2303'});document.querySelector('.back-top')?.addEventListener('click',()=>scrollTo({top:0,behavior:'smooth'}));const copy=async text=>{try{await navigator.clipboard.writeText(text)}catch{const area=document.createElement('textarea');area.value=text;area.style.position='fixed';area.style.opacity='0';document.body.append(area);area.select();document.execCommand('copy');area.remove()}};const dialog=document.getElementById('citation-dialog');document.querySelector('[data-cite]')?.addEventListener('click',()=>dialog.showModal());document.querySelector('.dialog-close')?.addEventListener('click',()=>dialog.close());dialog?.addEventListener('click',event=>{if(event.target===dialog)dialog.close()});document.querySelectorAll('[data-citation]').forEach(button=>button.addEventListener('click',async()=>{const style=button.dataset.citation;await copy(citations[style]);document.querySelector('.citation-status').textContent=style+' citation copied to clipboard.'}));document.querySelector('[data-share]')?.addEventListener('click',async()=>{const status=document.querySelector('.action-status');if(navigator.share){try{await navigator.share({title,url:canonical});status.textContent='Sharing options opened.';return}catch(error){if(error.name==='AbortError')return}}await copy(canonical);status.textContent='Article link copied to clipboard.'})})()</script></body></html>`;
   const bytes2 = Buffer.byteLength(html);
-  const sha2564 = createHash51("sha256").update(html).digest("hex");
+  const sha2564 = createHash52("sha256").update(html).digest("hex");
   return {
     html,
     filename: "blog-article.html",
@@ -60218,7 +60311,7 @@ function apiError(error, errorCode2 = "invalid_request") {
 }
 async function memoryContext(c) {
   const user = c.get("user");
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   return { user, key: key3, error };
 }
 function memoryStatus(result3) {
@@ -60390,7 +60483,7 @@ scheduledResultApp.delete("/schedule-runs/:runId/view-links/:shareId", async (c)
 import { Hono as Hono39 } from "hono";
 
 // src/scheduled-artifacts/scheduled-run-artifact-store.ts
-import { createHash as createHash52 } from "crypto";
+import { createHash as createHash53 } from "crypto";
 var SCHEDULED_RUN_ARTIFACT_PREFIX = "scheduled-run-artifacts/";
 var SCHEDULED_RUN_ARTIFACT_DOWNLOAD_TTL_MS = 15 * 60 * 1e3;
 var SCHEDULED_RUN_ARTIFACT_MAX_BYTES = 2e6;
@@ -60406,7 +60499,7 @@ function policy5() {
   };
 }
 function runStorageSegment(runId) {
-  return /^[a-zA-Z0-9_-]{1,160}$/.test(runId) ? runId : `run-${createHash52("sha256").update(runId).digest("hex").slice(0, 32)}`;
+  return /^[a-zA-Z0-9_-]{1,160}$/.test(runId) ? runId : `run-${createHash53("sha256").update(runId).digest("hex").slice(0, 32)}`;
 }
 async function createScheduledRunArtifact(args) {
   if (args.rendered.bytes > SCHEDULED_RUN_ARTIFACT_MAX_BYTES) {
@@ -60598,11 +60691,11 @@ scheduledArtifactInternalApp.post("/render", async (c) => {
 });
 
 // src/api/personal-assistant-routes.ts
-import { createHash as createHash60, randomUUID as randomUUID45 } from "crypto";
+import { createHash as createHash61, randomUUID as randomUUID45 } from "crypto";
 import { Hono as Hono42 } from "hono";
 
 // src/api/personal-assistant-schedule-readiness.ts
-import { createHash as createHash53 } from "crypto";
+import { createHash as createHash54 } from "crypto";
 import { z as z47 } from "zod";
 var opaqueRef = z47.string().trim().regex(/^[a-z][a-z0-9_]*_[A-Za-z0-9_-]{3,128}$/);
 var isoTimestamp2 = z47.iso.datetime({ offset: true });
@@ -60675,7 +60768,7 @@ function canonicalJson2(value) {
   return JSON.stringify(value);
 }
 function digest2(value) {
-  return createHash53("sha256").update(canonicalJson2(value)).digest("hex");
+  return createHash54("sha256").update(canonicalJson2(value)).digest("hex");
 }
 function validTimezone2(timezone) {
   try {
@@ -60936,7 +61029,7 @@ async function evaluateScheduleReadiness(rawInput, dependencies) {
 }
 
 // src/api/personal-assistant-command-builder.ts
-import { createHash as createHash54 } from "crypto";
+import { createHash as createHash55 } from "crypto";
 function canonicalJson3(value) {
   return JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
@@ -60944,7 +61037,7 @@ function canonicalJson3(value) {
   });
 }
 function digest3(value) {
-  return createHash54("sha256").update(canonicalJson3(value)).digest("hex");
+  return createHash55("sha256").update(canonicalJson3(value)).digest("hex");
 }
 function explicitControlIntent(text3) {
   const normalized = text3.trim().toLowerCase();
@@ -60993,7 +61086,7 @@ async function buildPersonalAssistantCommand(context, input) {
 }
 
 // src/api/personal-assistant-consent-content.ts
-import { createHash as createHash55 } from "crypto";
+import { createHash as createHash56 } from "crypto";
 var SUBMITTED_EVIDENCE = Object.freeze({
   evidenceVersion: "twilio-toll-free-submission.2026-08-28.v1",
   policyVersion: "2026-08-28.v1",
@@ -61056,7 +61149,7 @@ var ASSISTANT_ENROLLMENT_DISCLOSURE_TEXT = Object.freeze([
   ASSISTANT_CONSENT_CONTENT_V1.retentionDisclosure,
   ASSISTANT_CONSENT_CONTENT_V1.termsDisclosure
 ].join("\n\n"));
-var ASSISTANT_ENROLLMENT_DISCLOSURE_DIGEST = createHash55("sha256").update(`${ASSISTANT_CONSENT_CONTENT_V1.policyVersion}\0${ASSISTANT_ENROLLMENT_DISCLOSURE_TEXT}`).digest("hex");
+var ASSISTANT_ENROLLMENT_DISCLOSURE_DIGEST = createHash56("sha256").update(`${ASSISTANT_CONSENT_CONTENT_V1.policyVersion}\0${ASSISTANT_ENROLLMENT_DISCLOSURE_TEXT}`).digest("hex");
 var ASSISTANT_ENROLLMENT_DISCLOSURE_PROJECTION = Object.freeze({
   policyVersion: ASSISTANT_CONSENT_CONTENT_V1.policyVersion,
   disclosureDigest: ASSISTANT_ENROLLMENT_DISCLOSURE_DIGEST,
@@ -61067,11 +61160,11 @@ var ASSISTANT_ENROLLMENT_DISCLOSURE_PROJECTION = Object.freeze({
 });
 
 // src/api/personal-assistant-lifecycle.ts
-import { createHash as createHash57, randomUUID as randomUUID44 } from "crypto";
+import { createHash as createHash58, randomUUID as randomUUID44 } from "crypto";
 import { z as z48 } from "zod";
 
 // src/api/personal-assistant-db.ts
-import { createHash as createHash56 } from "crypto";
+import { createHash as createHash57 } from "crypto";
 import { Pool } from "pg";
 
 // src/api/personal-assistant-schema.ts
@@ -61193,7 +61286,7 @@ function assistantDatabaseBindingFingerprint(value) {
   if (!database) {
     throw new AssistantDatabaseError("assistant_database_binding_invalid", "Personal Assistant database name is missing.");
   }
-  return createHash56("sha256").update(`${normalizedNeonHost(parsed.hostname)}\0${database}`).digest("hex");
+  return createHash57("sha256").update(`${normalizedNeonHost(parsed.hostname)}\0${database}`).digest("hex");
 }
 function assistantDatabaseRole(value) {
   const role = decodeURIComponent(parseDatabaseUrl(value).username);
@@ -61481,7 +61574,7 @@ var AssistantLifecycleError = class extends Error {
 };
 
 // src/api/personal-assistant-service.ts
-import { createHash as createHash58 } from "crypto";
+import { createHash as createHash59 } from "crypto";
 var PERSONAL_ASSISTANT_INTENT_ENVELOPE_VERSION = "assistant-intent-envelope.v1";
 var CONTROL_INTENTS = /* @__PURE__ */ new Set(["help", "status", "approve", "reject", "cancel"]);
 var EXPLICIT_TASK_INTENTS = /* @__PURE__ */ new Set([
@@ -61647,7 +61740,7 @@ function canonicalServiceJson(value) {
   });
 }
 function serviceDigest(value) {
-  return createHash58("sha256").update(canonicalServiceJson(value)).digest("hex");
+  return createHash59("sha256").update(canonicalServiceJson(value)).digest("hex");
 }
 function serviceReceipt(idempotencyKey4, requestDigest2, occurredAt, state2, result3, error = null) {
   const receiptRef = `receipt_${serviceDigest({ idempotencyKey: idempotencyKey4, requestDigest: requestDigest2 }).slice(0, 32)}`;
@@ -63074,7 +63167,7 @@ import twilio3 from "twilio";
 import { Hono as Hono41 } from "hono";
 
