@omnisocials/mcp-server 1.35.0 → 1.39.0

package/README.md

@@ -9,7 +9,7 @@ MCP (Model Context Protocol) server for the [OmniSocials](https://omnisocials.co
 
 ## Remote MCP URL (no install)
 
-For clients that support remote MCP over HTTP (claude.ai, ChatGPT, Notion, OpenClaw):
+For clients that support remote MCP over HTTP (claude.ai, ChatGPT, Notion, Muse, OpenClaw):
 
 ```
 https://mcp.omnisocials.com?API_KEY=omsk_live_your_key_here
@@ -115,7 +115,7 @@ OmniSocials accepts the following channel IDs in `create_post`, `create_and_publ
 
 ## Available Tools
 
-### Posts (13 tools)
+### Posts (15 tools)
 
 | Tool | Description |
 |------|-------------|
@@ -130,7 +130,9 @@ OmniSocials accepts the following channel IDs in `create_post`, `create_and_publ
 | `list_approval_workflows` | List the workspace's approval workflows (steps + approvers); pass an id as `approval_workflow_id` on `create_post` to hold the post for review |
 | `approve_post` | Approve the current step of a post's approval workflow (the connected user must be a listed approver for that step) |
 | `reject_post` | Reject a post's approval workflow, stopping it immediately |
+| `get_post_approval` | Read the approval review of a post: steps, approvers and their decisions, the rejection reason and the comment thread |
 | `search_locations` | Find an Instagram or Threads location to tag (Instagram place IDs for `location_id`, Threads location ids for `threads.location_id`; Threads also searches by latitude/longitude) |
+| `list_pinterest_products` | List the product Pins of the connected Pinterest account (catalog or own Pins), or check one Pin, to tag products with `pinterest.product_tags` |
 | `search_instagram_audio` | Search Instagram's licensed music catalog for a track to attach to a Reel |
 
 ### Media & folders (6 tools)
@@ -178,12 +180,12 @@ Apply a set when creating a post: `create_post` / `create_and_publish_post` acce
 | `list_workspaces` | List all workspaces available in this session |
 | `switch_workspace` | Switch the active workspace **by name** (id or list number also accepted) |
 
-### Webhooks (5 tools)
+### Webhooks (6 tools)
 
 | Tool | Description |
 |------|-------------|
 | `list_webhooks` | List all webhooks |
-| `create_webhook` | Create a webhook for event notifications |
+| `create_webhook` | Create a webhook for event notifications (`post.scheduled`, `post.published`, `post.failed`, `post.approved`, `post.rejected`) |
 | `get_webhook` | Get webhook details |
 | `update_webhook` | Update a webhook |
 | `delete_webhook` | Delete a webhook |
@@ -194,10 +196,10 @@ Apply a set when creating a post: `create_post` / `create_and_publish_post` acce
 | Tool | Description |
 |------|-------------|
 | `list_inbox_conversations` | List conversations: Instagram/Facebook DMs, comments, mentions, LinkedIn company-page comments/mentions, TikTok video comments, YouTube video comments, X DMs (opt-in), and Threads replies on your posts plus mentions; filter by platform, type, unread, or `unanswered` |
-| `get_next_unanswered` | The next item that still needs an answer (longest-waiting first) with the whole thread and the post it is on; filter by platform or type, `include_read`, `exclude` |
+| `get_next_unanswered` | The next item that still needs an answer (DMs that can still be answered first, then expired Instagram/Facebook DMs, then comments and mentions oldest first) with the whole thread, the post it is on and its `reply_window`; filter by platform or type, `include_read`, `exclude` |
 | `get_inbox_conversation` | Get a conversation's full message history with the post it belongs to; every message shows its `#id` |
 | `mark_inbox_read` | Mark all incoming messages in a conversation as read (also the durable skip for `get_next_unanswered`) |
-| `reply_to_inbox` | Reply to a DM, comment, or mention (existing conversations only); `include_next` returns the next unanswered item in the same call |
+| `reply_to_inbox` | Reply to a DM, comment, or mention (existing conversations only); `message_id` picks the comment being answered; `include_next` returns the next unanswered item in the same call |
 | `hide_inbox_comment` | Hide or unhide a comment on one of your posts (Facebook, Instagram, TikTok, YouTube, Threads) |
 | `delete_inbox_comment` | Permanently delete a comment on one of your posts, with the replies under it (Facebook, Instagram, TikTok) |
 | `hide_inbox_reply` | Older name for `hide_inbox_comment`, kept for compatibility |
@@ -227,6 +229,49 @@ Full API docs: [docs.omnisocials.com](https://docs.omnisocials.com)
 
 ## Changelog
 
+### 1.39.0 (2026-10-05)
+
+- **Added: tag products on a Pinterest Pin.** `pinterest.product_tags` on `create_post`, `create_and_publish_post` and `update_post` takes up to 24 product Pins of the connected Pinterest account (Pin IDs or Pin links), so people can shop the items in the image. Pinterest accepts a product only when its Pin is public, belongs to the same account and links to a website that account claimed; products of other merchants cannot be tagged. The tags are added right after the Pin is published. A product that Pinterest refuses never fails the post: the other products are still tagged, and `get_post` shows the outcome (`product_tags_result`, with Pinterest's reason for each product that was not tagged).
+- **Added: `list_pinterest_products`.** New tool that lists the product Pins of the connected Pinterest account, with the `pin_id` to use in `pinterest.product_tags`. `source` `catalog` reads the Pinterest catalog (price and stock included) and needs catalog access, which the user gives one time in the OmniSocials composer (Pinterest options, Add products, Connect catalog). `source` `pins` reads the account's own Pins and works on every connection. `check_pin` checks one Pin ID or Pin link instead of listing.
+
+### 1.38.0 (2026-10-02)
+
+- **Added: read the approval review of a post.** New tool `get_post_approval` returns the review of a post that went through an approval workflow: every step with its approvers and their decisions, the rejection (who, when and the reason) and the comment thread, oldest first. Until now the tools only gave the status, so an assistant saw `rejected` and not who rejected the post or why. Use it on a rejected post to learn what to change before sending it again, or on a post that waits for approval to see who it waits for and what the reviewers wrote. Read-only. A post without an approval workflow returns status `none`. Backed by `GET /posts/{id}/approval` (scope `posts:read`). Same on the companion server (`mcp.omnisocials.com`).
+- **Added: webhook events `post.approved` and `post.rejected`.** `create_webhook` and `update_webhook` take them next to `post.scheduled`, `post.published` and `post.failed`. `post.approved` fires when the last step of a post's approval workflow is approved (the post moves to `scheduled`, or `posting` when its publish time already passed). `post.rejected` fires when an approver rejects the post (it will not publish). Both carry one more object, `data.approval`: `{ status, decided_by, reason }` (`reason` is `null` on an approval and when the approver gave none), and their `targets` array is empty. Same on the companion server.
+- **Changed: more approval emails.** A rejection, a reviewer comment, a reviewer edit and the final approval now email the person who requested the approval, and the requester's reply in the review thread emails the reviewers. A post that still waits for approval gets automatic emails near its publish time: the reviewers 24 hours before, and the reviewers plus the requester when the time passes (the post did not publish; a late approval publishes it at once). No tool input or output changed for this.
+- **Changed: X link-post credits count only `http://` and `https://` links.** A post that names a website without a scheme (`brand.com`, `www.brand.com`) no longer uses credits and no longer returns the `x_url_post_credits` warning, because X does not bill it as a link post. A post with a full link still uses 20 credits. The descriptions of `create_post` and `create_and_publish_post` say which links count. Same on the companion server.
+
+### 1.37.1 (2026-09-30)
+
+- **Changed: Facebook Reels longer than 90 seconds are accepted.** The API no longer refuses a Facebook Reel over 90 seconds at submit: a Reel now follows the 240 minute ceiling of a Facebook feed video. Meta removed the Reel length limit in June 2025 (every Facebook video is a reel now), while its Reels Publishing API guide still lists 3 to 90 seconds. A 3 minute Reel published through the API on 2026-09-30, and Reels of 91 to 117 seconds published before the cap existed. The `create_post` and `create_and_publish_post` descriptions no longer tell the assistant to keep a Facebook Reel under 90 seconds. If Facebook refuses a length at publish time, the Facebook target fails with "Facebook did not accept the length of this video..." and the video can go out as a regular Facebook post (`type: "post"`). Same on the companion server.
+- **Changed: `video_cover` on YouTube Shorts is described as channel-dependent.** YouTube shows the cover on Shorts only on channels where it has enabled custom Shorts thumbnails (rolling out since July 2026, Partner Program channels first); on other channels it stores the cover as the default thumbnail but shows a frame from the video (checked on 15 published Shorts from 5 channels: 3 channels show it, 1 does not). The `video_cover` and `youtube` descriptions now say so, so the assistant says it depends on the channel instead of promising it. The image is now sent at up to 1080 x 1920, YouTube's Shorts thumbnail size. Same on the companion server.
+- **Companion server: `video_cover` added.** The hosted server now accepts `video_cover` on `create_post`, `create_and_publish_post` and `update_post` (`null` removes it), takes `facebook.thumbnail_type` / `thumb_offset` / `cover_url`, and lists the cover under Platform Options in `get_post`. This package has had them since 1.35.0.
+
+### 1.37.0 (2026-09-28)
+
+- **Added: the original PDF is kept, and LinkedIn receives it.** `upload_media` (url, base64 and the `upload_url` snippet) still splits a PDF into one image slide per page (max 20) and now also keeps the original file. When a LinkedIn post's `media_ids` are exactly that PDF's slides, in order and unchanged, LinkedIn receives the original file as the document: text stays sharp, in-document links work, viewers download the real file, and every page is included even past the 20-slide cap. The upload result names the kept file (`pdf.id`, `pdf.name`, `pdf.url`, `pdf.size_bytes`), the tool output says so, and every slide returned by `list_media` / `get_media` carries `pdf: { id, name, url, page, total_pages, rendered_pages }`. Same on the companion server (`mcp.omnisocials.com`).
+- **Added: `pdf_mode` on `upload_media`.** `"slides"` (default) keeps one image media item per page, one Media ID each. `"document"` keeps the PDF as ONE media item (`type: "document"`, its page images in `pdf.pages`); pass its single Media ID in `media_ids` and the post gets every page, in order. The tool output explains which shape came back, and `list_media` shows document items as "Document (PDF, N pages)". Same on the companion server (`mcp.omnisocials.com`), where the `upload_url` snippet takes it as a form field (`-F pdf_mode=document`).
+- **Added: `document_source` on the `linkedin` / `linkedin_page` options** of `create_post`, `create_and_publish_post` and `update_post`. `"original_pdf"` (default) sends the kept original when the images are its unchanged pages; `"slides"` rebuilds the document from the slide images instead (a flattened copy). On `update_post`: `"slides"` sets it, `"original_pdf"`/`null` reverts, omitted keeps the current value. `get_post` prints "document source: rebuilt from the slide images" when a channel opted out. Ignored when the images are not a PDF's pages, when `carousel_as_images` is true, and for 0-1 images, videos and polls. Same on the companion server.
