@sendinel/mcp-server 1.0.0

package/build/tools/analytics.js

@@ -0,0 +1,1105 @@
+import { z } from 'zod';
+import { db, adminDb } from '../db.js';
+import { getProjectId } from '../project.js';
+import { resolveProjectClient } from '../byod-client.js';
+import { decrypt } from '../crypto.js';
+const txt = (text) => ({ content: [{ type: 'text', text }] });
+const j = (data) => txt(JSON.stringify(data, null, 2));
+const percent = (rate) => `${(rate * 100).toFixed(1)}%`;
+const pctNumber = (rate) => Math.round(rate * 1000) / 10;
+const roundRate = (rate) => Math.round(rate * 1000) / 1000;
+const clamp = (value, min, max) => Math.min(max, Math.max(min, value));
+const socialPlatforms = ['instagram', 'linkedin', 'twitter', 'facebook', 'tiktok', 'youtube', 'pinterest', 'uploadpost', 'other'];
+const socialPublishers = ['uploadpost', 'buffer'];
+const UPLOADPOST_API_BASE = process.env.UPLOADPOST_API_BASE || 'https://api.upload-post.com/api';
+function slugifyCampaign(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 100) || 'campaign';
+}
+function buildSocialTrackedUrl(params) {
+    const url = new URL(params.destination_url);
+    const utmCampaign = params.utm_campaign?.trim() || slugifyCampaign(params.name);
+    url.searchParams.set('utm_source', params.platform);
+    url.searchParams.set('utm_medium', 'social');
+    url.searchParams.set('utm_campaign', utmCampaign);
+    if (params.utm_content?.trim())
+        url.searchParams.set('utm_content', params.utm_content.trim());
+    return {
+        tracked_url: url.toString(),
+        utm_source: params.platform,
+        utm_medium: 'social',
+        utm_campaign: utmCampaign,
+    };
+}
+async function scheduleUploadPost(apiKey, params) {
+    const res = await fetch(`${UPLOADPOST_API_BASE}/uploadposts/schedule`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Apikey ${apiKey}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+            platform: params.platform,
+            content: params.link ? `${params.content}\n\n${params.link}` : params.content,
+            scheduled_at: params.scheduledAt?.toISOString(),
+            media_urls: params.mediaUrls,
+            link: params.link ?? undefined,
+        }),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => '');
+        throw new Error(`UploadPost schedule failed: ${res.status}${text ? ` ${text.slice(0, 200)}` : ''}`);
+    }
+    const json = await res.json();
+    const publisherPostId = json.id ?? json.request_id ?? json.post_id;
+    if (!publisherPostId)
+        throw new Error('UploadPost schedule response did not include a post id.');
+    return {
+        publisherPostId: String(publisherPostId),
+        scheduledAt: json.scheduled_at ? new Date(json.scheduled_at) : params.scheduledAt,
+        postUrl: json.post_url ?? json.post?.post_url,
+    };
+}
+async function publishViaByoPublisher(publisher, credentials, params) {
+    if (publisher === 'uploadpost')
+        return scheduleUploadPost(credentials, params);
+    throw new Error('Buffer publisher is not yet implemented. Connect UploadPost instead.');
+}
+export function computeAnalyticsMetrics(rows, eventCounts) {
+    const sent = rows.length;
+    const delivered = rows.filter(r => ['delivered', 'opened', 'clicked'].includes(r.status)).length;
+    const opened = eventCounts?.opened ?? rows.filter(r => r.status === 'opened' || r.status === 'clicked').length;
+    const clicked = eventCounts?.clicked ?? rows.filter(r => r.status === 'clicked').length;
+    const bounced = rows.filter(r => r.status === 'bounced').length;
+    const complained = rows.filter(r => r.status === 'complained').length;
+    const unsubscribed = rows.filter(r => r.status === 'unsubscribed').length;
+    return {
+        sent,
+        delivered,
+        opened,
+        clicked,
+        bounced,
+        complained,
+        unsubscribed,
+        delivery_rate: sent > 0 ? delivered / sent : 0,
+        open_rate: delivered > 0 ? opened / delivered : 0,
+        click_rate: delivered > 0 ? clicked / delivered : 0,
+        bounce_rate: sent > 0 ? bounced / sent : 0,
+        complaint_rate: sent > 0 ? complained / sent : 0,
+        unsubscribe_rate: sent > 0 ? unsubscribed / sent : 0,
+    };
+}
+export function computeSenderHealthScore(metrics, trackingEnabled) {
+    let score = 100;
+    if (metrics.bounce_rate > 0.05)
+        score -= 40;
+    else if (metrics.bounce_rate > 0.02)
+        score -= 20;
+    if (metrics.complaint_rate > 0.005)
+        score -= 40;
+    else if (metrics.complaint_rate > 0.001)