 // src/api/personal-assistant-observability.ts
-import { createHash as createHash59 } from "crypto";
+import { createHash as createHash60 } from "crypto";
 var OPAQUE_TRACE_REF = /^trace_[A-Za-z0-9_-]{8,128}$/u;
 var KINDS = /* @__PURE__ */ new Set([
   "purchase_unknown",
@@ -63771,7 +63864,7 @@ function payloadWithout(input, ...keys) {
   return Object.fromEntries(Object.entries(input).filter(([key3, value]) => !omitted.has(key3) && value !== void 0));
 }
 function personalAssistantMessagingServiceReviewDigest(review) {
-  return createHash60("sha256").update(JSON.stringify({
+  return createHash61("sha256").update(JSON.stringify({
     schemaVersion: "assistant-messaging-service-review.v1",
     numberRef: review.numberRef,
     connectionRef: review.connectionRef,
@@ -63905,7 +63998,7 @@ function ownerCaller(c) {
     throw new OwnerRouteError("not_authenticated", "Authentication is required.", 401);
   }
   if (ownerUserId2 <= 0n) throw new OwnerRouteError("not_authenticated", "Authentication is required.", 401);
-  const subjectRef = `owner_${createHash60("sha256").update(ownerUserId2.toString()).digest("hex").slice(0, 24)}`;
+  const subjectRef = `owner_${createHash61("sha256").update(ownerUserId2.toString()).digest("hex").slice(0, 24)}`;
   return { kind: "owner", surface: "rest", ownerUserId: ownerUserId2, subjectRef };
 }
 function enrollmentRequesterBinding(c, caller2) {
@@ -64681,7 +64774,7 @@ function buildPersonalAssistantBrowserProfileRoutes(options) {
 }
 
 // src/api/personal-assistant-browser-production.ts
-import { createHash as createHash64, randomUUID as randomUUID52 } from "crypto";
+import { createHash as createHash65, randomUUID as randomUUID52 } from "crypto";
 
 // src/api/personal-assistant-browser-handoff-store.ts
 import { createHmac as createHmac12, randomUUID as randomUUID48 } from "crypto";
@@ -64975,7 +65068,7 @@ function createPostgresPersonalAssistantBrowserHandoffStore(options) {
 }
 
 // src/api/personal-assistant-browser-profile-store.ts
-import { createHash as createHash61, createHmac as createHmac13, randomUUID as randomUUID49 } from "crypto";
+import { createHash as createHash62, createHmac as createHmac13, randomUUID as randomUUID49 } from "crypto";
 import { domainToASCII } from "url";
 var PersonalAssistantBrowserProfileStoreError = class extends Error {
   constructor(code, message = code, status = code.endsWith("revision_conflict") ? 409 : code.endsWith("input_rejected") ? 400 : 404) {
@@ -65105,7 +65198,7 @@ function deriveBrowserProviderNamespaceDigest(keyInput, ownerUserId2, profileRef
 }
 function digestEvidence(value) {
   const canonical3 = JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))) : entry);
-  return createHash61("sha256").update(canonical3).digest("hex");
+  return createHash62("sha256").update(canonical3).digest("hex");
 }
 function exactCapabilityList(value, allowed) {
   if (!Array.isArray(value)) return [];
@@ -65511,7 +65604,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
 }
 
 // src/api/personal-assistant-idempotency-store.ts
-import { createHash as createHash62, randomUUID as randomUUID50 } from "crypto";
+import { createHash as createHash63, randomUUID as randomUUID50 } from "crypto";
 var PersonalAssistantIdempotencyConflictError = class extends Error {
   code = "idempotency_conflict";
   status = 409;
@@ -65540,7 +65633,7 @@ function jsonValue(value) {
   return JSON.parse(serialized);
 }
 function resultDigest(value) {
-  return createHash62("sha256").update(canonicalJson4(value)).digest("hex");
+  return createHash63("sha256").update(canonicalJson4(value)).digest("hex");
 }
 function timestamp3(value) {
   return value instanceof Date ? value.toISOString() : new Date(value).toISOString();
@@ -65623,7 +65716,7 @@ function createPostgresPersonalAssistantIdempotencyStore(options = {}) {
 }
 
 // src/api/personal-assistant-browser-account-cleanup.ts
-import { createHash as createHash63, randomUUID as randomUUID51 } from "crypto";
+import { createHash as createHash64, randomUUID as randomUUID51 } from "crypto";
 function positiveOwner2(value) {
   if (typeof value !== "bigint" || value <= 0n) throw new TypeError("positive ownerUserId is required");
   return value.toString();
@@ -65685,7 +65778,7 @@ function createPersonalAssistantBrowserAccountCleanup(options) {
       cleanupRef: `cleanup_${randomUUID51().replaceAll("-", "")}`,
       state: "confirmed",
       ...evidence,
-      evidenceDigest: createHash63("sha256").update(JSON.stringify(evidence)).digest("hex")
+      evidenceDigest: createHash64("sha256").update(JSON.stringify(evidence)).digest("hex")
     });
   };
 }
@@ -65712,7 +65805,7 @@ var VERIFIED_BROWSER_CAPABILITIES = Object.freeze([
   "download"
 ]);
 function digest5(value) {
-  return createHash64("sha256").update(JSON.stringify(value, (_key, entry) => {
+  return createHash65("sha256").update(JSON.stringify(value, (_key, entry) => {
     if (typeof entry === "bigint") return entry.toString();
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
@@ -66283,7 +66376,7 @@ var personalAssistantBrowserHandoffApp = buildPersonalAssistantBrowserHandoffRou
 import { Hono as Hono46 } from "hono";
 
 // src/api/personal-assistant-worker-routes.ts
-import { createHash as createHash65, createPublicKey, verify as verify2 } from "crypto";
+import { createHash as createHash66, createPublicKey, verify as verify2 } from "crypto";
 import { Hono as Hono45 } from "hono";
 import { z as z49 } from "zod";
 var PERSONAL_ASSISTANT_WORKER_API_PREFIX = "/api/private/v1/assistant-worker";
@@ -66313,11 +66406,11 @@ function canonicalJson5(value) {
   return JSON.stringify(value);
 }
 function personalAssistantWorkerBodyDigest(rawBody) {
-  return createHash65("sha256").update(rawBody, "utf8").digest("hex");
+  return createHash66("sha256").update(rawBody, "utf8").digest("hex");
 }
 function personalAssistantPlanDigest(plan) {
   const { planRef: _planRef, planDigest: _planDigest, immutable: _immutable, createdAt: _createdAt, ...proposal } = plan;
-  return createHash65("sha256").update(canonicalJson5(proposal)).digest("hex");
+  return createHash66("sha256").update(canonicalJson5(proposal)).digest("hex");
 }
 function personalAssistantWorkerSigningPayload(input) {
   return [
@@ -66471,7 +66564,7 @@ function verifyPolicyEnvelope(identity, envelope, at) {
   if (Date.parse(envelope.expiresAt) <= at.getTime() || Math.abs(at.getTime() - Date.parse(envelope.createdAt)) > 6e4) {
     throw new AssistantWorkerRouteError("worker_policy_request_expired", "The policy request has expired.", 401);
   }
-  const expectedDigest = createHash65("sha256").update(canonicalJson5(envelope.body)).digest("hex");
+  const expectedDigest = createHash66("sha256").update(canonicalJson5(envelope.body)).digest("hex");
   if (expectedDigest !== envelope.bodyDigest) throw new AssistantWorkerRouteError("worker_policy_digest_mismatch", "The policy request digest does not match.", 401);
   const { signature, ...unsigned } = envelope;
   let valid = false;
@@ -66489,7 +66582,7 @@ function verifyClaimEnvelope(identity, envelope, at) {
   if (Math.abs(at.getTime() - Date.parse(envelope.createdAt)) > PERSONAL_ASSISTANT_WORKER_SIGNATURE_TTL_MS) {
     throw new AssistantWorkerRouteError("worker_claim_expired", "The worker claim has expired.", 401);
   }
-  const expectedDigest = createHash65("sha256").update(canonicalJson5(envelope.body)).digest("hex");
+  const expectedDigest = createHash66("sha256").update(canonicalJson5(envelope.body)).digest("hex");
   if (expectedDigest !== envelope.bodyDigest) throw new AssistantWorkerRouteError("worker_claim_digest_mismatch", "The claim digest does not match.", 401);
   const { signature, ...unsigned } = envelope;
   let valid = false;
@@ -66792,12 +66885,12 @@ var personalAssistantWorkerProductionApp = (() => {
 })();
 