+
+### 1.36.0 (2026-09-24)
+
+- **Added: `reply_to_inbox` takes `message_id`.** Every comment on a post shares one inbox conversation, and the reply endpoint always answered the newest incoming comment on that post, so a reply drafted for one person could land under a different person's comment. Pass `message_id` (the "Message to answer" `#id` from `get_next_unanswered`, or a `#id` from `get_inbox_conversation`) and the reply goes under exactly that comment. Without it the old behaviour is kept for compatibility (newest comment). Ignored for DMs. A `404 not_found` means the id is not an incoming message of that conversation. The tool description and the `get_next_unanswered` output tell the assistant to always pass it for comments. Same on the companion server (`mcp.omnisocials.com`).
+- **Changed: `get_next_unanswered` serves DMs first and no longer drops expired ones.** A customer's Facebook DM ("How do I buy and where please") was never served: DMs older than 24 hours were filtered out and the queue was oldest-first across everything, so a fresh DM sat behind a three-week comment backlog until Meta's reply window closed. The order is now: Instagram/Facebook DMs inside Meta's 24-hour window (the one closing soonest first) and X DMs, then Instagram/Facebook DMs whose window has closed, then comments and mentions oldest first (`order: "newest"` reverses within each group). Each item carries `reply_window: { open, closes_at }` (only Instagram/Facebook DMs have a window; everything else is `open: true, closes_at: null`). When `open` is false the tool prints a warning that OmniSocials cannot reply and that the user must answer from the Instagram or Facebook app (mirrored into the inbox) or skip with `mark_inbox_read`. `list_inbox_conversations` with `unanswered: true` now includes those expired DM conversations too. Same on the companion server.
+- **Changed: `reply_to_inbox` checks the 24-hour window before sending.** A `422 outside_messaging_window` on an Instagram/Facebook DM is now raised before the platform call (it was only mapped from Meta's error afterwards). Nothing is sent, the message names when the window closed, and the tool description tells the assistant not to retry. Same on the companion server.
+- **Changed: `hide_inbox_comment` explains a 502 `hide_not_applied`.** After an Instagram hide or unhide the API reads the comment back and reports Instagram's own `hidden` state. When Instagram accepted the call but the comment is still in the old state, the API answers 502 `hide_not_applied` and the inbox row is left unchanged (a hide had been reported as done while the comment stayed public). This happens with comments Instagram shows under "Comments from Facebook" on a reel that is also shared to Facebook: they live on Facebook and Instagram's hide does not reach them. The tool description tells the assistant to have the user hide it in the Instagram or Facebook app and not retry. Same on the companion server.
+- **Changed: Facebook `reach` is absent, never 0, in `get_post_analytics` and `get_bulk_post_analytics`.** Meta retired Facebook post reach on 2026-06-15 and the replacement metric it documents (`post_total_media_view_unique`) returns 0 for every Page post while views and clicks keep counting, so the API had stored and returned a false 0 for every Facebook post. The key is now left out, and a row collected before 2026-09-27 that still carries `reach: 0` is dropped by the API. The tool description tells the assistant to treat a missing `reach` as "not reported" and to sum reach only over the platforms that carry it (Instagram, LinkedIn, TikTok with the Business API). Same on the companion server (`mcp.omnisocials.com`).
+
+### 1.35.1 (2026-09-22)
+
+- **Changed: `reply_to_inbox` explains a 422 `reply_not_allowed`.** The API answers 422 instead of 502 when the platform refuses replies to an item for good (Facebook `#1705`: comment on a share or boosted copy of the post, or the commenter restricts replies; YouTube: the thread's `canReply` is false). The item is dropped from `get_next_unanswered` automatically; relay it, do not retry.
+- **Changed: `hide_inbox_comment` explains a 422 `cannot_hide`.** Facebook does not let the Page hide some comments (the commenter blocked the Page, their account is deactivated or restricted, or the comment sits on a shared copy of the post); the API now reads the comment back and answers 422 when Facebook's `can_hide` is false, instead of a 502 on every attempt. Retrying never changes it; use `mark_inbox_read` if the item should stop coming up.
+
+### 1.35.0 (2026-09-17)
+
+- **Added: video covers.** `create_post`, `create_and_publish_post` and `update_post` accept `video_cover` for a post whose media is one video: `type: "frame"` with `thumb_offset` (milliseconds into the video) or `type: "custom"` with `cover_url` (JPEG/PNG), plus per-platform `overrides` keyed by platform id (instagram, facebook, linkedin, linkedin_page, tiktok, pinterest, youtube). On `update_post`, `video_cover: null` removes the stored cover. `get_post` shows the cover in use.
+- **Changed: analytics say "not reported" instead of 0.** Metrics a platform never reports at post level (reach on X, saves on Facebook, link clicks on Instagram feed posts, and so on) render as N/A with the reason, and `reach` is null when the platform did not report it, so a zero is never invented.
+- **Changed: `reply_to_inbox` explains a 409 `duplicate_reply`.** The API now refuses the same reply (same text and attachment) sent twice to one comment, or to one DM conversation, within 10 minutes; the tool description tells the assistant that nothing was sent again and to continue with `get_next_unanswered` rather than resend. Guards against a re-invoked tool call after a slow response (a customer's Instagram comment got the identical reply twice, 21 seconds apart).
+
 ### 1.34.1 (2026-09-14)
 
 - **Changed: Threads threads and the Threads inbox are no longer "rolling out".** Meta approved the reply, read-replies and mentions permissions, so `threads.thread_parts` and the Threads inbox work for every Threads connection; accounts connected before 2026-09-14 need a one-time reconnect under Settings -> Organisation -> Workspaces (`400`/`401` errors name the reconnect). Threads location tagging stays rolling out (not approved yet). Same on the companion server.

package/build/client.d.ts

@@ -1,4 +1,4 @@
-import type { Account, AnalyticsOverview, AccountAnalyticsEntry, ApiPost, ApiResponse, ApiVideoCover, AudioSearchResult, BestTimesResult, HashtagSet, LocationSearchResult, MediaCheckResult, MediaCompatibility, MediaFolder, MediaItem, PdfUploadResult, PostAnalytics, PublishPostResult, RecentPlatformPost, RetryPostResult, ApprovePostResult, RejectPostResult, InboxConversation, InboxDeleteResult, InboxMessage, InboxNextUnanswered, Webhook } from "./types.js";
+import type { Account, AnalyticsOverview, AccountAnalyticsEntry, ApiPost, ApiResponse, ApiVideoCover, AudioSearchResult, BestTimesResult, HashtagSet, LocationSearchResult, PinterestProductCheck, PinterestProductsResult, MediaCheckResult, MediaCompatibility, MediaFolder, MediaItem, PdfUploadResult, PostAnalytics, PublishPostResult, RecentPlatformPost, RetryPostResult, ApprovePostResult, RejectPostResult, PostApproval, InboxConversation, InboxDeleteResult, InboxMessage, InboxNextUnanswered, Webhook } from "./types.js";
 export declare function fetchImageAsBase64(url: string): Promise<{
     data: string;
     mimeType: string;
@@ -270,11 +270,19 @@ export declare class OmniSocialsClient {
     retryPost(id: string): Promise<ApiResponse<RetryPostResult>>;
     approvePost(id: string): Promise<ApiResponse<ApprovePostResult>>;
     rejectPost(id: string, comment?: string): Promise<ApiResponse<RejectPostResult>>;
+    getPostApproval(id: string): Promise<ApiResponse<PostApproval>>;
     searchLocations(query?: string, platform?: "instagram" | "threads", coords?: {
         latitude?: number;
         longitude?: number;
     }): Promise<LocationSearchResult>;
     validateLocation(id: string): Promise<ApiResponse<unknown>>;
+    listPinterestProducts(params?: {
+        source?: "catalog" | "pins";
+        product_group_id?: string;
+        bookmark?: string;
+        page_size?: string;
+    }): Promise<PinterestProductsResult>;
+    validatePinterestProduct(id: string): Promise<PinterestProductCheck>;
     searchInstagramAudio(query?: string, type?: "music" | "original_sound"): Promise<AudioSearchResult>;
     listMedia(params?: {
         limit?: string;
@@ -287,6 +295,7 @@ export declare class OmniSocialsClient {
         filename?: string;
         name?: string;
         folder?: string;
+        pdf_mode?: "slides" | "document";
     }): Promise<ApiResponse<MediaItem> & Partial<PdfUploadResult> & {
         compatibility?: MediaCompatibility;
         message?: string;
@@ -297,6 +306,7 @@ export declare class OmniSocialsClient {
         filename?: string;
         name?: string;
         folder?: string;
+        pdf_mode?: "slides" | "document";
     }): Promise<ApiResponse<MediaItem> & Partial<PdfUploadResult> & {
         compatibility?: MediaCompatibility;
         message?: string;
@@ -394,6 +404,7 @@ export declare class OmniSocialsClient {
     markInboxRead(conversationId: string): Promise<ApiResponse<unknown>>;
     replyToInboxConversation(conversationId: string, data: {
         text: string;
+        message_id?: string;
         attachment_url?: string;
         attachment_type?: string;
         include_next?: boolean;

package/build/client.js

@@ -285,6 +285,12 @@ export class OmniSocialsClient {
             ...(comment ? { comment } : {}),
         });
     }
+    // Reads the review of the post's approval workflow: every step with its
+    // approvers and their decisions, the rejection with its reason, and the
+    // comment thread. A post without a workflow answers 200 with status "none".
+    async getPostApproval(id) {
+        return this.request("GET", `/posts/${id}/approval`);
+    }
     // Locations (Instagram or Threads place tagging). NOT the standard
     // envelope; see LocationSearchResult: Instagram's degraded-path `error` is
     // a plain string next to `data`; Threads answers with `locations` and a
@@ -303,6 +309,24 @@ export class OmniSocialsClient {
     async validateLocation(id) {
         return this.request("GET", "/locations/validate", undefined, { id });
     }
+    // Pinterest product Pins (for `pinterest.product_tags`). NOT the standard
+    // envelope; see PinterestProductsResult: `products` on success, a
+    // { code, message } `error` object when the list could not be read.