+        score -= 20;
+    if (metrics.unsubscribe_rate > 0.02)
+        score -= 10;
+    if (trackingEnabled && metrics.open_rate < 0.10)
+        score -= 10;
+    return clamp(score, 0, 100);
+}
+function sendVolumeByDay(rows) {
+    const byDay = new Map();
+    for (const row of rows) {
+        if (!row.sent_at)
+            continue;
+        const date = new Date(row.sent_at).toISOString().slice(0, 10);
+        byDay.set(date, (byDay.get(date) ?? 0) + 1);
+    }
+    return Array.from(byDay.entries())
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([date, sent]) => ({ date, sent }));
+}
+function daysBetween(startDate, endDate) {
+    const start = new Date(`${startDate}T00:00:00Z`).getTime();
+    const end = new Date(`${endDate}T23:59:59Z`).getTime();
+    return Math.max(1, Math.ceil((end - start) / 86_400_000));
+}
+function addDays(date, days) {
+    const next = new Date(date);
+    next.setUTCDate(next.getUTCDate() + days);
+    return next;
+}
+function dateOnly(date) {
+    return date.toISOString().slice(0, 10);
+}
+function addDeviationFlag(flags, metric, recent, baseline) {
+    if (baseline === 0)
+        return;
+    const deviation = (recent - baseline) / baseline;
+    if (Math.abs(deviation) > 0.20) {
+        flags.push(`${metric} ${deviation > 0 ? 'up' : 'down'} ${(Math.abs(deviation) * 100).toFixed(1)}% vs 30d baseline`);
+    }
+}
+function distinctEventCount(events, eventType, logIds) {
+    return new Set(events
+        .filter(event => event.event_type === eventType && event.email_log_id && logIds.has(event.email_log_id))
+        .map(event => event.email_log_id)).size;
+}
+export function registerAnalyticsTools(server) {
+    server.registerTool('list_event_log', {
+        description: 'List received API event tracking calls with optional filters.',
+        inputSchema: {
+            event_name: z.string().optional(),
+            email: z.string().optional(),
+            source: z.string().optional(),
+            site_id: z.string().uuid().optional(),
+            limit: z.number().int().min(1).max(100).optional().default(50),
+        },
+    }, async ({ event_name, email, source, site_id, limit = 50 }) => {
+        let query = db().from('event_log')
+            .select('id, site_id, contact_id, email, event_name, source, campaigns_enrolled, campaigns_skipped, skip_reason, properties, created_at')
+            .eq('project_id', getProjectId())
+            .order('created_at', { ascending: false })
+            .limit(limit);
+        if (event_name)
+            query = query.ilike('event_name', `%${event_name}%`);
+        if (email)
+            query = query.ilike('email', `%${email}%`);
+        if (source)
+            query = query.eq('source', source);
+        if (site_id)
+            query = query.eq('site_id', site_id);
+        const { data, error } = await query;
+        if (error)
+            return j({ error: error.message });
+        return j({ events: data ?? [] });
+    });
+    server.registerTool('get_portfolio_analytics', {
+        description: 'Get cross-site analytics totals and per-site breakdown.',
+        inputSchema: { period_days: z.number().int().min(1).max(365).optional().default(30) },
+    }, async ({ period_days = 30 }) => {
+        const since = new Date(Date.now() - period_days * 86400000).toISOString();
+        const { data, error } = await db().from('email_log').select('site_id, status, sent_at, created_at').eq('project_id', getProjectId()).gte('created_at', since).limit(20000);
+        if (error)
+            return j({ error: error.message });
+        const rows = data ?? [];
+        const totals = computeAnalyticsMetrics(rows);
+        const bySite = new Map();
+        for (const row of rows) {
+            const key = row.site_id ?? 'unknown';
+            bySite.set(key, [...(bySite.get(key) ?? []), row]);
+        }
+        return j({
+            totals,
+            by_site: Array.from(bySite.entries()).map(([site_id, siteRows]) => ({ site_id, ...computeAnalyticsMetrics(siteRows) })),
+        });
+    });
+    server.registerTool('list_projects', {
+        description: 'List all projects accessible to this API key. Returns project ID, name, plan, and associated organization. Useful for orchestrators managing multiple products through a single Sendinel account.',
+        inputSchema: {},
+    }, async () => {
+        // API keys are scoped to a single project, but an organization can have multiple projects.
+        // Look up the org for this project, then list all projects in that org.