 // src/api/personal-assistant-admin-routes.ts
-import { createHash as createHash67, createPublicKey as createPublicKey2 } from "crypto";
+import { createHash as createHash68, createPublicKey as createPublicKey2 } from "crypto";
 import { Hono as Hono47 } from "hono";
 import { z as z50 } from "zod";
 
 // src/api/personal-assistant-kill-controls.ts
-import { createHash as createHash66, randomUUID as randomUUID53 } from "crypto";
+import { createHash as createHash67, randomUUID as randomUUID53 } from "crypto";
 var PERSONAL_ASSISTANT_KILL_SCOPES = [
   "global",
   "outbound",
@@ -66825,7 +66918,7 @@ function canonicalJson6(value) {
   return JSON.stringify(value);
 }
 function digest6(value) {
-  return createHash66("sha256").update(canonicalJson6(value)).digest("hex");
+  return createHash67("sha256").update(canonicalJson6(value)).digest("hex");
 }
 function validateTarget(target) {
   if (!PERSONAL_ASSISTANT_KILL_SCOPES.includes(target.scope)) throw new PersonalAssistantKillControlError("invalid_kill_control", "Invalid kill-control scope.", 400);
@@ -67093,7 +67186,7 @@ async function strictJson2(c, maxBodyBytes) {
   }
 }
 function derivedRef(prefix, ...identity) {
-  return `${prefix}_${createHash67("sha256").update(identity.join("\0")).digest("base64url").slice(0, 32)}`;
+  return `${prefix}_${createHash68("sha256").update(identity.join("\0")).digest("base64url").slice(0, 32)}`;
 }
 function ownerUserId(target) {
   if (!/^[1-9][0-9]{0,18}$/.test(target.targetKey)) {
@@ -67179,7 +67272,7 @@ function buildPersonalAssistantAdminRoutes(options) {
     const identity = c.get("assistantAdmin");
     requireCapability(identity, "assistant.worker_registration.register");
     const parsed = WorkerRegistrationSchema.safeParse(await strictJson2(c, maxBodyBytes));
-    if (!parsed.success || Date.parse(parsed.data.expiresAt) <= now().getTime() || !/^-----BEGIN PUBLIC KEY-----\n[\s\S]+\n-----END PUBLIC KEY-----\n?$/.test(parsed.data.publicKeyPem) || /PRIVATE KEY|ENCRYPTED/.test(parsed.data.publicKeyPem) || createHash67("sha256").update(parsed.success ? parsed.data.publicKeyPem : "").digest("hex") !== (parsed.success ? parsed.data.publicKeySha256 : "")) {
+    if (!parsed.success || Date.parse(parsed.data.expiresAt) <= now().getTime() || !/^-----BEGIN PUBLIC KEY-----\n[\s\S]+\n-----END PUBLIC KEY-----\n?$/.test(parsed.data.publicKeyPem) || /PRIVATE KEY|ENCRYPTED/.test(parsed.data.publicKeyPem) || createHash68("sha256").update(parsed.success ? parsed.data.publicKeyPem : "").digest("hex") !== (parsed.success ? parsed.data.publicKeySha256 : "")) {
       throw new PersonalAssistantAdminRouteError("invalid_worker_registration", "Invalid worker registration request.", 400);
     }
     try {
@@ -67305,24 +67398,24 @@ var personalAssistantCronProductionApp = (() => {
 })();
 
 // src/api/personal-assistant-production.ts
-import { createHash as createHash97 } from "crypto";
+import { createHash as createHash98 } from "crypto";
 
 // src/api/personal-assistant-admin-production.ts
-import { createHash as createHash71 } from "crypto";
+import { createHash as createHash72 } from "crypto";
 
 // src/api/personal-assistant-worker-store.ts
-import { createHash as createHash70, randomUUID as randomUUID55 } from "crypto";
+import { createHash as createHash71, randomUUID as randomUUID55 } from "crypto";
 
 // src/api/personal-assistant-repository.ts
-import { createHash as createHash69, randomBytes as randomBytes7, randomUUID as randomUUID54 } from "crypto";
+import { createHash as createHash70, randomBytes as randomBytes7, randomUUID as randomUUID54 } from "crypto";
 
 // src/api/personal-assistant-wake-packet.ts
-import { createHash as createHash68 } from "crypto";
+import { createHash as createHash69 } from "crypto";
 function stableJson(value) {
   return JSON.stringify(value, (_key, entry) => !entry || typeof entry !== "object" || Array.isArray(entry) ? entry : Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))));
 }
 function stableDigest(value) {
-  return createHash68("sha256").update(stableJson(value)).digest("hex");
+  return createHash69("sha256").update(stableJson(value)).digest("hex");
 }
 function deterministicWakePacketRef(snapshot) {
   return `wake_${stableDigest({ assistantRef: snapshot.assistantRef, commandRef: snapshot.commandRef, cycleRef: snapshot.cycleRef, executionRef: snapshot.executionRef, contextVersionRef: snapshot.contextVersion.contextVersionRef }).slice(0, 32)}`;
@@ -67375,10 +67468,10 @@ function canonicalJson7(value) {
   });
 }
 function digest7(value) {
-  return createHash69("sha256").update(canonicalJson7(value)).digest("hex");
+  return createHash70("sha256").update(canonicalJson7(value)).digest("hex");
 }
 function deterministicRef2(prefix, identity) {
-  return `${prefix}_${createHash69("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash70("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function messageCursor(message) {
   return Buffer.from(JSON.stringify([message.occurredAt, message.messageRef])).toString("base64url");
@@ -67874,7 +67967,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           `, [ownerUserId2.toString(), row.id]);
         }
         const token7 = randomBytes7(32).toString("base64url");
-        const tokenHash5 = createHash69("sha256").update(token7).digest("hex");
+        const tokenHash5 = createHash70("sha256").update(token7).digest("hex");
         const leaseRef = deterministicRef2("lease", `${input.executionRef}\0${input.workerRef}\0${input.now}`);
         const expiresAt = new Date(Date.parse(input.now) + input.leaseSeconds * 1e3).toISOString();
         await client2.query(`
@@ -69412,10 +69505,10 @@ var AssistantWorkerStoreError = class extends Error {
 };
 function hash(value) {
   const canonical3 = JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))) : entry);
-  return createHash70("sha256").update(canonical3).digest("hex");
+  return createHash71("sha256").update(canonical3).digest("hex");
 }
 function ref2(prefix, identity) {
-  return `${prefix}_${createHash70("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash71("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function requiredString(input, key3) {
   const value = input[key3];
@@ -69814,7 +69907,7 @@ var INTERNAL_CAPABILITIES = /* @__PURE__ */ new Set([
   "assistant.worker_registration.revoke"
 ]);
 function actorRef(issuer, subject) {
-  return `admin_actor_${createHash71("sha256").update(`${issuer}\0${subject}`).digest("base64url").slice(0, 32)}`;
+  return `admin_actor_${createHash72("sha256").update(`${issuer}\0${subject}`).digest("base64url").slice(0, 32)}`;
 }
 var VerifiedPersonalAssistantAdminIdentityPort = class {
   constructor(verifier, configuration) {
@@ -69928,7 +70021,7 @@ function createPersonalAssistantAdminProductionDependencies(input) {
 }
 
 // src/api/personal-assistant-dispatcher.ts
-import { createHash as createHash72, randomBytes as randomBytes8, randomUUID as randomUUID56 } from "crypto";
+import { createHash as createHash73, randomBytes as randomBytes8, randomUUID as randomUUID56 } from "crypto";
 var AssistantLeaseFenceError = class extends Error {
   code = "assistant_lease_fence_rejected";
   constructor() {
@@ -69942,7 +70035,7 @@ function canonical2(value) {
   return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key3, entry]) => [key3, canonical2(entry)]));
 }
 function digest8(value) {
-  return createHash72("sha256").update(JSON.stringify(canonical2(value))).digest("hex");
+  return createHash73("sha256").update(JSON.stringify(canonical2(value))).digest("hex");
 }
 function ref3(prefix, identity) {
   return `${prefix}_${digest8(identity).slice(0, 32)}`;
@@ -70806,10 +70899,10 @@ function createPersonalAssistantReminderRuntime(options) {
 }
 