+    async listPinterestProducts(params) {
+        const query = {};
+        if (params?.source)
+            query.source = params.source;
+        if (params?.product_group_id)
+            query.product_group_id = params.product_group_id;
+        if (params?.bookmark)
+            query.bookmark = params.bookmark;
+        if (params?.page_size)
+            query.page_size = params.page_size;
+        return this.request("GET", "/pinterest/products", undefined, query);
+    }
+    async validatePinterestProduct(id) {
+        return this.request("GET", "/pinterest/products/validate", undefined, { id });
+    }
     // Audio (Instagram Reel music). Same nonstandard string-`error` envelope.
     async searchInstagramAudio(query, type) {
         const params = {};

package/build/index.js

@@ -29,7 +29,7 @@ const sessionState = { activeIndex: 0 };
 const getActiveClient = () => workspaceClients[sessionState.activeIndex].client;
 const server = new McpServer({
     name: "OmniSocials",
-    version: "1.35.0",
+    version: "1.39.0",
 });
 // Register all tools - pass getter function so tools always use the active workspace's client
 registerPostTools(server, getActiveClient);

package/build/metrics.d.ts

@@ -20,9 +20,11 @@ export declare function getImpressions(platform: string, metrics: Metrics): numb
 export declare function getReach(platform: string, metrics: Metrics): number | null;
 /** Post-level metrics a platform can never report: platform -> metric key -> reason. */
 export declare const UNSUPPORTED_POST_METRICS: Record<string, Record<string, string>>;
-/** Reason `metricKey` is unavailable on `platform`, or null when it is available. */
-export declare function unsupportedMetricReason(platform: string, metricKey: string): string | null;
-/** True when the platform can never report `metricKey`; a finite stored value overrides the map. */
+/** Metrics unavailable for some post types only: platform -> content_type -> metric key -> reason. Empty since Facebook reach moved to the platform-wide map. */
+export declare const UNSUPPORTED_POST_METRICS_BY_CONTENT_TYPE: Record<string, Record<string, Record<string, string>>>;
+/** Reason `metricKey` is unavailable on `platform` (refined by `contentType`), or null when it is available. */
+export declare function unsupportedMetricReason(platform: string, metricKey: string, contentType?: string): string | null;
+/** True when the platform can never report `metricKey` for this post; a finite stored value overrides the map. */
 export declare function isMetricUnsupported(platform: string, metricKey: string, metrics?: Metrics): boolean;
 /**
  * Engagement rate as a percentage (0-100), suppressed below the impression

package/build/metrics.js

@@ -129,6 +129,7 @@ export const UNSUPPORTED_POST_METRICS = {
         reach: "X does not report reach, only impressions.",
     },
     facebook: {
+        reach: "Facebook stopped reporting post reach in June 2026: Meta retired the metric and its replacement returns no data.",
         saves: "Facebook does not report saves.",
     },
     instagram: {
@@ -190,13 +191,19 @@ export const UNSUPPORTED_POST_METRICS = {
         engagement_rate: "Google discontinued per-post metrics for Business Profiles in 2023.",
     },
 };
-/** Reason `metricKey` is unavailable on `platform`, or null when it is available. */
-export function unsupportedMetricReason(platform, metricKey) {
+/** Metrics unavailable for some post types only: platform -> content_type -> metric key -> reason. Empty since Facebook reach moved to the platform-wide map. */
+export const UNSUPPORTED_POST_METRICS_BY_CONTENT_TYPE = {};
+/** Reason `metricKey` is unavailable on `platform` (refined by `contentType`), or null when it is available. */
+export function unsupportedMetricReason(platform, metricKey, contentType) {
+    const typed = contentType ? UNSUPPORTED_POST_METRICS_BY_CONTENT_TYPE[platform]?.[contentType]?.[metricKey] : undefined;
+    if (typed)
+        return typed;
     return UNSUPPORTED_POST_METRICS[platform]?.[metricKey] ?? null;
 }
-/** True when the platform can never report `metricKey`; a finite stored value overrides the map. */
+/** True when the platform can never report `metricKey` for this post; a finite stored value overrides the map. */
 export function isMetricUnsupported(platform, metricKey, metrics) {
-    if (!unsupportedMetricReason(platform, metricKey))
+    const contentType = typeof metrics?.content_type === "string" ? metrics.content_type : undefined;
+    if (!unsupportedMetricReason(platform, metricKey, contentType))
         return false;
     if (metrics && finiteOrNull(metrics[metricKey]) !== null)
         return false;

package/build/tools/analytics.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { formatNumber, capitalize, metricRows, metricBreakdownRows, sortMetricLabels } from "../client.js";
 import { getEngagement, getImpressions, getEngagementRate, MIN_IMPRESSIONS_FOR_ENGAGEMENT_RATE, } from "../metrics.js";
 export function registerAnalyticsTools(server, getClient) {
-    server.tool("get_post_analytics", "Get analytics/statistics for a specific published post. Renders every metric the platform reported per platform: impressions, reach, views, saves, likes, comments, shares, clicks, link_clicks, engagements, and more. A missing key means the platform does not report it: reach is absent (not 0) on X, Pinterest, YouTube, Threads, Bluesky and Mastodon; link_clicks (clicks on links in the post) exists for X posts under 30 days, LinkedIn profile, Facebook feed posts, Pinterest and Instagram stories, while clicks is the platform's broadest click count. TikTok videos also carry average_time_watched, full_video_watched_rate, total_time_watched, favorites and reach when the workspace enabled TikTok comments (Business API authorization).", {
+    server.tool("get_post_analytics", "Get analytics/statistics for a specific published post. Renders every metric the platform reported per platform: impressions, reach, views, saves, likes, comments, shares, clicks, link_clicks, engagements, and more. A missing key means the platform does not report it: reach is absent (not 0) on X, Pinterest, YouTube, Threads, Bluesky, Mastodon and Facebook (Meta retired Facebook post reach in June 2026 and its replacement metric returns no data; a Facebook row collected before 2026-09-27 may still carry reach: 0, treat it as absent); link_clicks (clicks on links in the post) exists for X posts under 30 days, LinkedIn profile, Facebook feed posts, Pinterest and Instagram stories, while clicks is the platform's broadest click count. TikTok videos also carry average_time_watched, full_video_watched_rate, total_time_watched, favorites and reach when the workspace enabled TikTok comments (Business API authorization).", {
         post_id: z.string().describe("The numeric OmniSocials post id (the `id` field from list_posts). NOT a platform post id such as a YouTube video id or tweet id."),
     }, { title: "Get Post Analytics", readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async ({ post_id }) => {
         const result = await getClient().getPostAnalytics(post_id);

package/build/tools/inbox.js

@@ -80,11 +80,15 @@ function renderNextUnanswered(result) {
     const c = item.conversation;
     const who = c.participant?.name || c.participant?.username || "Unknown";
     let md = `## Next: ${PLATFORM_EMOJI[c.platform] || ""} ${c.platform} ${c.type} from ${who}\n\n`;
-    md += `Conversation ID: \`${c.conversation_id}\`\nMessage to answer: \`#${item.message.id}\`\n\n`;
+    md += `Conversation ID: \`${c.conversation_id}\`\nMessage to answer: \`#${item.message.id}\` (pass it as message_id when replying)\n\n`;
+    if (item.reply_window?.open === false) {
+        const app = c.platform === "instagram" ? "Instagram" : "Facebook";
+        md += `⚠️ **Meta's 24-hour reply window for this DM closed ${formatDateTime(item.reply_window.closes_at)}.** OmniSocials cannot send a reply here (reply_to_inbox answers 422 outside_messaging_window). Tell the user to answer it from the ${app} app; that reply is mirrored into the inbox and clears this item. Or mark_inbox_read to skip it.\n\n`;
+    }
     md += renderInboxPost(item.message.post || c.post);
     md += renderInboxMessages(item.messages, item.message.id);
     md += `_${result.remaining || 0} more waiting._\n\n`;
-    md += `_Reply: reply_to_inbox with the conversation ID (add include_next: true to get the next one in the same call). Skip for good: mark_inbox_read. Comments: hide_inbox_comment / delete_inbox_comment with the message id._`;
+    md += `_Reply: reply_to_inbox with the conversation ID and message_id: "${item.message.id}" (add include_next: true to get the next one in the same call). Skip for good: mark_inbox_read. Comments: hide_inbox_comment / delete_inbox_comment with the message id._`;
     return md;
 }
 export function registerInboxTools(server, getClient) {
@@ -104,7 +108,7 @@ export function registerInboxTools(server, getClient) {
         unanswered: z
             .boolean()
             .optional()
-            .describe("Only conversations that still need an answer: the customer's latest DM has no reply after it (Instagram/Facebook DMs within the 24-hour reply window), or a comment/mention nobody replied to and that is not hidden. Replies typed in the native apps count as answers."),
+            .describe("Only conversations that still need an answer: the customer's latest DM has no reply after it (Instagram/Facebook DMs past the 24-hour reply window included; they cannot be answered through the API but the customer is still waiting), or a comment/mention nobody replied to and that is not hidden. Replies typed in the native apps count as answers."),
         limit: z
             .number()
             .optional()
@@ -201,8 +205,12 @@ export function registerInboxTools(server, getClient) {
             ],
         };
     });
-    server.tool("reply_to_inbox", "Reply to an existing inbox conversation (DM, comment, or mention) on Instagram, Facebook, LinkedIn, TikTok, YouTube, X, or Threads. You can only reply to conversations that already exist. Meta direct-message replies must be within the platform's 24-hour messaging window. TikTok replies are comments only, text-only, and capped at 150 characters; they can take a few minutes to appear on TikTok while they pass spam review. YouTube replies are comments only. Threads replies are on the workspace's posts and mentions; a 401 reauth_required means the Threads connection must be reconnected to grant the reply permission. X replies are DM-only and use 2 prepaid credits per send (X's API fee passed through at cost); a 402 insufficient_credits error means the organisation needs to top up at https://app.omnisocials.com/credits; relay that link to the user rather than retrying. Each workspace can send up to 1,000 replies per day. attachment_url/attachment_type let you send media on a Facebook or Instagram DM (text is optional when an attachment is set); other platforms are text-only. Set include_next: true to get the next conversation that needs an answer back in the same call (same as get_next_unanswered), so the inbox can be worked through as: get_next_unanswered → draft → reply_to_inbox(include_next) → draft → repeat.", {
+    server.tool("reply_to_inbox", "Reply to an existing inbox conversation (DM, comment, or mention) on Instagram, Facebook, LinkedIn, TikTok, YouTube, X, or Threads. You can only reply to conversations that already exist. For a comment or mention, pass message_id (the #id of the comment being answered): comments on one post share a conversation and without it the reply goes under the newest comment on the post. Meta direct-message replies must be within the platform's 24-hour messaging window: a 422 outside_messaging_window means the window has closed, nothing was sent, and the user must answer that DM from the Instagram or Facebook app (mirrored into the inbox) or skip it with mark_inbox_read; do not retry. TikTok replies are comments only, text-only, and capped at 150 characters; they can take a few minutes to appear on TikTok while they pass spam review. YouTube replies are comments only. Threads replies are on the workspace's posts and mentions; a 401 reauth_required means the Threads connection must be reconnected to grant the reply permission. X replies are DM-only and use 2 prepaid credits per send (X's API fee passed through at cost); a 402 insufficient_credits error means the organisation needs to top up at https://app.omnisocials.com/credits; relay that link to the user rather than retrying. Each workspace can send up to 1,000 replies per day. attachment_url/attachment_type let you send media on a Facebook or Instagram DM (text is optional when an attachment is set); other platforms are text-only. Set include_next: true to get the next conversation that needs an answer back in the same call (same as get_next_unanswered), so the inbox can be worked through as: get_next_unanswered → draft → reply_to_inbox(include_next) → draft → repeat. A 409 duplicate_reply means this exact reply already went out to this conversation in the last 10 minutes (an earlier call that looked slow or failed did succeed) or is being sent right now: nothing was sent again, do NOT retry it — continue with get_next_unanswered. A 422 reply_not_allowed means the platform refuses replies to this item for good (Facebook #1705: the comment sits on a share or boosted copy of the post, or the commenter restricts replies; YouTube: the thread's canReply is false because comments are off on the video or the comment was removed or held for review): the item is dropped from get_next_unanswered automatically, tell the user, and do NOT retry.", {