+        const projectId = getProjectId();
+        const { data: project, error: projErr } = await adminDb()
+            .from('projects')
+            .select('id, name, org_id')
+            .eq('id', projectId)
+            .maybeSingle();
+        if (projErr || !project)
+            return txt(`Error: could not find project ${projectId}`);
+        if (!project.org_id) {
+            // No org — return just this project
+            return j({ projects: [{ id: project.id, name: project.name, current: true }] });
+        }
+        // List all projects in the same organization
+        const { data: projects, error: listErr } = await adminDb()
+            .from('projects')
+            .select('id, name')
+            .eq('org_id', project.org_id)
+            .order('name');
+        if (listErr)
+            return txt(`Error: ${listErr.message}`);
+        // Get org info
+        const { data: org } = await adminDb()
+            .from('organizations')
+            .select('id, name, plan')
+            .eq('id', project.org_id)
+            .maybeSingle();
+        return j({
+            organization: org ? { id: org.id, name: org.name, plan: org.plan } : null,
+            projects: (projects ?? []).map((p) => ({
+                id: p.id,
+                name: p.name,
+                current: p.id === projectId,
+            })),
+        });
+    });
+    server.registerTool('get_sites', {
+        description: 'List all active Sendinel sites',
+        inputSchema: {},
+    }, async () => {
+        const { data, error } = await db()
+            .from('sites')
+            .select('id, slug, name, sending_domain, from_email, active')
+            .eq('active', true)
+            .eq('project_id', getProjectId())
+            .order('name');
+        if (error)
+            return { content: [{ type: 'text', text: `Error: ${error.message}` }] };
+        return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+    });
+    server.registerTool('get_stats', {
+        description: 'Aggregate email metrics for a site over a date range. Returns sent, delivered, bounce/complaint rates, Sender Health Score (0–100), send volume by day, list growth rate, inactive subscriber percentage, and open/click rates when tracking is enabled.',
+        inputSchema: {
+            site_id: z.string().uuid().describe('Site UUID'),
+            start_date: z.string().describe('ISO date e.g. 2026-01-01'),
+            end_date: z.string().optional().describe('ISO date, defaults to today'),
+        },
+    }, async ({ site_id, start_date, end_date }) => {
+        const projectId = getProjectId();
+        const end = end_date ?? new Date().toISOString().slice(0, 10);
+        const { data: site, error: siteError } = await db()
+            .from('sites')
+            .select('tracking_enabled')
+            .eq('project_id', projectId)
+            .eq('id', site_id)
+            .maybeSingle();
+        if (siteError)
+            return { content: [{ type: 'text', text: `Error: ${siteError.message}` }] };
+        const trackingEnabled = site?.tracking_enabled ?? false;
+        const { data, error } = await db()
+            .from('email_log')
+            .select('id, status, sent_at')
+            .eq('project_id', projectId)
+            .eq('site_id', site_id)
+            .gte('sent_at', `${start_date}T00:00:00Z`)
+            .lte('sent_at', `${end}T23:59:59Z`);
+        if (error)
+            return { content: [{ type: 'text', text: `Error: ${error.message}` }] };
+        const rows = (data ?? []);
+        let eventCounts = { opened: 0, clicked: 0 };
+        if (trackingEnabled) {
+            const { data: events, error: eventsError } = await db()
+                .from('email_events')
+                .select('email_log_id, event_type')
+                .eq('project_id', projectId)
+                .eq('site_id', site_id)
+                .in('event_type', ['open', 'click'])
+                .gte('occurred_at', `${start_date}T00:00:00Z`)
+                .lte('occurred_at', `${end}T23:59:59Z`);
+            if (eventsError)
+                return { content: [{ type: 'text', text: `Error: ${eventsError.message}` }] };
+            const logIds = new Set(rows.map(row => row.id).filter((id) => Boolean(id)));
+            eventCounts = {
+                opened: distinctEventCount(events ?? [], 'open', logIds),
+                clicked: distinctEventCount(events ?? [], 'click', logIds),
+            };
+        }
+        const metrics = computeAnalyticsMetrics(rows, trackingEnabled ? eventCounts : undefined);
+        const periodDays = daysBetween(start_date, end);
+        const priorStart = dateOnly(addDays(new Date(`${start_date}T00:00:00Z`), -periodDays));
+        const priorEnd = dateOnly(addDays(new Date(`${start_date}T00:00:00Z`), -1));
+        const { data: subscribers } = await db()
+            .from('subscribers')
+            .select('created_at, last_engaged_at, last_opened_at, last_clicked_at')
+            .eq('project_id', projectId);
+        const subscriberRows = (subscribers ?? []);
+        const currentNew = subscriberRows.filter(s => s.created_at && s.created_at >= `${start_date}T00:00:00Z` && s.created_at <= `${end}T23:59:59Z`).length;
+        const priorNew = subscriberRows.filter(s => s.created_at && s.created_at >= `${priorStart}T00:00:00Z` && s.created_at <= `${priorEnd}T23:59:59Z`).length;
+        const inactiveCutoff = dateOnly(addDays(new Date(`${end}T00:00:00Z`), -90));