 // src/api/personal-assistant-reconcile-cron.ts
-import { createHash as createHash74, timingSafeEqual as timingSafeEqual8 } from "crypto";
+import { createHash as createHash75, timingSafeEqual as timingSafeEqual8 } from "crypto";
 
 // src/api/personal-assistant-reconcile.ts
-import { createHash as createHash73 } from "crypto";
+import { createHash as createHash74 } from "crypto";
 var PERSONAL_ASSISTANT_RECONCILIATION_LIMITS = Object.freeze({
   defaultBatchSize: 20,
   maxBatchSize: 50,
@@ -70831,7 +70924,7 @@ var PUBLIC_REF = /^[a-z][a-z0-9_]*_[A-Za-z0-9_-]{3,128}$/u;
 var DIGEST2 = /^[a-f0-9]{64}$/u;
 var PROVIDER_REF = /^[A-Za-z0-9:_-]{3,200}$/u;
 function hash2(value) {
-  return createHash73("sha256").update(value).digest("hex");
+  return createHash74("sha256").update(value).digest("hex");
 }
 function validateCandidate(candidate) {
   if (!/^[1-9]\d*$/u.test(candidate.ownerUserId) || !PUBLIC_REF.test(candidate.candidateRef) || !/^trace_[A-Za-z0-9_-]{8,128}$/u.test(candidate.traceRef) || !PUBLIC_REF.test(candidate.claimToken) || !PROVIDER_REF.test(candidate.providerAccountRef) || !PROVIDER_REF.test(candidate.providerLocatorRef) || !DIGEST2.test(candidate.expectedDigest) || !Number.isFinite(Date.parse(candidate.stuckSince))) {
@@ -70953,8 +71046,8 @@ async function reconcilePersonalAssistantTransports(dependencies, options = {})
 // src/api/personal-assistant-reconcile-cron.ts
 function authorized(actual, expectedSecret) {
   if (!actual?.startsWith("Bearer ")) return false;
-  const actualDigest = createHash74("sha256").update(actual).digest();
-  const expectedDigest = createHash74("sha256").update(`Bearer ${expectedSecret}`).digest();
+  const actualDigest = createHash75("sha256").update(actual).digest();
+  const expectedDigest = createHash75("sha256").update(`Bearer ${expectedSecret}`).digest();
   return timingSafeEqual8(actualDigest, expectedDigest);
 }
 function createPersonalAssistantReconcileCronHandler(options) {
@@ -71016,7 +71109,7 @@ function createPersonalAssistantReminderCronHandler(options) {
 }
 
 // src/api/twilio-inbound-admission.ts
-import { createHash as createHash75, randomBytes as randomBytes9 } from "crypto";
+import { createHash as createHash76, randomBytes as randomBytes9 } from "crypto";
 var ACCOUNT_SID = /^AC[0-9a-f]{32}$/iu;
 var MESSAGE_SID = /^(?:SM|MM)[0-9a-f]{32}$/iu;
 var MESSAGING_SERVICE_SID = /^MG[0-9a-f]{32}$/iu;
@@ -71038,10 +71131,10 @@ function canonicalJson8(value) {
   });
 }
 function digest9(value) {
-  return createHash75("sha256").update(canonicalJson8(value)).digest("hex");
+  return createHash76("sha256").update(canonicalJson8(value)).digest("hex");
 }
 function stableRef(prefix, value) {
-  return `${prefix}_${createHash75("sha256").update(value).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash76("sha256").update(value).digest("hex").slice(0, 32)}`;
 }
 function normalizeOptionalSid(value) {
   const normalized = value?.trim() || null;
@@ -71187,8 +71280,8 @@ function createTwilioInboundIngressCronHandler(options) {
   return async (request) => {
     if (request.method !== "GET") return Response.json({ error: "method_not_allowed" }, { status: 405, headers: { Allow: "GET" } });
     const actual = request.headers.get("authorization") ?? "";
-    const actualDigest = createHash75("sha256").update(actual).digest();
-    const expectedDigest = createHash75("sha256").update(expectedAuthorization).digest();
+    const actualDigest = createHash76("sha256").update(actual).digest();
+    const expectedDigest = createHash76("sha256").update(expectedAuthorization).digest();
     if (actualDigest.length !== expectedDigest.length || !actualDigest.equals(expectedDigest)) {
       return Response.json({ error: "unauthorized" }, { status: 401 });
     }
@@ -71230,7 +71323,7 @@ function createPersonalAssistantWorkerAndCronProduction(options) {
 }
 
 // src/api/personal-assistant-control-plane-store.ts
-import { createHash as createHash76, randomUUID as randomUUID57 } from "crypto";
+import { createHash as createHash77, randomUUID as randomUUID57 } from "crypto";
 var REF = /^[a-z][A-Za-z0-9_-]{2,159}$/;
 var DIGEST4 = /^[a-f0-9]{64}$/;
 function record3(input) {
@@ -71262,7 +71355,7 @@ function canonicalJson9(value) {
   });
 }
 function digest10(value) {
-  return createHash76("sha256").update(canonicalJson9(value)).digest("hex");
+  return createHash77("sha256").update(canonicalJson9(value)).digest("hex");
 }
 function normalizeE164(value) {
   const trimmed = value.trim();
@@ -71691,7 +71784,7 @@ function createPostgresPersonalAssistantNumberPort(options) {
 }
 
 // src/api/personal-assistant-scheduling-store.ts
-import { createHash as createHash77, randomUUID as randomUUID58 } from "crypto";
+import { createHash as createHash78, randomUUID as randomUUID58 } from "crypto";
 var PersonalAssistantSchedulingStoreError = class extends Error {
   constructor(code, message = code, status = code === "schedule_not_found" ? 404 : code === "schedule_activation_unavailable" ? 503 : 409) {
     super(message);
@@ -71718,7 +71811,7 @@ function canonicalJson10(value) {
   return JSON.stringify(value);
 }
 function digest11(value) {
-  return createHash77("sha256").update(canonicalJson10(value)).digest("hex");
+  return createHash78("sha256").update(canonicalJson10(value)).digest("hex");
 }
 function authorityClass(value) {
   if (value === "observe") return "observe";
@@ -72162,7 +72255,7 @@ function assertNoRawTwilioSecretEnvironment(environment2 = process.env) {
 }
 
 // src/api/twilio-messaging-service.ts
-import { createHash as createHash78 } from "crypto";
+import { createHash as createHash79 } from "crypto";
 
 // src/api/personal-assistant-policy.ts
 var AUTHORITY_RANK = {
@@ -72462,10 +72555,10 @@ function canonicalJson11(value) {
   });
 }
 function digest12(value) {
-  return createHash78("sha256").update(canonicalJson11(value)).digest("hex");
+  return createHash79("sha256").update(canonicalJson11(value)).digest("hex");
 }
 function deterministicRef3(prefix, identity) {
-  return `${prefix}_${createHash78("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash79("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function isBoundedAuthorityRef(value) {
   return typeof value === "string" && value.length >= 3 && value.length <= 240 && !value.includes("\0");
@@ -72637,7 +72730,7 @@ function inboundIdentity(input, route) {
   };
 }
 function sha256Bytes(bytes2) {
-  return createHash78("sha256").update(bytes2).digest("hex");
+  return createHash79("sha256").update(bytes2).digest("hex");
 }
 function startsWith(bytes2, signature) {
   return signature.every((value, index) => bytes2[index] === value);
@@ -73816,11 +73909,11 @@ function createTwilioMessagingService(dependencies = {}) {
 }
 
 // src/api/twilio-memory-media.ts
-import { createHash as createHash79, randomUUID as randomUUID59 } from "crypto";
+import { createHash as createHash80, randomUUID as randomUUID59 } from "crypto";
 var IMAGE_TYPES = /* @__PURE__ */ new Set(["image/jpeg", "image/png", "image/gif", "image/webp"]);
 var FILE_TYPES = /* @__PURE__ */ new Set(["application/pdf", "text/plain"]);
 function digestBytes(bytes2) {
-  return createHash79("sha256").update(bytes2).digest("hex");
+  return createHash80("sha256").update(bytes2).digest("hex");
 }
 function publicPointer(pointer) {
   return Object.freeze({
@@ -73904,7 +73997,7 @@ function createTwilioMemoryMedia(options) {
       return publicPointer(await options.pointers.put({
         ownerBindingRef: input.ownerBindingRef,
         mediaRef: input.mediaRef,
-        renewablePointerRef: `memory_asset_${createHash79("sha256").update(`${input.ownerBindingRef}\0${asset.assetId}`).digest("hex").slice(0, 32)}`,
+        renewablePointerRef: `memory_asset_${createHash80("sha256").update(`${input.ownerBindingRef}\0${asset.assetId}`).digest("hex").slice(0, 32)}`,
         byteDigest: input.byteDigest,
         contentType: input.contentType,
         byteSize: input.bytes.byteLength,
@@ -73937,7 +74030,7 @@ function createTwilioMemoryMedia(options) {
 }
 