         conversation_id: z.string().describe("The conversation ID to reply to"),
+        message_id: z
+            .string()
+            .optional()
+            .describe("For comment/mention threads: the inbox id of the comment you are answering (the 'Message to answer' #id from get_next_unanswered, or a #id from get_inbox_conversation). Every comment on a post shares one conversation, so without it the reply is posted under the newest comment on the post, which can be a different person than the one you drafted for. Always pass it for comments. Ignored for DMs."),
         text: z
             .string()
             .optional()
@@ -219,9 +227,10 @@ export function registerInboxTools(server, getClient) {
             .boolean()
             .optional()
             .describe("After sending, also return the next conversation that needs an answer (full thread + post context), or 'nothing waiting'"),
-    }, { title: "Reply to Inbox Message", readOnlyHint: false, destructiveHint: true, openWorldHint: true }, async ({ conversation_id, text, attachment_url, attachment_type, include_next }) => {
+    }, { title: "Reply to Inbox Message", readOnlyHint: false, destructiveHint: true, openWorldHint: true }, async ({ conversation_id, message_id, text, attachment_url, attachment_type, include_next }) => {
         const result = await getClient().replyToInboxConversation(conversation_id, {
             text: text ?? "",
+            ...(message_id ? { message_id } : {}),
             attachment_url,
             attachment_type,
             ...(include_next ? { include_next: true } : {}),
@@ -240,7 +249,7 @@ export function registerInboxTools(server, getClient) {
         }
         return { content: [{ type: "text", text: md }] };
     });
-    server.tool("get_next_unanswered", "Get the next inbox item that needs an answer, with the whole conversation and the post it is on, in one call. Serves the longest-waiting item first: the customer's latest DM with no reply after it (Instagram/Facebook DMs within the 24-hour reply window only, since Meta refuses later replies), or a comment/mention nobody replied to and that is not hidden. Replies typed in the native apps count as answered (they are mirrored into the inbox), so a thread a colleague answered on their phone is not served again. Instagram mentions are skipped (no reply path). Only unread items are served by default: to skip one for good, mark_inbox_read it; pass include_read to also see read-but-unanswered items. Looks back 30 days. Loop: get_next_unanswered → draft a reply → reply_to_inbox with include_next: true → repeat until nothing is waiting.", {
+    server.tool("get_next_unanswered", "Get the next inbox item that needs an answer, with the whole conversation and the post it is on, in one call. An item needs an answer when it is the customer's latest DM with no reply after it, or a comment/mention nobody replied to and that is not hidden. Order: DMs that can still be answered first (Instagram/Facebook DMs inside Meta's 24-hour window, the one closing soonest first, plus X DMs), then Instagram/Facebook DMs whose window has closed (reply_window.open = false: OmniSocials cannot reply, tell the user to answer from the native app or skip with mark_inbox_read), then comments and mentions, oldest first. Replies typed in the native apps count as answered (they are mirrored into the inbox), so a thread a colleague answered on their phone is not served again. Instagram mentions are skipped (no reply path). Only unread items are served by default: to skip one for good, mark_inbox_read it; pass include_read to also see read-but-unanswered items. Looks back 30 days. Loop: get_next_unanswered → draft a reply → reply_to_inbox with the conversation id, message_id = the served message's #id, and include_next: true → repeat until nothing is waiting.", {
         platform: z
             .enum(INBOX_PLATFORMS)
             .optional()
@@ -252,7 +261,7 @@ export function registerInboxTools(server, getClient) {
         order: z
             .enum(["oldest", "newest"])
             .optional()
-            .describe("oldest (default): the item that has waited longest first; newest: the most recent first"),
+            .describe("oldest (default): the item that has waited longest first; newest: the most recent first. Applies within each group (answerable DMs, then expired Instagram/Facebook DMs, then comments); the groups keep their order"),
         include_read: z
             .boolean()
             .optional()
@@ -307,7 +316,7 @@ export function registerInboxTools(server, getClient) {
             ],
         };
     };
-    server.tool("hide_inbox_comment", "Hide (or unhide) a comment someone left on one of the workspace's posts, on the platform, as the post owner. Facebook, Instagram, TikTok, YouTube and Threads comments. On YouTube, hide sets the comment to 'rejected' (removed from public view together with its replies) and unhide publishes it again. Takes the message id (the #id shown by get_inbox_conversation and get_next_unanswered), not the conversation id. A hidden comment no longer counts as unanswered. If the comment was already deleted on the platform (its author removed it, etc.), this still succeeds — the response says so — and the item is marked handled; do not retry it. A 403 reconnect_required means the account was connected without the comment-moderation permission and must be reconnected in the dashboard; relay that to the user rather than retrying.", hideCommentSchema, { title: "Hide Inbox Comment", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, hideComment);
+    server.tool("hide_inbox_comment", "Hide (or unhide) a comment someone left on one of the workspace's posts, on the platform, as the post owner. Facebook, Instagram, TikTok, YouTube and Threads comments. On YouTube, hide sets the comment to 'rejected' (removed from public view together with its replies) and unhide publishes it again. Takes the message id (the #id shown by get_inbox_conversation and get_next_unanswered), not the conversation id. A hidden comment no longer counts as unanswered. If the comment was already deleted on the platform (its author removed it, etc.), this still succeeds — the response says so — and the item is marked handled; do not retry it. A 403 reconnect_required means the account was connected without the comment-moderation permission and must be reconnected in the dashboard; relay that to the user rather than retrying. A 422 cannot_hide means Facebook does not let the Page hide this particular comment (the commenter blocked the Page, their account is deactivated or restricted, or the comment sits on a shared copy of the post): retrying never changes it — tell the user, and use mark_inbox_read on the conversation if it should stop coming up. A 502 hide_not_applied means Instagram accepted the call but still reports the comment as visible (this happens with comments shown under 'Comments from Facebook' on a reel shared to Facebook; they live on Facebook and Instagram's hide does not reach them): nothing changed in the inbox, tell the user to hide it in the Instagram or Facebook app, do not retry.", hideCommentSchema, { title: "Hide Inbox Comment", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, hideComment);
     // Older name from 1.28.0 (when hiding was Threads-only). Kept so existing
     // setups keep working; same call, same platforms as hide_inbox_comment.
     server.tool("hide_inbox_reply", "Older name for hide_inbox_comment, kept so existing setups keep working; prefer hide_inbox_comment. Same behaviour: hide (or unhide with hide: false) a comment someone left on one of the workspace's posts, as the post owner, on Facebook, Instagram, TikTok, YouTube or Threads. Takes the message id (the #id in the thread), not the conversation id. A 403 reconnect_required means the account must be reconnected in the dashboard to grant the comment-moderation permission.", hideCommentSchema, { title: "Hide Inbox Comment (older name)", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, hideComment);

package/build/tools/media.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { fetchImageAsBase64, formatBytes } from "../client.js";
 export function registerMediaTools(server, getClient) {
-    server.tool("list_media", "List media files in the workspace. Returns each file's ID, name, folder, type (image/video), and size. To reuse an existing graphic, SEARCH for it by name here FIRST instead of re-uploading — re-uploading the same image creates duplicates. Media IDs from this list can be passed to create_post. Organize assets into folders with create_folder / list_folders.", {
+    server.tool("list_media", "List media files in the workspace. Returns each file's ID, name, folder, type (image/video/document — a document is a PDF kept as one item; its ID in media_ids expands into every page), and size. To reuse an existing graphic, SEARCH for it by name here FIRST instead of re-uploading — re-uploading the same image creates duplicates. Media IDs from this list can be passed to create_post. Organize assets into folders with create_folder / list_folders.", {
         limit: z.string().optional().describe("Max results to return"),
         offset: z.string().optional().describe("Offset for pagination"),
         search: z.string().optional().describe('Find a file by name or filename, e.g. "play5get50". Use this before uploading to check if the graphic already exists.'),
@@ -30,7 +30,16 @@ export function registerMediaTools(server, getClient) {
             // `type` may be "video"/"image" (normalized) or a raw MIME like "video/mp4".
             const rawType = typeof m.type === "string" ? m.type : "";
             const isVideo = rawType === "video" || rawType.startsWith("video/");
-            const type = isVideo ? "Video" : "Image";
+            const isDocument = rawType === "document";
+            // A PDF document item names its page count (pass its ONE id and the
+            // post gets every page); a slide rendered from a PDF names its file
+            // and page, so the assistant can pass the whole deck in order.
+            const pdfTag = m.pdf
+                ? isDocument
+                    ? ` (PDF, ${Array.isArray(m.pdf.pages) ? m.pdf.pages.length : m.pdf.rendered_pages} pages)`
+                    : ` (PDF ${m.pdf.name ? `"${m.pdf.name}" ` : ""}page ${m.pdf.page}/${m.pdf.total_pages})`
+                : "";
+            const type = (isVideo ? "Video" : isDocument ? "Document" : "Image") + pdfTag;
             const folder = m.folder_id ? `\`${m.folder_id}\`` : "—";
             md += `| ${i + 1} | ${type} | ${m.name || m.filename || "—"} | ${folder} | ${(m.size || "—")} | \`${m.id}\` |\n`;
         }
@@ -57,7 +66,7 @@ export function registerMediaTools(server, getClient) {
     });
     server.tool("upload_media", `Upload media to the library. Accepts EITHER a public URL OR base64-encoded image data (e.g. when the user pastes an image directly in chat). Supported: JPEG, PNG, GIF, WebP, MP4, MOV, AVI, and PDF.
 
-PDF = carousel: upload a PDF (as a 'url' or as base64_data with mime_type "application/pdf") and it is split into one image slide per page (max 20 pages). The response lists a Media ID for every slide — pass ALL of them, in order, as media_ids to create_post to post the deck as a carousel. On LinkedIn the slides post as a native swipeable DOCUMENT; on Instagram, TikTok, Threads and Pinterest as an image carousel. This is the way to let a user post an existing slide deck (Canva/PowerPoint/Figma exported to PDF) as a carousel.
+PDF = carousel: upload a PDF (as a 'url' or as base64_data with mime_type "application/pdf") and it is split into one image slide per page (max 20 pages). The response lists a Media ID for every slide — pass ALL of them, in order, as media_ids to create_post to post the deck as a carousel. Prefer pdf_mode "document" when the user wants ONE library item for the deck: the response then has a single Media ID whose media_ids entry expands into every page at post time. On LinkedIn the slides post as a native swipeable DOCUMENT made from the ORIGINAL PDF file (the file is kept: text stays sharp, in-document links work, viewers download the real file, and every page is included even past the 20-slide cap) as long as the slides are posted unchanged and in order; on Instagram, TikTok, Threads and Pinterest as an image carousel. Set linkedin.document_source to 'slides' on the post to send a document rebuilt from the slide images instead. This is the way to let a user post an existing slide deck (Canva/PowerPoint/Figma exported to PDF) as a carousel.
 
 Size limits: base64 and direct uploads are capped at 100 MB (and base64 inflates the request body, so the practical ceiling is ~75 MB). For anything larger — up to 1 GB — use ONE of: (a) pass a public 'url' and the server fetches it (handles up to 1 GB), or (b) have the user upload the file in the OmniSocials Library UI at https://app.omnisocials.com/library . IMPORTANT: if the user has a large LOCAL file (over ~100 MB) with no public URL, do NOT tell them to compress or shrink it — instead point them to the Library UI link above, which uploads files up to 1 GB directly.