+        const inactive = subscriberRows.filter(s => {
+            const lastEngaged = s.last_engaged_at ?? s.last_clicked_at ?? s.last_opened_at ?? null;
+            return !lastEngaged || lastEngaged < `${inactiveCutoff}T00:00:00Z`;
+        }).length;
+        const response = {
+            site_id, period: { start: start_date, end },
+            tracking_enabled: trackingEnabled,
+            total_sent: metrics.sent,
+            total_delivered: metrics.delivered,
+            total_bounced: metrics.bounced,
+            total_complained: metrics.complained,
+            total_unsubscribed: metrics.unsubscribed,
+            delivery_rate: metrics.sent > 0 ? percent(metrics.delivery_rate) : 'N/A',
+            send_volume_by_day: sendVolumeByDay(rows),
+            list_growth_rate: subscriberRows.length > 0 ? pctNumber(currentNew / subscriberRows.length) : 0,
+            inactive_pct: subscriberRows.length > 0 ? pctNumber(inactive / subscriberRows.length) : 0,
+            sender_health_score: computeSenderHealthScore(metrics, trackingEnabled),
+        };
+        if (trackingEnabled) {
+            response.open_rate = metrics.sent > 0 ? percent(metrics.open_rate) : 'N/A';
+            response.click_rate = metrics.sent > 0 ? percent(metrics.click_rate) : 'N/A';
+        }
+        else {
+            response.tracking_note = 'Enable tracking in Site Settings to see open and click rates';
+        }
+        return { content: [{ type: 'text', text: JSON.stringify(response, null, 2) }] };
+    });
+    server.registerTool('get_domain_health', {
+        description: 'SPF/DKIM/DMARC status and warmup progress for a site',
+        inputSchema: {
+            site_id: z.string().uuid().describe('Site UUID'),
+            days: z.number().int().min(1).max(90).optional().describe('Recent days to return, default 7'),
+        },
+    }, async ({ site_id, days = 7 }) => {
+        const { data, error } = await db()
+            .from('domain_health')
+            .select('*')
+            .eq('site_id', site_id)
+            .order('check_date', { ascending: false })
+            .limit(days);
+        if (error)
+            return { content: [{ type: 'text', text: `Error: ${error.message}` }] };
+        return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+    });
+    server.registerTool('get_engagement_insights', {
+        description: 'Get engagement scoring summary: lifecycle distribution, score buckets, top engaged contacts, at-risk contacts, and never-engaged counts. Use this data to recommend re-engagement campaigns, identify high-value contacts, or suggest list hygiene actions.',
+        inputSchema: {
+            site_id: z.string().uuid().optional().describe('Optional site UUID for site-specific tracking settings and engagement anomaly analysis'),
+        },
+    }, async ({ site_id }) => {
+        const projectId = getProjectId();
+        const { data, error } = await db()
+            .rpc('get_engagement_summary', site_id ? { p_project_id: projectId, p_site_id: site_id } : { p_project_id: projectId });
+        if (error)
+            return { content: [{ type: 'text', text: `Error: ${error.message}` }] };
+        let trackingEnabled = true;
+        if (site_id) {
+            const { data: site, error: siteError } = await db()
+                .from('sites')
+                .select('tracking_enabled')
+                .eq('project_id', projectId)
+                .eq('id', site_id)
+                .maybeSingle();
+            if (siteError)
+                return { content: [{ type: 'text', text: `Error: ${siteError.message}` }] };
+            trackingEnabled = site?.tracking_enabled ?? false;
+        }
+        else {
+            const { data: sites, error: sitesError } = await db()
+                .from('sites')
+                .select('tracking_enabled')
+                .eq('project_id', projectId);
+            if (sitesError)
+                return { content: [{ type: 'text', text: `Error: ${sitesError.message}` }] };
+            trackingEnabled = (sites ?? []).some((site) => site.tracking_enabled);
+        }
+        const since30d = new Date(Date.now() - 30 * 86_400_000).toISOString();
+        const since7d = new Date(Date.now() - 7 * 86_400_000).toISOString();
+        let q = db()
+            .from('email_log')
+            .select('status, opened_at, clicked_at, sent_at')
+            .eq('project_id', projectId)
+            .gte('sent_at', since30d);
+        if (site_id)
+            q = q.eq('site_id', site_id);
+        const { data: logs, error: logsError } = await q;
+        if (logsError)
+            return { content: [{ type: 'text', text: `Error: ${logsError.message}` }] };
+        const rows = (logs ?? []);
+        const metrics30d = computeAnalyticsMetrics(rows);
+        const metrics7d = computeAnalyticsMetrics(rows.filter(row => row.sent_at && row.sent_at >= since7d));
+        const anomalyFlags = [];
+        addDeviationFlag(anomalyFlags, 'delivery_rate', metrics7d.delivery_rate, metrics30d.delivery_rate);
+        addDeviationFlag(anomalyFlags, 'bounce_rate', metrics7d.bounce_rate, metrics30d.bounce_rate);
+        addDeviationFlag(anomalyFlags, 'complaint_rate', metrics7d.complaint_rate, metrics30d.complaint_rate);
+        addDeviationFlag(anomalyFlags, 'unsubscribe_rate', metrics7d.unsubscribe_rate, metrics30d.unsubscribe_rate);
+        if (trackingEnabled) {