 // src/api/twilio-provider-facade.ts
-import { createHash as createHash80 } from "crypto";
+import { createHash as createHash81 } from "crypto";
 
 // src/api/twilio-messaging-client.ts
 import twilio4 from "twilio";
@@ -74272,7 +74365,7 @@ function validAuthority(input) {
   return /^[1-9]\d*$/u.test(input.ownerUserId) && PUBLIC_REF2.test(input.executionRef) && ACCOUNT_SID3.test(input.providerAccountRef) && PUBLIC_REF2.test(input.connectionRef) && /^[A-Za-z][A-Za-z0-9_.:-]{2,159}$/u.test(input.environmentRef);
 }
 function digest13(value) {
-  return createHash80("sha256").update(JSON.stringify(value, (_key, entry) => {
+  return createHash81("sha256").update(JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
   })).digest("hex");
@@ -74461,7 +74554,7 @@ function createTwilioProduction(options) {
 }
 
 // src/runtime/personal-assistant-deployment-config.ts
-import { createHash as createHash81 } from "crypto";
+import { createHash as createHash82 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
 import { resolve as resolve2 } from "path";
 var REF_PATTERN = /^(?:[a-z][a-z0-9+.-]*:\/\/)?[A-Za-z0-9][A-Za-z0-9._:/-]{2,240}$/;
@@ -74497,7 +74590,7 @@ function databaseBinding(value) {
     const database = decodeURIComponent(parsed.pathname.replace(/^\//, ""));
     const role = decodeURIComponent(parsed.username);
     if (!database || !/^[a-z_][a-z0-9_]*$/.test(role)) return null;
-    return { fingerprint: createHash81("sha256").update(`${labels.join(".")}\0${database}`).digest("hex"), role };
+    return { fingerprint: createHash82("sha256").update(`${labels.join(".")}\0${database}`).digest("hex"), role };
   } catch {
     return null;
   }
@@ -74959,7 +75052,7 @@ function createPersonalAssistantHostedConfigurationAdapter(input) {
 }
 
 // src/api/personal-assistant-authorization.ts
-import { createHash as createHash82 } from "crypto";
+import { createHash as createHash83 } from "crypto";
 import { z as z51 } from "zod";
 var ABUSE_GATED_OPERATIONS = /* @__PURE__ */ new Set(["assistant.message.send", "assistant.bulk.send"]);
 var NORMALIZED_RECIPIENT_OPERATIONS = /* @__PURE__ */ new Set([
@@ -75137,7 +75230,7 @@ function canonicalJson12(value) {
   return JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))) : entry);
 }
 function factDigest(value) {
-  return createHash82("sha256").update(canonicalJson12(value)).digest("hex");
+  return createHash83("sha256").update(canonicalJson12(value)).digest("hex");
 }
 var PostgresPersonalAssistantPolicyFactsRepository = class {
   constructor(db, contexts, now = () => /* @__PURE__ */ new Date()) {
@@ -75327,7 +75420,7 @@ var PostgresPersonalAssistantPolicyFactsRepository = class {
 };
 
 // src/api/personal-assistant-abuse-controls.ts
-import { createHash as createHash83 } from "crypto";
+import { createHash as createHash84 } from "crypto";
 var EMPTY_STATE = () => ({
   version: 1,
   events: [],
@@ -75338,7 +75431,7 @@ var EMPTY_STATE = () => ({
   bulkIdentities: {}
 });
 function digest14(value) {
-  return createHash83("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash84("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function isDigest(value) {
   return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
@@ -75598,10 +75691,10 @@ var PostgresPersonalAssistantAbuseStore = class {
 };
 
 // src/api/twilio-authority-billing-postgres.ts
-import { createHash as createHash85, randomUUID as randomUUID60 } from "crypto";
+import { createHash as createHash86, randomUUID as randomUUID60 } from "crypto";
 
 // src/api/personal-assistant-billing.ts
-import { createHash as createHash84 } from "crypto";
+import { createHash as createHash85 } from "crypto";
 var AssistantBillingError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -75618,7 +75711,7 @@ function canonicalJson13(value) {
   });
 }
 function digest15(value) {
-  return createHash84("sha256").update(canonicalJson13(value)).digest("hex");
+  return createHash85("sha256").update(canonicalJson13(value)).digest("hex");
 }
 function assertMoney(value, field) {
   if (!Number.isSafeInteger(value) || value < 0) throw new AssistantBillingError("billing_invalid_input", `${field} must be a non-negative safe integer.`);
@@ -75663,7 +75756,7 @@ function canonicalJson14(value) {
   });
 }
 function digest16(value) {
-  return createHash85("sha256").update(canonicalJson14(value)).digest("hex");
+  return createHash86("sha256").update(canonicalJson14(value)).digest("hex");
 }
 function amountFor2(usage) {
   return usage.reduce((sum2, item) => sum2 + item.units * item.rateMinorPerUnit, 0);
@@ -75898,7 +75991,7 @@ function createPostgresAssistantBillingStore(options = {}) {
 import {
   createCipheriv as createCipheriv3,
   createDecipheriv as createDecipheriv3,
-  createHash as createHash86,
+  createHash as createHash87,
   createHmac as createHmac14,
   randomBytes as randomBytes10
 } from "crypto";
@@ -75956,7 +76049,7 @@ function canonicalContext(input) {
   });
 }
 function contextDigest(context) {
-  return createHash86("sha256").update(context, "utf8").digest("hex");
+  return createHash87("sha256").update(context, "utf8").digest("hex");
 }
 function decodeBase64Url(value, expectedBytes) {
   if (!value || !BASE64URL.test(value)) throw new PersonalAssistantProtectedDataCryptoError("protected_data_envelope_invalid");
@@ -76145,8 +76238,8 @@ async function resolvePersonalAssistantProtectedDataCryptoFactory(options) {
 }
 
 // src/api/twilio-first-text-context-postgres.ts
-import { createHash as createHash87 } from "crypto";
-var digest17 = (value) => createHash87("sha256").update(value).digest("hex");
+import { createHash as createHash88 } from "crypto";
+var digest17 = (value) => createHash88("sha256").update(value).digest("hex");
 function createPostgresTwilioFirstTextDiagnosticContextResolver(options = {}) {
   const queryable = options.queryable ?? getAssistantPool();
   return async (input) => {
@@ -76191,10 +76284,10 @@ function createPostgresTwilioFirstTextDiagnosticContextResolver(options = {}) {
 }
 
 // src/api/twilio-first-text-diagnostic-postgres.ts
-import { createHash as createHash89, randomBytes as randomBytes12, randomUUID as randomUUID61 } from "crypto";
+import { createHash as createHash90, randomBytes as randomBytes12, randomUUID as randomUUID61 } from "crypto";
 
 // src/api/twilio-first-text-diagnostic.ts
-import { createHash as createHash88, randomBytes as randomBytes11 } from "crypto";
+import { createHash as createHash89, randomBytes as randomBytes11 } from "crypto";
 var TWILIO_FIRST_TEXT_BODY = ASSISTANT_CONSENT_CONTENT_V1.diagnosticMessage;
 var TwilioFirstTextDiagnosticError = class extends Error {
   constructor(code) {
@@ -76205,10 +76298,10 @@ var TwilioFirstTextDiagnosticError = class extends Error {
   code;
 };
 function digest18(value) {
-  return createHash88("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash89("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function stableRef2(prefix, identity) {
-  return `${prefix}_${createHash88("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash89("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function providerSid(result3) {
   const value = result3.receipt.providerMessageSid;
@@ -76320,14 +76413,14 @@ function createTwilioFirstTextDiagnosticService(dependencies) {
 var COLUMNS = `owner_user_id::text,public_id,idempotency_key,request_digest,policy_version,recipient_ref,sender_ref,
  state,mode,stages,provider_message_sid,inbound_event_ref,routing_receipt_ref,acknowledgement_receipt_ref,
  retry_eligible,failure_code,execution_token_digest,created_at,updated_at`;
-var digest19 = (value) => createHash89("sha256").update(value).digest("hex");
+var digest19 = (value) => createHash90("sha256").update(value).digest("hex");
 var iso5 = (value) => new Date(value).toISOString();
 function receipt3(row) {
   return Object.freeze({
     diagnosticRef: row.public_id,
     ownerUserId: row.owner_user_id,
     idempotencyKey: row.idempotency_key,
-    executionRef: `execution_${createHash89("sha256").update(row.public_id).digest("hex").slice(0, 32)}`,
+    executionRef: `execution_${createHash90("sha256").update(row.public_id).digest("hex").slice(0, 32)}`,
     requestDigest: row.request_digest,
     policyVersion: row.policy_version,
     recipientRef: row.recipient_ref,
@@ -76495,10 +76588,10 @@ function createTwilioInboundQuarantineClaimAuthorizer(options) {
 }
 