 
@@ -72,6 +81,7 @@ When the user provides an image in the conversation (not a URL), use base64_data
         filename: z.string().optional().describe("Optional filename for the uploaded media"),
         name: z.string().optional().describe('Human-readable label so you can find this asset by name later instead of re-uploading it, e.g. "pp-play5get50". Strongly recommended on every upload.'),
         folder: z.string().optional().describe('Optional folder name to file this asset under (created at the top level if it does not exist), e.g. "win-graphics". See list_folders.'),
+        pdf_mode: z.enum(["slides", "document"]).optional().describe('PDF uploads only. "slides" (default): one image media item per page, one Media ID each (pass ALL of media_ids to create_post). "document": ONE media item for the whole PDF (type "document"); pass its single Media ID in media_ids and the post gets every page in order. Both keep the original file, which LinkedIn receives. Prefer "document" when the user wants one library item for the deck.'),
     }, { title: "Upload Media", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, async (params) => {
         let result;
         if (params.base64_data && params.mime_type) {
@@ -81,10 +91,17 @@ When the user provides an image in the conversation (not a URL), use base64_data
                 filename: params.filename,
                 name: params.name || params.filename,
                 folder: params.folder,
+                ...(params.pdf_mode ? { pdf_mode: params.pdf_mode } : {}),
             });
         }
         else if (params.url) {
-            result = await getClient().uploadMedia({ url: params.url, filename: params.filename, name: params.name || params.filename, folder: params.folder });
+            result = await getClient().uploadMedia({
+                url: params.url,
+                filename: params.filename,
+                name: params.name || params.filename,
+                folder: params.folder,
+                ...(params.pdf_mode ? { pdf_mode: params.pdf_mode } : {}),
+            });
         }
         else {
             return {
@@ -97,6 +114,23 @@ When the user provides an image in the conversation (not a URL), use base64_data
             };
         }
         const compatibility = result.compatibility;
+        // PDF kept as ONE document item (pdf_mode "document").
+        if (result.data?.type === "document" && result.pdf) {
+            const d = result.data;
+            const pdfInfo = result.pdf;
+            const pageCount = Array.isArray(d.pdf?.pages) ? d.pdf.pages.length : pdfInfo.rendered_pages;
+            let md = `## PDF Uploaded as One Document\n\n`;
+            md += `**${d.name || pdfInfo.name || "document.pdf"}**, ${pageCount} ${pageCount === 1 ? "page" : "pages"}`;
+            if (pdfInfo.truncated)
+                md += ` (${pdfInfo.total_pages} in the file; the first ${pdfInfo.rendered_pages} became page images)`;
+            md += `.\n\n**Media ID:** \`${d.id}\`\n\n`;
+            md += `Pass this ONE id in \`create_post\` as \`media_ids: ["${d.id}"]\`; the post gets every page, in order. `;
+            md += `On LinkedIn it posts as a swipeable **document** made from the **original PDF file** (sharp text, working links, the real download); on Instagram, TikTok, Threads and Pinterest as an **image** carousel. Platforms that do not support carousels use the first page.`;
+            if (compatibility && compatibility.compatible === false && compatibility.summary) {
+                md += `\n\n⚠️ **${compatibility.summary}** It will still post to your other connected platforms. Ask the user whether to continue before posting.`;
+            }
+            return { content: [{ type: "text", text: md }] };
+        }
         // PDF upload: the server split it into image slides. Surface every slide
         // id and tell the model to pass them ALL to create_post as one carousel.
         const mediaIds = result.media_ids;
@@ -115,7 +149,7 @@ When the user provides an image in the conversation (not a URL), use base64_data
             });
             md += `\n**Pass ALL of these to \`create_post\` as \`media_ids\`, in this order**, to post the deck as a carousel:\n\n`;
             md += `\`\`\`\nmedia_ids: [${mediaIds.map((id) => `"${id}"`).join(", ")}]\n\`\`\`\n\n`;
-            md += `On LinkedIn this posts as a swipeable **document** carousel; on Instagram, TikTok, Threads and Pinterest as an **image** carousel. Platforms that do not support carousels use the first slide.`;
+            md += `On LinkedIn this posts as a swipeable **document** carousel made from the **original PDF file** (kept in storage: sharp text, working links, the real download${pdf?.truncated ? `, all ${pdf.total_pages} pages` : ""}) as long as the slides are posted unchanged and in order; on Instagram, TikTok, Threads and Pinterest as an **image** carousel. Platforms that do not support carousels use the first slide. To send a document rebuilt from the slide images instead, set linkedin.document_source to "slides" on the post.`;
             if (compatibility && compatibility.compatible === false && compatibility.summary) {
                 md += `\n\n⚠️ **${compatibility.summary}** It will still post to your other connected platforms. Ask the user whether to continue before posting.`;
             }

package/build/tools/posts.js

@@ -88,7 +88,7 @@ const VIDEO_COVER_OPTIONS = VIDEO_COVER_ENTRY.extend({
         .describe("Per-platform overrides keyed by platform id (instagram, facebook, linkedin, linkedin_page, tiktok, pinterest, youtube). An override wins over the base cover for that platform."),
 })
     .optional()
-    .describe("Video thumbnail for a post whose media is ONE video. Applied on Instagram (feed videos and reels), Facebook (feed videos and reels), LinkedIn Profile and Page, TikTok, Pinterest and YouTube Shorts. TikTok only takes a frame: a 'custom' cover is skipped there, so add a tiktok override with type 'frame' when the user wants a specific TikTok frame. The per-platform reel fields (instagram.thumb_offset / cover_url, tiktok.video_cover_timestamp_ms, pinterest.video_cover) keep working and win over the base cover for their platform. get_post reads it back as `video_cover`.");
+    .describe("Video thumbnail for a post whose media is ONE video. Applied on Instagram (feed videos and reels), Facebook (feed videos and reels), LinkedIn Profile and Page, TikTok, Pinterest and YouTube Shorts. YouTube Shorts: the cover shows on Shorts only on channels where YouTube has enabled custom Shorts thumbnails (rolling out since July 2026, Partner Program channels first); on other channels YouTube stores it as the default thumbnail but shows a frame from the video on Shorts. Say that it depends on the channel; do not promise it. TikTok only takes a frame: a 'custom' cover is skipped there, so add a tiktok override with type 'frame' when the user wants a specific TikTok frame. The per-platform reel fields (instagram.thumb_offset / cover_url, tiktok.video_cover_timestamp_ms, pinterest.video_cover) keep working and win over the base cover for their platform. get_post reads it back as `video_cover`.");
 const LINKEDIN_OPTIONS = z
     .object({
     first_comment: z
@@ -101,6 +101,11 @@ const LINKEDIN_OPTIONS = z
         .nullable()
         .optional()
         .describe("Multi-image style for the profile post. By default 2+ images publish as LinkedIn's swipeable PDF document carousel; true publishes them as a plain multi-image gallery instead. Ignored for 0-1 images, videos, and polls. On update_post: true sets it, false/null reverts to the document carousel, omitted keeps the current value."),
+    document_source: z
+        .enum(["original_pdf", "slides"])
+        .nullable()
+        .optional()
+        .describe("Where the profile post's document carousel comes from when its images are exactly the rendered pages of one uploaded PDF (unchanged, in order). 'original_pdf' (default): LinkedIn receives the kept original PDF file: sharp text, working in-document links, the real download, every page even past the 20-slide cap. 'slides': rebuild the document from the slide images (a flattened copy). Ignored when the images are not a PDF's pages, when carousel_as_images is true, for 0-1 images, videos and polls. On update_post: 'slides' sets it, 'original_pdf'/null reverts to the default, omitted keeps the current value."),
 })
     .optional()
     .describe("LinkedIn Profile options");
@@ -116,6 +121,11 @@ const LINKEDIN_PAGE_OPTIONS = z
         .nullable()
         .optional()
         .describe("Multi-image style for the company-page post. By default 2+ images publish as LinkedIn's swipeable PDF document carousel; true publishes them as a plain multi-image gallery instead. Ignored for 0-1 images, videos, and polls. On update_post: true sets it, false/null reverts to the document carousel, omitted keeps the current value."),
+    document_source: z
+        .enum(["original_pdf", "slides"])
+        .nullable()
+        .optional()
+        .describe("Same as linkedin.document_source, for the company-page post: 'original_pdf' (default) sends the kept original PDF when the images are its unchanged pages; 'slides' rebuilds the document from the slide images. On update_post: 'slides' sets it, 'original_pdf'/null reverts, omitted keeps the current value."),
 })
     .optional()
     .describe("LinkedIn Company Page options");
@@ -174,6 +184,7 @@ const PINTEREST_OPTIONS = z.object({
     link: z.string().optional().describe("Destination URL the pin clicks through to"),
     video_cover: z.string().optional().describe("Cover image URL for video pins (JPEG/PNG). Falls back to a video keyframe if omitted."),
     alt_text: z.string().optional().describe("Accessibility alt text for the pin image (max 500 characters)"),
+    product_tags: z.array(z.string()).max(24).optional().describe("Products to tag on the Pin, so people can shop the items in the image. Up to 24 product Pins of the connected Pinterest account, each as a Pin ID string or a Pin link (https://www.pinterest.com/pin/<id>/). Get the IDs with list_pinterest_products. Only the account's own product Pins can be tagged (public, with a link on a website the account claimed on Pinterest); products of other merchants cannot. The tags are added right after the Pin is published; a product Pinterest refuses never fails the post, and get_post shows the outcome (product_tags_result). On update_post the pinterest object replaces the stored one, so leave product_tags out to remove the tags."),
 }).optional().describe("Pinterest-specific options. Attach 2–5 images via media_urls.pinterest (or default) to publish a single carousel pin instead of separate pins. More than 5 images is rejected with a 400 validation_error at create/schedule time — carousels hard-cap at 5. Carousel slides MUST share the same aspect ratio (1% tolerance) — the API returns 400 validation_error with `mismatched_slides: [n, ...]` if you pass mixed-ratio images and try to schedule or publish. Drafts are exempt so you can iterate.");
 // One Instagram photo tag. The wrapping z.array(...).describe(...) stays
 // per-tool because update_post documents replace/clear semantics.
@@ -627,6 +638,18 @@ export function registerPostTools(server, getClient) {
             optionRows.push(["Pinterest title", pin.title]);
         if (typeof pin.link === "string" && pin.link)
             optionRows.push(["Pinterest link", pin.link]);
+        if (Array.isArray(pin.product_tags) && pin.product_tags.length) {
+            optionRows.push(["Pinterest product tags", pin.product_tags.join(", ")]);
+        }
+        // Outcome of the tag step, written after the Pin is live.
+        const tagResult = pin.product_tags_result;
+        if (tagResult && typeof tagResult === "object") {
+            const skipped = (tagResult.skipped || []).map((item) => `${item.pin_id} ${item.reason}`).join(", ");
+            optionRows.push([
+                "Pinterest products tagged",
+                `${(tagResult.tagged || []).length} of ${tagResult.requested ?? 0}${skipped ? ` (not tagged: ${skipped})` : ""}${tagResult.error ? ` (Pinterest: ${tagResult.error})` : ""}`,
+            ]);
+        }
         // Cross-platform video cover (base + per-platform overrides).
         const describeCover = (c) => {
             if (!c || typeof c !== "object")
@@ -662,15 +685,20 @@ export function registerPostTools(server, getClient) {
             for (const [k, v] of optionRows)
                 md += `| ${k} | ${v.replace(/\|/g, "\\|")} |\n`;
         }
-        // LinkedIn multi-image style: nested under each channel's options
-        // object by the API. Only rendered when the post opts out of the
-        // default PDF document carousel.