+            addDeviationFlag(anomalyFlags, 'open_rate', metrics7d.open_rate, metrics30d.open_rate);
+            addDeviationFlag(anomalyFlags, 'click_rate', metrics7d.click_rate, metrics30d.click_rate);
+        }
+        else {
+            anomalyFlags.push('Tracking is disabled; open and click anomalies are not evaluated. Enable tracking in Site Settings to see open and click rates');
+        }
+        if (metrics7d.bounce_rate > 0.05)
+            anomalyFlags.push(`HIGH bounce rate: ${pctNumber(metrics7d.bounce_rate)}%`);
+        else if (metrics7d.bounce_rate > 0.02)
+            anomalyFlags.push(`Elevated bounce rate: ${pctNumber(metrics7d.bounce_rate)}%`);
+        if (metrics7d.complaint_rate > 0.005)
+            anomalyFlags.push(`HIGH complaint rate: ${(metrics7d.complaint_rate * 100).toFixed(3)}%`);
+        else if (metrics7d.complaint_rate > 0.001)
+            anomalyFlags.push(`Elevated complaint rate: ${(metrics7d.complaint_rate * 100).toFixed(3)}%`);
+        const rolling = {
+            sent_7d: metrics7d.sent,
+            sent_30d: metrics30d.sent,
+            delivery_rate_7d: roundRate(metrics7d.delivery_rate),
+            delivery_rate_30d: roundRate(metrics30d.delivery_rate),
+            bounce_rate_7d: roundRate(metrics7d.bounce_rate),
+            bounce_rate_30d: roundRate(metrics30d.bounce_rate),
+            complaint_rate_7d: roundRate(metrics7d.complaint_rate),
+            complaint_rate_30d: roundRate(metrics30d.complaint_rate),
+            unsubscribe_rate_7d: roundRate(metrics7d.unsubscribe_rate),
+            unsubscribe_rate_30d: roundRate(metrics30d.unsubscribe_rate),
+        };
+        if (trackingEnabled) {
+            rolling.open_rate_7d = roundRate(metrics7d.open_rate);
+            rolling.open_rate_30d = roundRate(metrics30d.open_rate);
+            rolling.click_rate_7d = roundRate(metrics7d.click_rate);
+            rolling.click_rate_30d = roundRate(metrics30d.click_rate);
+        }
+        return { content: [{ type: 'text', text: JSON.stringify({
+                        ...(typeof data === 'object' && data !== null ? data : { summary: data }),
+                        tracking_enabled: trackingEnabled,
+                        rolling_7d_vs_30d: rolling,
+                        anomaly_flags: anomalyFlags,
+                    }, null, 2) }] };
+    });
+    server.registerTool('deliverability_check', {
+        description: 'Run a deliverability check for a site: DNS records (SPF/DKIM/DMARC), warmup status, bounce/complaint rates, and risk assessment',
+        inputSchema: {
+            site_id: z.string().uuid(),
+        },
+    }, async ({ site_id }) => {
+        const projectId = getProjectId();
+        const { data: site, error: siteErr } = await db()
+            .from('sites')
+            .select('id, slug, name, sending_domain, from_email')
+            .eq('id', site_id)
+            .eq('project_id', projectId)
+            .maybeSingle();
+        if (siteErr || !site)
+            return txt(`Error: Site not found — ${siteErr?.message ?? 'not found'}`);
+        const domain = site.sending_domain;
+        const dnsResults = { spf: null, dkim: null, dmarc: null };
+        let verificationSource = 'dns_lookup';
+        let resendDomainStatus = null;
+        // Try Resend domain verification API first — avoids false negatives from
+        // raw DNS lookups (Resend uses varying DKIM selectors per domain vintage).
+        try {
+            // Resolve Resend API key: site key → project key → env
+            let apiKey = null;
+            const { data: siteRow } = await adminDb()
+                .from('sites')
+                .select('provider_api_key_enc')
+                .eq('id', site_id)
+                .eq('project_id', projectId)
+                .maybeSingle();
+            if (siteRow?.provider_api_key_enc) {
+                apiKey = decrypt(siteRow.provider_api_key_enc);
+            }
+            else {
+                const { data: projRow } = await adminDb()
+                    .from('projects')
+                    .select('provider_api_key_enc')
+                    .eq('id', projectId)
+                    .maybeSingle();
+                if (projRow?.provider_api_key_enc) {
+                    apiKey = decrypt(projRow.provider_api_key_enc);
+                }
+                else if (process.env.RESEND_API_KEY) {
+                    apiKey = process.env.RESEND_API_KEY;
+                }
+            }
+            if (apiKey) {
+                const { Resend } = await import('resend');
+                const resend = new Resend(apiKey);
+                const { data: domainList } = await resend.domains.list();
+                const domains = domainList?.data ?? [];
+                const match = domains.find((d) => d.name === domain);
+                if (match) {
+                    resendDomainStatus = match.status;
+                    if (match.status === 'verified') {
+                        verificationSource = 'resend_api';
+                        dnsResults.spf = { found: true, verified_by: 'resend_api', note: 'Resend handles SPF authentication at infrastructure level' };
+                        dnsResults.dkim = { found: true, verified_by: 'resend_api', note: 'DKIM signing managed by Resend (selector may vary)' };
+                        dnsResults.dmarc = { found: true, verified_by: 'resend_api', note: 'Domain verified by Resend — DMARC alignment confirmed' };
+                    }
+                }