 // src/api/twilio-inbound-claim-control-plane-postgres.ts
-import { createHash as createHash90, randomUUID as randomUUID62 } from "crypto";
-var stableRef3 = (prefix, value) => `${prefix}_${createHash90("sha256").update(value).digest("hex").slice(0, 32)}`;
+import { createHash as createHash91, randomUUID as randomUUID62 } from "crypto";
+var stableRef3 = (prefix, value) => `${prefix}_${createHash91("sha256").update(value).digest("hex").slice(0, 32)}`;
 var stableUuid = (value) => {
-  const hex = createHash90("sha256").update(value).digest("hex").slice(0, 32).split("");
+  const hex = createHash91("sha256").update(value).digest("hex").slice(0, 32).split("");
   hex[12] = "5";
   hex[16] = (Number.parseInt(hex[16], 16) & 3 | 8).toString(16);
   return `${hex.slice(0, 8).join("")}-${hex.slice(8, 12).join("")}-${hex.slice(12, 16).join("")}-${hex.slice(16, 20).join("")}-${hex.slice(20).join("")}`;
@@ -76580,12 +76673,12 @@ function createPostgresTwilioInboundClaimControlPlane(options) {
 }
 
 // src/api/twilio-inbound-envelope-postgres.ts
-import { createHash as createHash92 } from "crypto";
+import { createHash as createHash93 } from "crypto";
 
 // src/api/twilio-inbound-admission-postgres.ts
-import { createHash as createHash91, randomBytes as randomBytes13, randomUUID as randomUUID63 } from "crypto";
+import { createHash as createHash92, randomBytes as randomBytes13, randomUUID as randomUUID63 } from "crypto";
 function tokenHash4(value) {
-  return createHash91("sha256").update(value).digest("hex");
+  return createHash92("sha256").update(value).digest("hex");
 }
 function rowToRecord(row) {
   return Object.freeze({
@@ -76754,7 +76847,7 @@ function createPostgresTwilioInboundAdmissionStore(options = {}) {
 
 // src/api/twilio-inbound-envelope-postgres.ts
 function stableRef4(prefix, identity) {
-  return `${prefix}_${createHash92("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash93("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function parseStoredEnvelope(value) {
   let parsed;
@@ -77116,11 +77209,11 @@ function createPostgresTwilioInboundQuarantineStore(options = {}) {
 }
 
 // src/api/twilio-inbound-quarantine.ts
-import { createHash as createHash93, createHmac as createHmac15, timingSafeEqual as timingSafeEqual10 } from "crypto";
+import { createHash as createHash94, createHmac as createHmac15, timingSafeEqual as timingSafeEqual10 } from "crypto";
 var DIGEST7 = /^[a-f0-9]{64}$/u;
 var OPAQUE2 = /^[A-Za-z][A-Za-z0-9_.:-]{2,199}$/u;
 function digest20(value) {
-  return createHash93("sha256").update(value).digest("hex");
+  return createHash94("sha256").update(value).digest("hex");
 }
 function stableRef5(prefix, identity) {
   return `${prefix}_${digest20(identity).slice(0, 32)}`;
@@ -77435,10 +77528,10 @@ async function createPersonalAssistantTwilioTransportProduction(options) {
 }
 
 // src/api/twilio-number-production.ts
-import { createHash as createHash95, randomUUID as randomUUID66 } from "crypto";
+import { createHash as createHash96, randomUUID as randomUUID66 } from "crypto";
 
 // src/api/twilio-number-repository.ts
-import { createHash as createHash94, randomUUID as randomUUID65 } from "crypto";
+import { createHash as createHash95, randomUUID as randomUUID65 } from "crypto";
 var PUBLIC_REF3 = /^[a-z][a-z0-9_]*_[A-Za-z0-9_-]{3,128}$/;
 var DIGEST8 = /^[a-f0-9]{64}$/;
 var ACCOUNT_SID4 = /^AC[0-9a-f]{32}$/i;
@@ -77527,7 +77620,7 @@ function priceValue(value) {
   }), blocker: null });
 }
 function digest21(value) {
-  return createHash94("sha256").update(JSON.stringify(value, (_key, entry) => {
+  return createHash95("sha256").update(JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
   })).digest("hex");
@@ -78314,13 +78407,13 @@ function createPostgresTwilioNumberProductionAdapters(options) {
 }
 function twilioProviderAccountDigest(providerAccountRef) {
   if (!ACCOUNT_SID4.test(providerAccountRef)) throw new TwilioNumberRepositoryError("invalid_provider_account", "Twilio account assignment is invalid.", 400);
-  return createHash94("sha256").update(providerAccountRef).digest("hex");
+  return createHash95("sha256").update(providerAccountRef).digest("hex");
 }
 
 // src/api/twilio-number-production.ts
 var DIGEST9 = /^[a-f0-9]{64}$/u;
 function hash3(value) {
-  return createHash95("sha256").update(typeof value === "string" ? value : JSON.stringify(value, (_key, entry) => {
+  return createHash96("sha256").update(typeof value === "string" ? value : JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
   })).digest("hex");
@@ -78733,7 +78826,7 @@ function createTwilioNumberProductionInterfaces(options) {
 }
 
 // src/api/twilio-number-service.ts
-import { createHash as createHash96, randomUUID as randomUUID67 } from "crypto";
+import { createHash as createHash97, randomUUID as randomUUID67 } from "crypto";
 var DEFAULT_RESERVATION_TTL_MS = 5 * 60 * 1e3;
 var MIN_RESERVATION_TTL_MS = 60 * 1e3;
 var MAX_RESERVATION_TTL_MS = 10 * 60 * 1e3;
@@ -78869,7 +78962,7 @@ function canonicalJson15(value) {
   });
 }
 function digest22(value) {
-  return createHash96("sha256").update(canonicalJson15(value)).digest("hex");
+  return createHash97("sha256").update(canonicalJson15(value)).digest("hex");
 }
 function requireIdempotencyKey(value) {
   if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9:._/-]{7,239}$/.test(value)) {
@@ -80298,7 +80391,7 @@ function presence(env) {
 }
 function fingerprintDigest(env) {
   const value = env.PA_NEON_BINDING_FINGERPRINT?.trim();
-  return value ? createHash97("sha256").update("personal-assistant-binding-v1\0").update(value).digest("hex") : null;
+  return value ? createHash98("sha256").update("personal-assistant-binding-v1\0").update(value).digest("hex") : null;
 }
 function missingHostedBindings(env) {
   return Object.entries(REQUIRED_HOSTED_BINDINGS).filter(([, variable]) => !env[variable]?.trim()).map(([name]) => `binding_${name}_missing`);
@@ -80531,7 +80624,7 @@ function shouldRunSiteExtractInBackground(input) {
 }
 
 // src/api/page-media-artifacts.ts
-import { createHash as createHash98, randomBytes as randomBytes14 } from "crypto";
+import { createHash as createHash99, randomBytes as randomBytes14 } from "crypto";
 import { homedir as homedir4 } from "os";
 import { basename, extname, join as join9 } from "path";
 import pLimit6 from "p-limit";
@@ -80678,7 +80771,7 @@ async function fetchMedia(rawUrl, expectedType) {
       finalUrl: checked.parsed.href,
       width: dimensions?.width ?? null,
       height: dimensions?.height ?? null,
-      sha256: createHash98("sha256").update(bytes2).digest("hex")
+      sha256: createHash99("sha256").update(bytes2).digest("hex")
     };
   }
   throw new Error("media_redirect_rejected");
@@ -80884,13 +80977,13 @@ async function reconcileSiteExtractSettlements(limit = 25) {
 }
 
 // src/api/page-diff.ts
-import { createHash as createHash99 } from "crypto";
+import { createHash as createHash100 } from "crypto";
 import { diffLines } from "diff";
 var MAX_SNAPSHOT_CONTENT_CHARS = 25e4;
 var MAX_DIFF_HUNKS = 200;
 var MAX_DIFF_LINES_PER_RESPONSE = 2e3;
 function sha256Hex(value) {
-  return createHash99("sha256").update(value).digest("hex");
+  return createHash100("sha256").update(value).digest("hex");
 }
 function truncateForStorage(value, maxChars = MAX_SNAPSHOT_CONTENT_CHARS) {
   if (value.length <= maxChars) return { value, truncated: false };
@@ -80957,7 +81050,7 @@ async function depositScrapeToVault(user, opts) {
     const content = (opts.content ?? "").trim();
     if (!content) return { deposited: false, error: "empty content" };
     const clipped = content.length > MAX_DEPOSIT_CHARS ? content.slice(0, MAX_DEPOSIT_CHARS) : content;
-    const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+    const { key: key3, error } = await getMemoryServiceToken(user);
     if (!key3) return { deposited: false, error: error ?? "memory unavailable" };
     const vault = opts.vault?.trim() || "Library";
     const title = (opts.title?.trim() || opts.source).slice(0, 200);
@@ -81004,15 +81097,15 @@ async function persistScrapeBody(user, opts) {
 }
 