+        // LinkedIn multi-image style + document source: nested under each
+        // channel's options object by the API. Only rendered when the post
+        // opts out of a default (document carousel; kept original PDF).
         for (const channel of ["linkedin", "linkedin_page"]) {
             const opts = p[channel];
-            if (opts && typeof opts === "object" && opts.carousel_as_images === true) {
-                const label = channel === "linkedin_page" ? "LinkedIn Page" : "LinkedIn Profile";
+            if (!opts || typeof opts !== "object")
+                continue;
+            const label = channel === "linkedin_page" ? "LinkedIn Page" : "LinkedIn Profile";
+            if (opts.carousel_as_images === true) {
                 md += `\n\n**${label} multi-image style:** plain image gallery (default is the swipeable PDF document carousel)\n`;
             }
+            if (opts.document_source === "slides") {
+                md += `\n\n**${label} document source:** rebuilt from the slide images (default sends the kept original PDF when the images are its unchanged pages)\n`;
+            }
         }
         // Trial Reel state: nested under the instagram options object by the
         // API. Only rendered when enabled, so batch-scheduled Trial Reels can be
@@ -729,7 +757,7 @@ IMPORTANT — Before calling this tool, make sure you have all required informat
 
    **Per-platform video caps (duration + size, checked via ffprobe at submit; exceeding either returns a 400 validation_error stating the exact cap and the file's value, e.g. "X only allows videos up to 2min 20s; yours is 2min 35s. Trim the video or deselect X."):**
    - X — **140s (2min 20s)** · **512MB** on free/Basic accounts; when the connected X account has **Premium or Premium+** the caps rise to **125min / 16GB** automatically (tier is read from the connection; reconnect X after upgrading). X also can't mix a video with images in one tweet: a tweet is either 1 video OR up to 4 images
-   - Bluesky 180s · Threads 5min · Instagram 15min · TikTok 10min · YouTube Short 3min · LinkedIn 10min · Pinterest 15min · Facebook Reel 90s
+   - Bluesky 180s · Threads 5min · Instagram 15min · TikTok 10min · YouTube Short 3min · LinkedIn 10min · Pinterest 15min · Facebook 240min (Post + Reel; the old 90s Reel cap is gone)
    Pick a file within the cap up front; if the user's video is over, tell them the limit so they can trim it rather than retrying blindly.
 
    When attaching more than these caps to a selected platform, EITHER trim the array OR move to a flat \`media_urls: [...]\` and let the user know which platform will be over the limit so they can split into multiple posts.
@@ -743,7 +771,7 @@ IMPORTANT — Before calling this tool, make sure you have all required informat
    - TikTok: Privacy level?
    - **X threads vs long-form**: A chained "thread" (the user explicitly asks for one) → pass \`x.thread_parts\` as an array of 2–25 \`{ text }\` objects (each ≤ 280 chars on free/Basic, 25,000 on Premium/Premium+); the \`content\` field is then ignored for X. A single **long-form** post on a Premium / Premium+ account → just put the full text (up to 25,000 chars) in \`content\` — no threading needed (check \`platform_details.subscription_type\` via list_accounts). On free / Basic, X caps a single post at 280 chars, so either split into a thread or shorten. Never cram "1/", "2/" prefixes into \`content\` — that posts one tweet, not a thread.
    - **Bluesky, Mastodon and Threads chains**: the same \`thread_parts\` shape works under \`bluesky\`, \`mastodon\` and \`threads\` (each an array of 2 to 25 \`{ text, media_ids?, media_urls? }\` objects); parts after the first publish as replies to the previous part and \`content\` is then ignored for that platform. Threads: 2 to 25 parts, 500 characters per part, up to 10 media per part (images and videos can be mixed). Bluesky: 300 characters per part, 4 media. Mastodon: 500 characters per part (instance-dependent), 4 media.
-   - **X posts containing a link cost credits**: X's API bills posts whose text contains a URL at a premium, and OmniSocials passes that through as prepaid credits at X's exact rate (20 credits ≈ $0.20 per URL-containing tweet; threads are charged per part that contains a link). The create response includes a \`warnings\` entry (\`x_url_post_credits\`) with the cost and current balance — relay it to the user. Credits are only deducted after the post successfully publishes; a failed publish is never charged. If the balance can't cover it at publish time, only the X target fails (message says to top up at https://app.omnisocials.com/credits) and the post can be retried after topping up. Posts without links stay free — never remove a user's link to dodge the fee without asking them. Scheduling is also gated up front: every scheduled X link post reserves its cost, and a create/schedule that would push the reserved total past the balance is refused with a 402 \`x_credits_insufficient\` error (details carry credits_required / credits_balance / credits_reserved) — tell the user to top up or remove the link, don't silently retry.
+   - **X posts containing a link cost credits**: X's API bills posts whose text contains a URL at a premium, and OmniSocials passes that through as prepaid credits at X's exact rate (20 credits ≈ $0.20 per URL-containing tweet; threads are charged per part that contains a link). Only a link written with http:// or https:// counts; a bare domain (brand.com) or a www. link is free. The create response includes a \`warnings\` entry (\`x_url_post_credits\`) with the cost and current balance — relay it to the user. Credits are only deducted after the post successfully publishes; a failed publish is never charged. If the balance can't cover it at publish time, only the X target fails (message says to top up at https://app.omnisocials.com/credits) and the post can be retried after topping up. Posts without links stay free — never remove a user's link to dodge the fee without asking them. Scheduling is also gated up front: every scheduled X link post reserves its cost, and a create/schedule that would push the reserved total past the balance is refused with a 402 \`x_credits_insufficient\` error (details carry credits_required / credits_balance / credits_reserved) — tell the user to top up or remove the link, don't silently retry.
 
 Do NOT call this tool without media when creating stories, reels, Instagram posts, TikTok posts, or Pinterest posts — it will fail.
 
@@ -754,7 +782,7 @@ Do NOT call this tool without media when creating stories, reels, Instagram post
         media_ids: z.union([
             z.array(mediaIdEntry),
             z.record(z.string(), z.array(mediaIdEntry)),
-        ]).optional().describe("Media IDs from upload — flat array (same for all platforms) or object with platform keys: { default: [...], instagram: [...] }. Each entry is a plain ID string or { id, alt } to attach alt text (accessibility description, max 1500 chars) to that file — delivered to Mastodon, Bluesky, X, Pinterest, Instagram (images) and LinkedIn (images)."),
+        ]).optional().describe("Media IDs from upload — flat array (same for all platforms) or object with platform keys: { default: [...], instagram: [...] }. Each entry is a plain ID string or { id, alt } to attach alt text (accessibility description, max 1500 chars) to that file — delivered to Mastodon, Bluesky, X, Pinterest, Instagram (images) and LinkedIn (images). A media item of type 'document' (a PDF kept as one item) expands into its page images, in order, so one id attaches the whole deck."),
         media_urls: z.union([
             z.array(mediaUrlEntry),
             z.record(z.string(), z.array(mediaUrlEntry)),
@@ -781,7 +809,7 @@ Do NOT call this tool without media when creating stories, reels, Instagram post
             notify_subscribers: z.boolean().optional(),
             contains_synthetic_media: z.boolean().optional(),
             first_comment: z.string().max(10000).optional().describe("Text auto-posted as the first comment on the video right after it publishes. The video must have comments enabled."),
-        }).optional().describe("YouTube Shorts options. Only applies when type is 'reel' and youtube is among the selected channels."),
+        }).optional().describe("YouTube Shorts options. Only applies when type is 'reel' and youtube is among the selected channels. A custom Shorts thumbnail is set with the top-level `video_cover` (a `youtube` override for a YouTube-only image); it shows on Shorts only on channels where YouTube has enabled custom Shorts thumbnails (Partner Program channels first, since July 2026), other channels show a frame from the video."),
         instagram: z.object({
             share_to_feed: z.boolean().optional(),
             thumbnail_type: z.enum(["from-video", "from-library"]).optional().describe("How the Reel cover is chosen: 'from-video' picks a frame at thumb_offset; 'from-library' uses the image at cover_url. get_post reads the chosen cover back."),
@@ -901,10 +929,10 @@ IMPORTANT — Before calling this tool, make sure you have all required informat
    - Pinterest: ALWAYS need an image + board_id.
    - Ask the user which media to use. Use list_media to show options.
    - **Max items per platform** (same caps as create_post — exceeding returns 400): Bluesky/X/Mastodon ≤4, Instagram/Threads ≤10, TikTok ≤35 photos, Pinterest carousel 2–5 same-ratio images. Mixing images+video is rejected on Facebook/LinkedIn/X/Bluesky/Mastodon/TikTok; Instagram and Threads mixed carousels are allowed.
-   - **Video duration/size caps** (ffprobe at submit — over either returns 400 validation_error with the exact cap + the file's value): X **140s/512MB** free/Basic, **125min/16GB** when the connected X account has Premium/Premium+ (auto-detected; no video+image mix in one tweet), Bluesky 180s, Threads 5min, Instagram 15min, TikTok 10min, YouTube Short 3min, LinkedIn 10min, Facebook Reel 90s.
+   - **Video duration/size caps** (ffprobe at submit — over either returns 400 validation_error with the exact cap + the file's value): X **140s/512MB** free/Basic, **125min/16GB** when the connected X account has Premium/Premium+ (auto-detected; no video+image mix in one tweet), Bluesky 180s, Threads 5min, Instagram 15min, TikTok 10min, YouTube Short 3min, LinkedIn 10min, Facebook 240min (Post + Reel; the old 90s Reel cap is gone).
 4. **Pinterest board (auto-default to first board)**: If Pinterest is in \`channels\` and \`pinterest.board_id\` is NOT provided, do NOT block on asking — and do NOT skip Pinterest. Call \`get_account\` on the Pinterest account, take the FIRST board from the returned boards list, and pass its \`id\` as \`pinterest.board_id\`. In your reply, mention which board you used (e.g. "Published to your 'Marketing' board on Pinterest — let me know if you'd prefer a different one.") so the user can redirect. If the user named a specific board in the request, match it (case-insensitive) against the list and use that one instead.
 5. **X threads vs long-form**: A chained "thread" → pass \`x.thread_parts\` as a 2–25 entry array of \`{ text }\` objects (each ≤ 280 chars on free/Basic, 25,000 on Premium/Premium+). A single long-form post on a Premium / Premium+ account → put the full text (up to 25,000 chars) in \`content\`; no threading needed. On free / Basic, X caps a single post at 280 chars. Do NOT split into "1/", "2/" inside \`content\` — that produces a single tweet, not a thread. The same \`thread_parts\` shape works under \`bluesky\`, \`mastodon\` and \`threads\` (Threads: 2 to 25 parts, 500 characters per part, up to 10 media per part; parts after the first publish as replies to the previous part).
-6. **X posts containing a link cost credits**: X bills API posts whose text contains a URL at a premium; OmniSocials passes that through as prepaid credits at X's exact rate (20 credits ≈ $0.20 per URL-containing tweet, threads charged per link-containing part). Because this tool publishes IMMEDIATELY, the debit happens right away — if the company's balance can't cover it, the X target fails with a top-up message while other platforms still publish. Relay any \`x_url_post_credits\` warning and X publish failure to the user; never strip their link to avoid the fee without asking. If the balance (minus credits reserved by scheduled X link posts) can't cover this post, the request is refused up front with a 402 \`x_credits_insufficient\` error instead of failing at publish.