+            }
+        }
+        catch {
+            // Resend API unavailable or key missing — fall back to DNS lookup
+        }
+        // Fall back to raw DNS checks if Resend API didn't confirm verification
+        if (verificationSource === 'dns_lookup') {
+            try {
+                const dns = await import('dns/promises');
+                try {
+                    const txtRecords = await dns.resolveTxt(domain);
+                    const spfRecord = txtRecords.flat().find((r) => r.startsWith('v=spf1'));
+                    dnsResults.spf = { found: !!spfRecord, record: spfRecord ?? null, includes_resend: spfRecord?.includes('include:amazonses.com') || spfRecord?.includes('include:_spf.resend.com') || false };
+                }
+                catch {
+                    dnsResults.spf = { found: false, error: 'No SPF record found' };
+                }
+                try {
+                    const dmarcRecords = await dns.resolveTxt(`_dmarc.${domain}`);
+                    const dmarcRecord = dmarcRecords.flat().find((r) => r.startsWith('v=DMARC1'));
+                    const policy = dmarcRecord?.match(/p=(\w+)/)?.[1] ?? 'unknown';
+                    dnsResults.dmarc = { found: !!dmarcRecord, record: dmarcRecord ?? null, policy, strict: policy === 'quarantine' || policy === 'reject' };
+                }
+                catch {
+                    dnsResults.dmarc = { found: false, error: 'No DMARC record found' };
+                }
+                try {
+                    const cnames = await dns.resolveCname(`resend._domainkey.${domain}`);
+                    dnsResults.dkim = { found: cnames.length > 0, cname: cnames[0] ?? null };
+                }
+                catch {
+                    dnsResults.dkim = { found: false, error: 'No DKIM CNAME found for resend._domainkey' };
+                }
+            }
+            catch { /* dns module unavailable */ }
+        }
+        const { data: healthRows } = await db()
+            .from('domain_health')
+            .select('*')
+            .eq('site_id', site_id)
+            .order('check_date', { ascending: false })
+            .limit(14);
+        const health = healthRows ?? [];
+        const latest = health[0];
+        const warmupDay = latest?.warmup_day ?? null;
+        const warmupLimit = latest?.warmup_daily_limit ?? null;
+        const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000).toISOString();
+        const { data: recentLogs } = await db()
+            .from('email_log')
+            .select('status')
+            .eq('project_id', projectId)
+            .eq('site_id', site_id)
+            .gte('sent_at', sevenDaysAgo);
+        const logs = recentLogs ?? [];
+        const totalSent = logs.length;
+        const bounced = logs.filter((l) => l.status === 'bounced').length;
+        const complained = logs.filter((l) => l.status === 'complained').length;
+        const bounceRate = totalSent > 0 ? (bounced / totalSent * 100) : 0;
+        const complaintRate = totalSent > 0 ? (complained / totalSent * 100) : 0;
+        const risks = [];
+        if (verificationSource === 'dns_lookup') {
+            if (!dnsResults.spf?.found)
+                risks.push('SPF record missing');
+            if (!dnsResults.dkim?.found)
+                risks.push('DKIM not configured');
+            if (!dnsResults.dmarc?.found)
+                risks.push('DMARC record missing');
+        }
+        if (resendDomainStatus && resendDomainStatus !== 'verified') {
+            risks.push(`Resend domain status is '${resendDomainStatus}' — domain verification incomplete`);
+        }
+        if (bounceRate > 5)
+            risks.push(`HIGH bounce rate: ${bounceRate.toFixed(1)}%`);
+        else if (bounceRate > 2)
+            risks.push(`Elevated bounce rate: ${bounceRate.toFixed(1)}%`);
+        if (complaintRate > 0.3)
+            risks.push(`HIGH complaint rate: ${complaintRate.toFixed(2)}%`);
+        else if (complaintRate > 0.1)
+            risks.push(`Elevated complaint rate: ${complaintRate.toFixed(2)}%`);
+        if (warmupDay && warmupDay < 43)
+            risks.push(`Domain still in warmup (day ${warmupDay})`);
+        return j({
+            site: { slug: site.slug, domain, from_email: site.from_email },
+            verification_source: verificationSource,
+            resend_domain_status: resendDomainStatus,
+            dns: dnsResults,
+            warmup: { day: warmupDay, daily_limit: warmupLimit, completed: warmupDay ? warmupDay >= 43 : null },
+            recent_7d: { total_sent: totalSent, bounced, complained, bounce_rate: `${bounceRate.toFixed(2)}%`, complaint_rate: `${complaintRate.toFixed(3)}%` },
+            health_trend: health.slice(0, 7).map((h) => ({ date: h.check_date, sent: h.total_sent, delivery_rate: h.delivery_rate, bounce_rate: h.bounce_rate })),
+            risks,
+            overall: risks.length === 0 ? 'HEALTHY' : risks.some(r => r.startsWith('HIGH')) ? 'CRITICAL' : 'WARNING',
+        });
+    });
+    server.registerTool('performance_report', {
+        description: 'Generate a performance report: delivery/open/click rates, best send times, trends. Optionally group by campaign, site, company, day, or week.',
+        inputSchema: {
+            days: z.number().int().min(1).max(365).optional().describe('Lookback period in days, default 30'),
+            site_id: z.string().uuid().optional(),
+            campaign_id: z.string().uuid().optional(),