 // src/api/scrape-image-sink.ts
-import { createHash as createHash100 } from "crypto";
+import { createHash as createHash101 } from "crypto";
 var MAX_IMAGES_PER_SCRAPE = 25;
 function idempotencyKey3(userId, vault, input) {
-  return `scrape-image-${createHash100("sha256").update(`${userId}\0${vault}\0${input.sourceKind}\0${input.sourceUrl}\0${input.imageUrl ?? ""}\0${input.imageBase64 ?? ""}`).digest("hex")}`;
+  return `scrape-image-${createHash101("sha256").update(`${userId}\0${vault}\0${input.sourceKind}\0${input.sourceUrl}\0${input.imageUrl ?? ""}\0${input.imageBase64 ?? ""}`).digest("hex")}`;
 }
 async function persistScrapeImagesToMemory(user, inputs, vault) {
   const selected = inputs.slice(0, MAX_IMAGES_PER_SCRAPE);
   if (selected.length === 0) return { requested: 0, saved: 0, skipped: 0, assets: [] };
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   if (!key3) {
     return { requested: selected.length, saved: 0, skipped: inputs.length - selected.length, assets: [], error: error ?? "memory unavailable" };
   }
@@ -81479,7 +81572,7 @@ function inferredWaybackCapturedAt(content) {
 }
 
 // src/api/connection-memory-import.ts
-import { createHash as createHash101 } from "crypto";
+import { createHash as createHash102 } from "crypto";
 var CONNECTION_MEMORY_IMPORT_MAX_ARGS_BYTES = 64 * 1024;
 var CONNECTION_MEMORY_IMPORT_MAX_RESULT_BYTES = 1e6;
 var CONNECTION_MEMORY_IMPORT_MAX_STRING_CHARS = 256e3;
@@ -81509,7 +81602,7 @@ function canonicalJson16(value) {
   return JSON.stringify(value);
 }
 function sha2562(value) {
-  return createHash101("sha256").update(value).digest("hex");
+  return createHash102("sha256").update(value).digest("hex");
 }
 function sensitiveKey(key3) {
   const normalized = key3.toLowerCase().replace(/[^a-z0-9]/g, "");
@@ -81778,7 +81871,7 @@ async function cleanupExpiredScrapeBlobs(maxAgeMs = SCRAPE_BLOB_TTL_MS) {
 }
 
 // src/api/site-export-reader.ts
-import { createHash as createHash102 } from "crypto";
+import { createHash as createHash103 } from "crypto";
 var SiteExportFormatUnavailableError = class extends Error {
   constructor(format) {
     super(`The ${format} representation was not retained for this export page.`);
@@ -81788,7 +81881,7 @@ var SiteExportFormatUnavailableError = class extends Error {
   format;
 };
 function sha2563(value) {
-  return createHash102("sha256").update(value).digest("hex");
+  return createHash103("sha256").update(value).digest("hex");
 }
 function publicPageRecord(page3) {
   const { bodyMarkdown: _body, contentRef: _contentRef, discoveryLinks: _discovery, ...metadata } = page3;
@@ -82353,7 +82446,7 @@ async function dbUsage(identity, plan) {
 }
 