+6. **X posts containing a link cost credits**: X bills API posts whose text contains a URL at a premium; OmniSocials passes that through as prepaid credits at X's exact rate (20 credits ≈ $0.20 per URL-containing tweet, threads charged per link-containing part; only a link written with http:// or https:// counts, a bare domain or www. link is free). Because this tool publishes IMMEDIATELY, the debit happens right away — if the company's balance can't cover it, the X target fails with a top-up message while other platforms still publish. Relay any \`x_url_post_credits\` warning and X publish failure to the user; never strip their link to avoid the fee without asking. If the balance (minus credits reserved by scheduled X link posts) can't cover this post, the request is refused up front with a 402 \`x_credits_insufficient\` error instead of failing at publish.
 
 Do NOT call without required media — it will fail.`, {
         content: z.union([z.string(), z.record(z.string(), z.string())]).describe("Post caption. String for same text on all channels, or object with platform keys for per-channel captions: { \"default\": \"fallback\", \"linkedin\": \"long version\", \"threads\": \"short version\" }. The \"default\" key is used for any selected channel without its own key."),
@@ -939,7 +967,7 @@ Do NOT call without required media — it will fail.`, {
             notify_subscribers: z.boolean().optional(),
             contains_synthetic_media: z.boolean().optional(),
             first_comment: z.string().max(10000).optional().describe("Text auto-posted as the first comment on the video right after it publishes. The video must have comments enabled."),
-        }).optional().describe("YouTube Shorts options. Only applies when type is 'reel' and youtube is among the selected channels."),
+        }).optional().describe("YouTube Shorts options. Only applies when type is 'reel' and youtube is among the selected channels. A custom Shorts thumbnail is set with the top-level `video_cover` (a `youtube` override for a YouTube-only image); it shows on Shorts only on channels where YouTube has enabled custom Shorts thumbnails (Partner Program channels first, since July 2026), other channels show a frame from the video."),
         instagram: z.object({
             share_to_feed: z.boolean().optional(),
             thumbnail_type: z.enum(["from-video", "from-library"]).optional().describe("How the Reel cover is chosen: 'from-video' picks a frame at thumb_offset; 'from-library' uses the image at cover_url. get_post reads the chosen cover back."),
@@ -1053,7 +1081,7 @@ Do NOT call without required media — it will fail.`, {
             notify_subscribers: z.boolean().optional(),
             contains_synthetic_media: z.boolean().optional(),
             first_comment: z.string().max(10000).optional().describe("Text auto-posted as the first comment on the video right after it publishes. The video must have comments enabled. Pass an empty string to clear a previously set first comment."),
-        }).optional().describe("YouTube Shorts options. Only applies when type is 'reel' and youtube is among the selected channels."),
+        }).optional().describe("YouTube Shorts options. Only applies when type is 'reel' and youtube is among the selected channels. A custom Shorts thumbnail is set with the top-level `video_cover` (a `youtube` override for a YouTube-only image); it shows on Shorts only on channels where YouTube has enabled custom Shorts thumbnails (Partner Program channels first, since July 2026), other channels show a frame from the video."),
         pinterest: PINTEREST_OPTIONS,
         instagram: z.object({
             share_to_feed: z.boolean().optional(),
@@ -1272,6 +1300,72 @@ IMPORTANT: this only succeeds if the connected user is a listed approver for the
             content: [{ type: "text", text: md }],
         };
     });
+    server.tool("get_post_approval", `Read the approval review of a post: every workflow step with its approvers and their decisions, the rejection with its reason, and the comment thread.
+
+Use it when \`get_post\` shows the status \`rejected\` (who rejected it and why, what to change before sending it again) or \`in_approval\` (who the post waits for, what the reviewers wrote). Read-only. A post without an approval workflow returns status \`none\`.`, {
+        id: z.string().describe("The post ID"),
+    }, { title: "Get Post Approval", readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async ({ id }) => {
+        const result = await getClient().getPostApproval(id);
+        if (result.error) {
+            return {
+                content: [{ type: "text", text: `Error (${result.error.code}): ${result.error.message}` }],
+            };
+        }
+        const a = result.data;
+        if (!a) {
+            return {
+                content: [{ type: "text", text: "The API returned no approval review for this post. Check its status with get_post." }],
+            };
+        }
+        let md = `## Approval Review\n\n`;
+        md += `| Field | Value |\n`;
+        md += `|-------|-------|\n`;
+        md += `| **Post** | \`${a.post_id || id}\` |\n`;
+        md += `| **Status** | ${capitalize(a.status || "none")} |\n`;
+        if (a.workflow?.name)
+            md += `| **Workflow** | ${a.workflow.name} |\n`;
+        if (a.requested_by?.name)
+            md += `| **Requested by** | ${a.requested_by.name} |\n`;
+        if (a.status === "none") {
+            md += `\n_This post has no approval workflow._`;
+            return {
+                content: [{ type: "text", text: md }],
+            };
+        }
+        if (a.rejection) {
+            md += `\n### Rejected\n\n`;
+            md += `${a.rejection.by?.name || "A reviewer"} rejected this post${a.rejection.at ? ` on ${formatDateTime(a.rejection.at)}` : ""}.\n`;
+            md += a.rejection.reason ? `\n**Reason:** ${a.rejection.reason}\n` : `\n_No reason was given._\n`;
+        }
+        if (Array.isArray(a.steps) && a.steps.length) {
+            md += `\n### Steps\n\n`;
+            md += `| # | Step | Needs | Status | Approvers |\n`;
+            md += `|---|------|-------|--------|-----------|\n`;
+            for (const s of a.steps) {
+                const who = (s.approvers || [])
+                    .map((p) => `${p.name || p.email || p.id} (${p.status})`)
+                    .join(", ");
+                const active = a.current_step === s.order ? " (waiting now)" : "";
+                md += `| ${s.order} | ${s.name}${active} | ${s.require_mode === "any" ? "one approval" : "all approvers"} | ${capitalize(s.status)} | ${who || "none"} |\n`;
+            }
+        }
+        if (Array.isArray(a.comments) && a.comments.length) {
+            md += `\n### Comments (${a.comments.length}, oldest first)\n\n`;
+            for (const c of a.comments) {
+                const where = c.account ? ` on ${capitalize(c.account.replace(/_/g, " "))}` : "";
+                md += `- **${c.author?.name || "Unknown"}**${where}, ${formatDateTime(c.created_at)}: ${String(c.message).replace(/\n+/g, " / ")}\n`;
+            }
+        }
+        else {
+            md += `\n_No comments in the review thread._`;
+        }
+        if (a.status === "rejected") {
+            md += `\n\n_A rejected post does not publish. To send it again, open it in OmniSocials, edit it and send it for approval there, or create a new post with \`approval_workflow_id\`._`;
+        }
+        return {
+            content: [{ type: "text", text: md }],
+        };
+    });
     server.tool("search_locations", `Search for a location to tag on a post. Use this whenever the user wants to post WITH a place/location (e.g. "post this at my dealership", "tag the café"). It returns matching real venues with their addresses and a location ID.
 
 Pick the platform with \`platform\`: "instagram" (default) or "threads". The two use DIFFERENT ids (a Facebook Place ID is not a Threads location id), so search with the platform you will tag. If the user wants both, search twice.
@@ -1363,6 +1457,91 @@ Notes:
         });
         return { content: [{ type: "text", text: md }] };
     });
+    server.tool("list_pinterest_products", `List the product Pins of the connected Pinterest account, to tag products on a Pin (people can then shop the items in the image). Use this whenever the user wants to tag products on a Pinterest post.
+
+Flow: call it → show the products to the user → pass the chosen \`pin_id\` values (max 24) as \`pinterest.product_tags\` on create_post / create_and_publish_post / update_post. If the user gives a Pin link or Pin ID of a product, pass it as \`check_pin\` to check it first, or put it straight in \`pinterest.product_tags\`.
+
+Notes:
+- Only the account's own product Pins can be tagged: a public product Pin with a link on a website the account claimed on Pinterest. Products of other merchants cannot be tagged through the API.
+- \`source\` "catalog" reads the Pinterest catalog (with price and stock). It needs catalog access, which the user gives one time in OmniSocials: create a post, open the Pinterest options, select Add products, then Connect catalog. \`source\` "pins" reads the account's own Pins and returns the product Pins; one call scans up to 250 Pins, so an empty result with a bookmark means: call again with that bookmark. Without \`source\`, the catalog is used when the connection has catalog access, else the Pins.
+- A product that Pinterest refuses never fails the post; get_post shows which products were tagged.`, {
+        source: z
+            .enum(["catalog", "pins"])
+            .optional()
+            .describe("Where to read product Pins from. Default: catalog when the Pinterest connection has catalog access, else pins."),
+        product_group_id: z
+            .string()
+            .optional()
+            .describe("Catalog source only. A product group ID from an earlier result. Default: the group named All Products."),
+        bookmark: z
+            .string()
+            .optional()
+            .describe("Cursor from an earlier result, to get the next page."),
+        check_pin: z
+            .string()
+            .optional()
+            .describe("A Pin ID or Pin link (https://www.pinterest.com/pin/<id>/) to check instead of listing: answers whether that Pin can be tagged as a product."),
+    }, { title: "List Pinterest Products", readOnlyHint: true, destructiveHint: false, openWorldHint: true }, async ({ source, product_group_id, bookmark, check_pin }) => {
+        const messageOf = (err) => typeof err === "string" ? err : err?.message;
+        if (check_pin) {
+            const check = await getClient().validatePinterestProduct(check_pin);
+            const failed = messageOf(check?.error);
+            if (failed)
+                return { content: [{ type: "text", text: failed }] };
+            const name = check?.title ? ` (${check.title})` : "";
+            let text;
+            if (check?.valid) {
+                text = `Pin \`${check.pin_id}\`${name} is a product Pin of this account. Use it in \`pinterest.product_tags\`.`;
+            }
+            else if (check?.unverified) {
+                text = `Could not check Pin \`${check?.pin_id ?? check_pin}\`: ${check?.reason || "no answer from Pinterest"} You can still pass it in \`pinterest.product_tags\`; Pinterest checks it at publish.`;
+            }
+            else {
+                text = `Pin ${check?.pin_id ? `\`${check.pin_id}\`${name}` : `"${check_pin}"`} cannot be tagged: ${check?.reason || "Pinterest did not accept it."}`;
+            }
+            return { content: [{ type: "text", text }] };
+        }
+        const result = await getClient().listPinterestProducts({ source, product_group_id, bookmark });
+        const failed = messageOf(result?.error);
+        if (failed)
+            return { content: [{ type: "text", text: failed }] };
+        const products = result?.products || [];
+        const fromCatalog = result?.source === "catalog";
+        const groups = result?.product_groups || [];
+        let md = `## Pinterest product Pins (${fromCatalog ? "catalog" : "the account's own Pins"})\n\n`;
+        if (!products.length) {
+            if (result?.bookmark) {
+                md += `No product Pins in this part of the Pin list. Call again with bookmark \`${result.bookmark}\` to scan the next part.\n`;
+            }
+            else if (fromCatalog) {
+                md += groups.length
+                    ? "This product group has no products.\n"
+                    : "The Pinterest account has no catalog. Try source \"pins\", or pass a product Pin link as check_pin.\n";
+            }
+            else {
+                md += "No product Pins found. A product Pin comes from the Pinterest catalog, or links to a product page on a website the account claimed on Pinterest.\n";
+            }
+        }
+        else {
+            md += `Ask the user which products to tag, then pass their IDs (max 24) as \`pinterest.product_tags\`:\n\n`;
+            md += `| # | Product | Price | Stock | pin_id |\n|---|---------|-------|-------|--------|\n`;
+            products.forEach((p, i) => {
+                const price = typeof p.price === "number" ? `${p.price}${p.currency ? ` ${p.currency}` : ""}` : "-";
+                md += `| ${i + 1} | ${p.title || p.link || "-"} | ${price} | ${p.availability || "-"} | \`${p.pin_id}\` |\n`;
+            });
+            if (result?.bookmark)
+                md += `\nMore products: call again with bookmark \`${result.bookmark}\`.\n`;
+        }
+        if (fromCatalog && groups.length > 1) {
+            md += `\nProduct groups (pass one as product_group_id): ${groups
+                .map((g) => `${g.name || "Unnamed"} \`${g.id}\`${g.id === result?.product_group_id ? " (shown)" : ""}`)
+                .join(", ")}\n`;
+        }
+        if (!fromCatalog && result?.catalog_access === false) {
+            md += `\nThe connection has no catalog access, so catalog products are not listed. The user can give it one time in OmniSocials: create a post, open the Pinterest options, select Add products, then Connect catalog.\n`;
+        }
+        return { content: [{ type: "text", text: md }] };
+    });
     server.tool("search_instagram_audio", `Search Instagram's licensed music catalog for a track to attach to a REEL. Use this whenever the user wants to post a reel WITH music/a song/a sound (e.g. "post this reel with trending audio", "add that song to it").