+            group_by: z.enum(['campaign', 'site', 'company', 'day', 'week']).optional(),
+        },
+    }, async ({ days = 30, site_id, campaign_id, group_by }) => {
+        const projectId = getProjectId();
+        const since = new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString();
+        let q = db()
+            .from('email_log')
+            .select('id, site_id, campaign_id, contact_id, status, category, sent_at, opened_at, clicked_at, bounced_at, complained_at')
+            .eq('project_id', projectId)
+            .gte('sent_at', since);
+        if (site_id)
+            q = q.eq('site_id', site_id);
+        if (campaign_id)
+            q = q.eq('campaign_id', campaign_id);
+        const { data: logs, error } = await q;
+        if (error)
+            return txt(`Error: ${error.message}`);
+        const rows = logs ?? [];
+        if (!rows.length)
+            return j({ message: `No email activity in the last ${days} days.`, total: 0 });
+        const computeMetrics = (set) => {
+            const total = set.length;
+            const delivered = set.filter(r => ['delivered', 'opened', 'clicked'].includes(r.status)).length;
+            const opened = set.filter(r => r.opened_at).length;
+            const clicked = set.filter(r => r.clicked_at).length;
+            const bounced = set.filter(r => r.status === 'bounced').length;
+            const complained = set.filter(r => r.status === 'complained').length;
+            return {
+                total_sent: total, delivered, opened, clicked, bounced, complained,
+                delivery_rate: total > 0 ? `${((delivered / total) * 100).toFixed(1)}%` : 'N/A',
+                open_rate: total > 0 ? `${((opened / total) * 100).toFixed(1)}%` : 'N/A',
+                click_rate: total > 0 ? `${((clicked / total) * 100).toFixed(1)}%` : 'N/A',
+                bounce_rate: total > 0 ? `${((bounced / total) * 100).toFixed(1)}%` : 'N/A',
+                complaint_rate: total > 0 ? `${((complained / total) * 100).toFixed(3)}%` : 'N/A',
+                click_to_open: opened > 0 ? `${((clicked / opened) * 100).toFixed(1)}%` : 'N/A',
+            };
+        };
+        const overall = computeMetrics(rows);
+        const hourBuckets = {};
+        rows.forEach((r) => {
+            if (!r.sent_at)
+                return;
+            const hour = new Date(r.sent_at).getUTCHours();
+            if (!hourBuckets[hour])
+                hourBuckets[hour] = { sent: 0, opened: 0 };
+            hourBuckets[hour].sent++;
+            if (r.opened_at)
+                hourBuckets[hour].opened++;
+        });
+        const bestHours = Object.entries(hourBuckets)
+            .map(([hour, b]) => ({ hour: Number(hour), sent: b.sent, open_rate: b.sent > 0 ? (b.opened / b.sent * 100) : 0 }))
+            .filter(h => h.sent >= 5)
+            .sort((a, b) => b.open_rate - a.open_rate)
+            .slice(0, 3)
+            .map(h => ({ hour_utc: h.hour, sent: h.sent, open_rate: `${h.open_rate.toFixed(1)}%` }));
+        let grouped = null;
+        if (group_by === 'campaign' || group_by === 'site') {
+            const byKey = {};
+            rows.forEach((r) => {
+                const key = (group_by === 'campaign' ? r.campaign_id : r.site_id) ?? '(none)';
+                if (!byKey[key])
+                    byKey[key] = [];
+                byKey[key].push(r);
+            });
+            grouped = Object.entries(byKey).map(([id, set]) => ({
+                [`${group_by}_id`]: id,
+                ...computeMetrics(set),
+            })).sort((a, b) => b.total_sent - a.total_sent);
+        }
+        else if (group_by === 'company') {
+            const contactIds = [...new Set(rows.map((row) => typeof row.contact_id === 'string' ? row.contact_id : null).filter(Boolean))];
+            const companyByContact = new Map();
+            if (contactIds.length > 0) {
+                const { data: subscribers } = await db()
+                    .from('subscribers')
+                    .select('id, company_id, company:companies(name, domain)')
+                    .eq('project_id', projectId)
+                    .in('id', contactIds);
+                for (const subscriber of subscribers ?? []) {
+                    const company = Array.isArray(subscriber.company) ? subscriber.company[0] : subscriber.company;
+                    companyByContact.set(subscriber.id, {
+                        company_id: typeof subscriber.company_id === 'string' ? subscriber.company_id : null,
+                        company_name: typeof company?.name === 'string' ? company.name : null,
+                        company_domain: typeof company?.domain === 'string' ? company.domain : null,
+                    });
+                }
+            }
+            const byCompany = new Map();
+            rows.forEach((row) => {
+                const company = typeof row.contact_id === 'string' ? companyByContact.get(row.contact_id) : null;
+                const key = company?.company_id ?? '(none)';
+                const current = byCompany.get(key) ?? { id: company?.company_id ?? null, name: company?.company_name ?? null, domain: company?.company_domain ?? null, rows: [] };
+                current.rows.push(row);
+                byCompany.set(key, current);
+            });
+            grouped = Array.from(byCompany.values()).map((entry) => ({
+                company_id: entry.id,
+                company_name: entry.name,