 // src/api/resend-control.ts
-import { createHash as createHash103 } from "crypto";
+import { createHash as createHash104 } from "crypto";
 var DEFAULT_CONNECTION_CONTROL_URL = "https://mcp-scraper-scheduler.vercel.app";
 var RESEND_PROVIDER_CONFIG_KEY = "resend";
 var RESEND_LOGO_URL = "https://cdn.resend.com/brand/resend-icon-black.svg";
@@ -82612,7 +82705,7 @@ async function callResendRead(identity, connectionId, tool, args) {
   return isRecord9(data) ? data.result ?? data : data;
 }
 async function callResendAction(identity, connectionId, tool, input, idempotencyKey4) {
-  const requestId = `main-resend-action:${createHash103("sha256").update(identity).update("\0").update(idempotencyKey4.trim()).digest("hex")}`;
+  const requestId = `main-resend-action:${createHash104("sha256").update(identity).update("\0").update(idempotencyKey4.trim()).digest("hex")}`;
   const body3 = await controlRequest2("/api/internal/resend/actions/call", {
     method: "POST",
     headers: { "x-request-id": requestId },
@@ -83191,19 +83284,19 @@ app.post("/memory/mcp-call", auth5, async (c) => {
       }, 503);
     }
   }
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 502);
   const result3 = await memoryCall(body3.toolName, body3.args ?? {}, key3);
   return c.json(result3);
 });
 app.get("/memory/approved-senders", auth5, async (c) => {
-  const { key: key3, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  const { key: key3, error } = await getMemoryServiceToken(c.get("user"));
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 502);
   const r = await memoryCall("listApprovedSendersTool", {}, key3);
   return c.json(r);
 });
 app.post("/memory/approved-senders", auth5, async (c) => {
-  const { key: key3, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  const { key: key3, error } = await getMemoryServiceToken(c.get("user"));
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 502);
   const body3 = await c.req.json().catch(() => ({}));
   const senderIdentity = body3.senderIdentity?.trim();
@@ -83212,29 +83305,34 @@ app.post("/memory/approved-senders", auth5, async (c) => {
   return c.json(r);
 });
 app.delete("/memory/approved-senders/:identity", auth5, async (c) => {
-  const { key: key3, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  const { key: key3, error } = await getMemoryServiceToken(c.get("user"));
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 502);
   const senderIdentity = c.req.param("identity");
   const r = await memoryCall("removeApprovedSenderTool", { senderIdentity }, key3);
   return c.json(r);
 });
 app.get("/memory/connect", auth5, async (c) => {
-  const { key: key3, error } = await getOrCreateUserMemoryKey(c.get("user"));
-  if (!key3) return c.json({ error: error ?? "memory unavailable" }, 502);
-  const url2 = "https://memory.mcpscraper.dev/mcp";
+  const url2 = "https://mcpscraper.dev/mcp";
   const config = {
     mcpServers: {
-      Memory: {
+      "MCP Scraper": {
         url: url2,
-        headers: { Authorization: `Bearer ${key3}` }
+        headers: { "x-api-key": "${MCP_SCRAPER_API_KEY}" }
       }
     }
   };
-  const codeCommand = `claude mcp add --transport http memory ${url2} --header "Authorization: Bearer ${key3}"`;
-  return c.json({ ok: true, url: url2, key: key3, config, codeCommand });
+  const codeCommand = 'claude mcp add --transport http mcp-scraper https://mcpscraper.dev/mcp --header "x-api-key: $MCP_SCRAPER_API_KEY"';
+  return c.json({
+    ok: true,
+    url: url2,
+    apiKeyEnvironmentVariable: "MCP_SCRAPER_API_KEY",
+    authModes: ["x-api-key", "oauth"],
+    config,
+    codeCommand
+  });
 });
 app.post("/memory/vault", auth5, async (c) => {
-  const { key: key3, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  const { key: key3, error } = await getMemoryServiceToken(c.get("user"));
   if (!key3) return c.json({ error: error ?? "memory unavailable" }, 502);
   const body3 = await c.req.json().catch(() => ({}));
   const vault = body3.vault?.trim();
@@ -83283,7 +83381,7 @@ app.get("/memory/universe", auth5, async (c) => {
   }
 });
 app.put("/memory/note", auth5, async (c) => {
-  const { key: key3, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  const { key: key3, error } = await getMemoryServiceToken(c.get("user"));
   if (!key3) return c.json({ error: error ?? "memory unavailable" }, 502);
   const body3 = await c.req.json().catch(() => ({}));
   if (!body3.path) return c.json({ error: "path required" }, 400);
@@ -83291,7 +83389,7 @@ app.put("/memory/note", auth5, async (c) => {
   return c.json(result3, result3.ok ? 200 : 502);
 });
 app.delete("/memory/note", auth5, async (c) => {
-  const { key: key3, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  const { key: key3, error } = await getMemoryServiceToken(c.get("user"));
   if (!key3) return c.json({ error: error ?? "memory unavailable" }, 502);
   const vault = c.req.query("vault");
   const path5 = c.req.query("path");
@@ -83572,7 +83670,7 @@ function renderResendOAuthResult(ok) {
 app.get("/schedule-status", auth5, requirePaidSchedulingTier, async (c) => {
   try {
     const user = c.get("user");
-    const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+    const { key: key3, error } = await getMemoryServiceToken(user);
     if (!key3) return c.json({ error: error ?? "memory unavailable" }, 503);
     const r = await memoryCall("getScheduleStatusTool", {}, key3);
     return c.json({
@@ -83828,7 +83926,7 @@ app.post("/schedule-connections/actions/gmail/send-message", auth5, requireInteg
   }
   try {
     const result3 = await directGmailService.sendMessage({
-      ownerId: createHash104("sha256").update(user.api_key).digest("hex").slice(0, 24),
+      ownerId: createHash105("sha256").update(user.api_key).digest("hex").slice(0, 24),
       providerIdentity: user.email,
       connectionId,
       to: body3.to,
@@ -84017,7 +84115,7 @@ app.post("/schedule-connections/actions/import-memory", auth5, requireIntegratio
     }, {
       listConnections: combinedConnections,
       prepareMemory: async (_identity, requestedVault) => {
-        const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+        const { key: key3, error } = await getMemoryServiceToken(user);
         if (!key3) throw new ConnectionMemoryImportError("memory_unavailable", error || "Memory is unavailable.", 503, true);
         const listed = await memoryCall("listVaultsTool", {}, key3);
         if (!listed.ok) throw new ConnectionMemoryImportError("memory_unavailable", listed.error || "Memory vaults are unavailable.", 503, true);
@@ -84150,7 +84248,7 @@ app.post("/schedule-connections/actions/export-search-console-table", auth5, req
   const body3 = await c.req.json().catch(() => ({}));
   try {
     const request = validateSearchConsoleTableExportRequest(body3);
-    const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+    const { key: key3, error } = await getMemoryServiceToken(user);
     if (!key3) return c.json({ ok: false, error: error ?? "Memory table access is unavailable." }, 503);
     const result3 = await exportSearchConsoleTableData({
       ownerId: sha256Hex(user.api_key).slice(0, 24),
@@ -84235,7 +84333,7 @@ app.post("/schedule-link", auth5, requirePaidSchedulingTier, async (c) => {
     if (!credentials.ok) {
       return c.json({ ok: false, code: "schedule_credentials_unavailable", error: credentials.error ?? "Scheduled Actions credentials are unavailable." }, 503);
     }
-    const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+    const { key: key3, error } = await getMemoryServiceToken(user);
     if (!key3) return c.json({ error: error ?? "memory unavailable" }, 503);
     const r = await memoryCall("getScheduleLinkTool", {}, key3);
     return c.json(r);
@@ -84247,7 +84345,7 @@ app.post("/schedule-link", auth5, requirePaidSchedulingTier, async (c) => {
 });
 app.get("/schedule-actions", auth5, async (c) => {
   const user = c.get("user");
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
   const r = await memoryCall("listScheduledActionsTool", {}, key3);
   if (!r.ok || !Array.isArray(r.actions)) return c.json(r);
@@ -84278,7 +84376,7 @@ app.post("/schedule-actions", auth5, requirePaidSchedulingTier, async (c) => {
   if (!credentials.ok) {
     return c.json({ ok: false, code: "schedule_credentials_unavailable", error: credentials.error ?? "Scheduled Actions credentials are unavailable." }, 503);
   }
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
   const body3 = await c.req.json().catch(() => ({}));
   const executionMode = body3.executionMode ?? "agent";
@@ -84319,7 +84417,7 @@ app.post("/schedule-actions", auth5, requirePaidSchedulingTier, async (c) => {
 });
 app.post("/schedule-actions/propose", auth5, async (c) => {
   const user = c.get("user");
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
   const body3 = await c.req.json().catch(() => ({}));
   const r = await memoryCall("proposeScheduledActionTool", body3, key3);
@@ -84346,7 +84444,7 @@ app.put("/schedule-actions/:id/connections", auth5, requireIntegrationsTier, asy
   }
   try {
     const scheduleActionId = c.req.param("id");
-    const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+    const { key: key3, error } = await getMemoryServiceToken(user);
     if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
     const schedules = await memoryCall("listScheduledActionsTool", {}, key3);
     if (!schedules.ok || !Array.isArray(schedules.actions)) return c.json(schedules, 502);
@@ -84364,7 +84462,7 @@ app.put("/schedule-actions/:id/connections", auth5, requireIntegrationsTier, asy
 });
 app.get("/schedule-actions/:id/runs", auth5, async (c) => {
   const user = c.get("user");
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
   const limitRaw = Number(c.req.query("limit") ?? "50");
   const limit = Number.isFinite(limitRaw) ? Math.min(Math.max(Math.round(limitRaw), 1), 100) : 50;
@@ -84373,7 +84471,7 @@ app.get("/schedule-actions/:id/runs", auth5, async (c) => {
 });
 app.put("/schedule-actions/:id", auth5, requirePaidSchedulingTier, async (c) => {
   const user = c.get("user");
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
   const body3 = await c.req.json().catch(() => ({}));
   const updates = {};
@@ -84388,21 +84486,21 @@ app.put("/schedule-actions/:id", auth5, requirePaidSchedulingTier, async (c) =>
 });
 app.post("/schedule-actions/:id/pause", auth5, async (c) => {
   const user = c.get("user");
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
   const r = await memoryCall("pauseScheduledActionTool", { id: c.req.param("id") }, key3);
   return c.json(r);
 });
 app.post("/schedule-actions/:id/resume", auth5, requirePaidSchedulingTier, async (c) => {
   const user = c.get("user");
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
   const r = await memoryCall("resumeScheduledActionTool", { id: c.req.param("id") }, key3);
   return c.json(r);
 });
 app.delete("/schedule-actions/:id", auth5, async (c) => {
   const user = c.get("user");
-  const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+  const { key: key3, error } = await getMemoryServiceToken(user);
   if (!key3) return c.json({ ok: false, error: error ?? "memory unavailable" }, 503);
   const scheduleActionId = c.req.param("id");
   const r = await memoryCall("deleteScheduledActionTool", { id: scheduleActionId }, key3);
@@ -84418,7 +84516,7 @@ app.delete("/schedule-actions/:id", auth5, async (c) => {
 app.post("/schedule-link/revoke", auth5, async (c) => {
   try {
     const user = c.get("user");
-    const { key: key3, error } = await getOrCreateUserMemoryKey(user);
+    const { key: key3, error } = await getMemoryServiceToken(user);
     if (!key3) return c.json({ error: error ?? "memory unavailable" }, 503);
     const r = await memoryCall("revokeScheduleLinkTool", {}, key3);
     return c.json(r);
@@ -86145,7 +86243,7 @@ app.get("/cron/tick", async (c) => {
     return c.json({ error: "Unauthorized" }, 401);
   }
   const startedAt = Date.now();
-  const { drainQueue } = await import("./worker-OQSFSLNG.js");
+  const { drainQueue } = await import("./worker-LDCAULWL.js");
   const budget = { maxJobs: 10, deadlineMs: startedAt + CRON_TICK_DRAIN_BUDGET_MS };
   const origin = `${new URL(c.req.url).protocol}//${new URL(c.req.url).host}`;
   const unfinished = [];
@@ -86269,8 +86367,8 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
     finishExtractJob: finishExtractJob2,
     terminalExtractJobStatus: terminalExtractJobStatus2,
     extractJobLimitInfo: extractJobLimitInfo2
-  } = await import("./site-extract-repository-S5FYNFDY.js");
-  const { assembleExtractArtifacts } = await import("./extract-bundle-FALNLKYY.js");
+  } = await import("./site-extract-repository-VYFZASPU.js");
+  const { assembleExtractArtifacts } = await import("./extract-bundle-565SBZCR.js");
   const existing = await getExtractJob2(jobId2);
   if (!existing) return c.json({ error: "job not found" }, 404);
   if (existing.status !== "failed") {
@@ -86297,7 +86395,7 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
   if (!updated) return c.json({ error: "job state changed during re-finalization" }, 409);
   let settlement = "already_settled_or_refunded";
   if (job.billedMc == null && job.userId != null) {
-    const { settleExtractJob: settleExtractJob3, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-S5FYNFDY.js");
+    const { settleExtractJob: settleExtractJob3, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-VYFZASPU.js");
     const heldMc = Number(job.options.heldMc ?? 0);
     const successful = await countSuccessfulPages2(jobId2);
     const usedMc = Math.min(successful * MC_COSTS.page_scrape, heldMc);