 
 Flow: call with a song/artist/keyword (or NO query for currently trending audio) → present the options → once the user picks, pass that result's \`audio_id\` as \`instagram.audio_id\` on create_post / create_and_publish_post / update_post. Optionally mix with \`instagram.audio_volume\` / \`instagram.video_volume\` (0-100; set video_volume 0 to fully replace the video's own sound). Instagram Reels only — feed posts, carousels, and Stories can't take music via the API (Meta limitation).

package/build/tools/webhooks.js

@@ -28,9 +28,9 @@ export function registerWebhookTools(server, getClient) {
             content: [{ type: "text", text: md }],
         };
     });
-    server.tool("create_webhook", "Create a new webhook to receive event notifications. Available events: post.scheduled, post.published, post.failed", {
+    server.tool("create_webhook", "Create a new webhook to receive event notifications. Available events: post.scheduled, post.published, post.failed, post.approved (the last approval of a post's approval workflow is in), post.rejected (an approver rejected the post)", {
         url: z.string().describe("The HTTPS URL to send webhook events to"),
-        events: z.array(z.string()).describe("Events to subscribe to: post.scheduled, post.published, post.failed"),
+        events: z.array(z.string()).describe("Events to subscribe to: post.scheduled, post.published, post.failed, post.approved, post.rejected"),
     }, { title: "Create Webhook", readOnlyHint: false, destructiveHint: false, openWorldHint: false }, async (params) => {
         const result = await getClient().createWebhook(params);
         if (result.error) {
@@ -95,7 +95,7 @@ export function registerWebhookTools(server, getClient) {
     server.tool("update_webhook", "Update a webhook's URL, events, or active status.", {
         id: z.string().describe("The webhook ID to update"),
         url: z.string().optional().describe("Updated HTTPS URL"),
-        events: z.array(z.string()).optional().describe("Updated event list"),
+        events: z.array(z.string()).optional().describe("Updated event list: post.scheduled, post.published, post.failed, post.approved, post.rejected"),
         is_active: z.boolean().optional().describe("Enable or disable the webhook"),
     }, { title: "Update Webhook", readOnlyHint: false, destructiveHint: false, openWorldHint: false }, async ({ id, ...data }) => {
         const result = await getClient().updateWebhook(id, data);

package/build/types.d.ts

@@ -84,13 +84,23 @@ export interface InboxMessage {
 }
 /** What GET /inbox/next serves (and what `reply_to_inbox` returns as `next`
  * when `include_next` is set). `message` is the unanswered incoming item: its
- * `id` is what hide/delete take, its `conversation_id` is what reply takes.
+ * `id` is what hide/delete take and the `message_id` to pass to reply for a
+ * comment thread, its `conversation_id` is what reply takes as the path.
  * `messages` is the thread oldest first (the most recent 50, plus the target
  * and its parent when they fall outside that window). */
 export interface InboxNextUnanswered {
     conversation: InboxConversation;
     message: InboxMessage;
     messages: InboxMessage[];
+    /** Only Instagram and Facebook DMs have a reply window (Meta's 24 hours
+     * after the customer's last message): `closes_at` is that deadline and
+     * `open` is false once it has passed, in which case reply_to_inbox answers
+     * 422 outside_messaging_window. Every other item: open true, closes_at
+     * null. */
+    reply_window: {
+        open: boolean;
+        closes_at: string | null;
+    };
 }
 /** Response of DELETE /inbox/messages/:id. Replies under the comment are
  * removed with it; their inbox ids are listed in `removed_reply_ids`. */
@@ -274,6 +284,68 @@ export interface RejectPostResult {
     approval_status: "rejected";
     message?: string;
 }
+/** One approver of a step in GET /posts/:id/approval. */
+export interface PostApprovalApprover {
+    id: string;
+    name: string | null;
+    email: string | null;
+    status: "pending" | "approved" | "rejected";
+    decided_at: string | null;
+    /** The reason this approver gave with a rejection. */
+    comment: string | null;
+}
+export interface PostApprovalStep {
+    order: number;
+    name: string;
+    /** `all` = every approver of the step must approve. `any` = one approval is enough. */
+    require_mode: "all" | "any";
+    status: "pending" | "approved" | "rejected";
+    approvers: PostApprovalApprover[];
+}
+export interface PostApprovalComment {
+    id: string;
+    author: {
+        id: string;
+        name: string | null;
+    } | null;
+    message: string;
+    /** The channel the comment is about (`instagram`, `linkedin_page`, ...). Null = the whole post. */
+    account: string | null;
+    created_at: string;
+}
+/** `data` of GET /posts/:id/approval (backend/routes/api/v1/posts.js).
+ * `status: "none"` = the post has no approval workflow: `workflow`,
+ * `requested_by`, `requested_at`, `current_step` and `rejection` are null and
+ * `steps` and `comments` are empty. */
+export interface PostApproval {
+    post_id: string;
+    status: "none" | "pending" | "approved" | "rejected";
+    /** `id` is null for a one-off approval that was not made from a saved workflow. */
+    workflow: {
+        id: string | null;
+        name: string;
+    } | null;
+    requested_by: {
+        id: string;
+        name: string | null;
+    } | null;
+    requested_at: string | null;
+    /** Order of the step the post waits on. Null when the review is finished. */
+    current_step: number | null;
+    steps: PostApprovalStep[];
+    rejection: {
+        by: {
+            id: string;
+            name: string | null;
+        };
+        reason: string | null;
+        at: string | null;
+        step: number | null;
+    } | null;
+    /** The review thread, oldest first. Includes the entries OmniSocials
+     * writes when a reviewer edits the post. */
+    comments: PostApprovalComment[];
+}
 /** One place from GET /locations/search
  * (@openapi block in backend/routes/api/v1/locations.js). */
 export interface LocationPlace {
@@ -314,6 +386,57 @@ export interface LocationSearchResult {
     };
     needsPermission?: boolean;
 }
+/** One product Pin from GET /pinterest/products
+ * (@openapi block in backend/routes/api/v1/pinterest.js). */
+export interface PinterestProduct {
+    /** Use in `pinterest.product_tags`. */
+    pin_id: string;
+    title?: string | null;
+    description?: string | null;
+    link?: string | null;
+    image_url?: string | null;
+    /** Catalog source only. */
+    price?: number | null;
+    currency?: string | null;
+    availability?: string | null;
+    item_id?: string | null;
+}
+/** GET /pinterest/products envelope: NOT the standard data/error envelope.
+ * Success: `products` + `bookmark` + `source` + `catalog_access` (and, for
+ * the catalog source, `product_groups` + `product_group_id`). When the list
+ * could not be read, `error` is a { code, message } object with code one of
+ * pinterest_not_connected | pinterest_catalog_access_required |
+ * platform_error, and `products` is absent. */
+export interface PinterestProductsResult {
+    products?: PinterestProduct[];
+    bookmark?: string | null;
+    source?: "catalog" | "pins";
+    catalog_access?: boolean;
+    product_groups?: Array<{
+        id: string;
+        name?: string | null;
+    }>;
+    product_group_id?: string | null;
+    error?: string | {
+        code: string;
+        message: string;
+    };
+}
+/** GET /pinterest/products/validate result. `unverified` = the check could
+ * not run; the publish step is then the final check. */
+export interface PinterestProductCheck {
+    valid?: boolean;
+    pin_id?: string | null;
+    title?: string | null;
+    link?: string | null;
+    image_url?: string | null;
+    unverified?: boolean;
+    reason?: string;
+    error?: string | {
+        code: string;
+        message: string;
+    };
+}
 /** One track from GET /audio/search
  * (@openapi block in backend/routes/api/v1/audio.js). */
 export interface InstagramAudioTrack {
@@ -366,14 +489,29 @@ export interface MediaItem {
     size: string;
     status?: string;
     created_at: string;
+    pdf?: {
+        id: string;
+        name: string;
+        url: string;
+        page?: number;
+        total_pages: number;
+        rendered_pages: number;
+        truncated?: boolean;
+        pages?: Array<{
+            url: string;
+            width?: number | null;
+            height?: number | null;
+        }>;
+    };
 }
 /**
  * Extra top-level fields returned by /media/upload* when the uploaded file is a
- * PDF. A PDF is rasterized into one image slide per page (max 20): `data`
- * mirrors the first slide (back-compat), while `slides` + `media_ids` carry the
- * whole carousel in page order. Pass ALL of `media_ids` to create_post. On
- * LinkedIn the slides post as a native swipeable document; elsewhere as an
- * image carousel.
+ * PDF. A PDF is rasterized into one image slide per page (max 20) and the
+ * original file is kept: `data` mirrors the first slide (back-compat), while
+ * `slides` + `media_ids` carry the whole carousel in page order. Pass ALL of
+ * `media_ids` to create_post. On LinkedIn the slides post as a native
+ * swipeable document made from the original PDF (unless the post's
+ * linkedin.document_source is "slides"); elsewhere as an image carousel.
  */
 export interface PdfUploadResult {
     slides: MediaItem[];
@@ -382,6 +520,10 @@ export interface PdfUploadResult {
         total_pages: number;
         rendered_pages: number;
         truncated: boolean;
+        id?: string;
+        name?: string;
+        url?: string;
+        size_bytes?: number;
     };
 }
 export interface Account {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omnisocials/mcp-server",
-  "version": "1.35.0",
+  "version": "1.39.0",
   "mcpName": "io.github.omnisocials/mcp-server",
   "description": "MCP server for OmniSocials API - manage social media posts, media, accounts, analytics, and webhooks",
   "type": "module",
@@ -53,7 +53,7 @@
   },
   "overrides": {
     "zod": "4.4.0",
-    "fast-uri": "^3.1.7",
+    "fast-uri": "^3.1.8",
     "hono": "^4.13.7",
     "qs": "^6.16.0"
   }