+                company_domain: entry.domain,
+                ...computeMetrics(entry.rows),
+            })).sort((a, b) => b.total_sent - a.total_sent);
+        }
+        else if (group_by === 'day' || group_by === 'week') {
+            const byPeriod = {};
+            rows.forEach((r) => {
+                if (!r.sent_at)
+                    return;
+                const d = new Date(r.sent_at);
+                let key;
+                if (group_by === 'week') {
+                    const weekStart = new Date(d);
+                    weekStart.setUTCDate(weekStart.getUTCDate() - weekStart.getUTCDay());
+                    key = weekStart.toISOString().slice(0, 10);
+                }
+                else {
+                    key = d.toISOString().slice(0, 10);
+                }
+                if (!byPeriod[key])
+                    byPeriod[key] = [];
+                byPeriod[key].push(r);
+            });
+            grouped = Object.entries(byPeriod).sort(([a], [b]) => a.localeCompare(b)).map(([period, set]) => ({ period, ...computeMetrics(set) }));
+        }
+        const midpoint = new Date(Date.now() - (days / 2) * 24 * 60 * 60 * 1000).toISOString();
+        const firstHalf = rows.filter((r) => r.sent_at < midpoint);
+        const secondHalf = rows.filter((r) => r.sent_at >= midpoint);
+        const firstMetrics = computeMetrics(firstHalf);
+        const secondMetrics = computeMetrics(secondHalf);
+        const trend = {};
+        const parseRate = (s) => parseFloat(s) || 0;
+        if (firstHalf.length > 0 && secondHalf.length > 0) {
+            trend.open_rate = `${(parseRate(secondMetrics.open_rate) - parseRate(firstMetrics.open_rate) >= 0 ? '+' : '')}${(parseRate(secondMetrics.open_rate) - parseRate(firstMetrics.open_rate)).toFixed(1)}pp`;
+            trend.click_rate = `${(parseRate(secondMetrics.click_rate) - parseRate(firstMetrics.click_rate) >= 0 ? '+' : '')}${(parseRate(secondMetrics.click_rate) - parseRate(firstMetrics.click_rate)).toFixed(1)}pp`;
+            trend.volume = `${firstHalf.length} → ${secondHalf.length} emails`;
+        }
+        return j({
+            period: `Last ${days} days`,
+            overall,
+            best_send_times_utc: bestHours,
+            trend_vs_prior_period: trend,
+            ...(grouped ? { [`by_${group_by}`]: grouped } : {}),
+        });
+    });
+    // ── Cross-project analytics ─────────────────────────────────────────────
+    server.registerTool('get_portfolio_stats', {
+        description: 'Aggregate email metrics across all projects in your organization. Returns per-project and combined totals for the specified period. Useful for orchestrators managing multiple products.',
+        inputSchema: {
+            days: z.number().int().min(1).max(90).optional().default(30).describe('Lookback period in days (default: 30)'),
+        },
+    }, async ({ days }) => {
+        const projectId = getProjectId();
+        // Look up org
+        const { data: project } = await adminDb()
+            .from('projects')
+            .select('id, name, org_id')
+            .eq('id', projectId)
+            .maybeSingle();
+        if (!project)
+            return txt('Project not found');
+        // Get all projects in org
+        let projects;
+        if (project.org_id) {
+            const { data } = await adminDb()
+                .from('projects')
+                .select('id, name')
+                .eq('org_id', project.org_id)
+                .order('name');
+            projects = data ?? [{ id: project.id, name: project.name }];
+        }
+        else {
+            projects = [{ id: project.id, name: project.name }];
+        }
+        // Get org info
+        const org = project.org_id
+            ? (await adminDb().from('organizations').select('name, plan').eq('id', project.org_id).maybeSingle()).data
+            : null;
+        const since = new Date(Date.now() - days * 86_400_000).toISOString();
+        const results = [];
+        for (const proj of projects) {
+            try {
+                // Resolve per-project client (BYOD-aware)
+                const client = await resolveProjectClient(proj.id);
+                const projDb = client ?? adminDb();
+                const { data: logs } = await projDb
+                    .from('email_log')
+                    .select('status, opened_at, clicked_at')
+                    .eq('project_id', proj.id)
+                    .gte('sent_at', since);
+                const rows = logs ?? [];
+                const sent = rows.length;
+                const delivered = rows.filter((r) => ['delivered', 'opened', 'clicked'].includes(r.status)).length;
+                const opened = rows.filter((r) => r.opened_at).length;
+                const clicked = rows.filter((r) => r.clicked_at).length;
+                const bounced = rows.filter((r) => r.status === 'bounced').length;
+                const complained = rows.filter((r) => r.status === 'complained').length;
+                results.push({
+                    project_id: proj.id,
+                    name: proj.name,
+                    sent,
+                    delivered,
+                    opened,
+                    clicked,
+                    bounced,
+                    complained,
+                    open_rate: sent > 0 ? Math.round((opened / sent) * 1000) / 10 : 0,
+                    click_rate: sent > 0 ? Math.round((clicked / sent) * 1000) / 10 : 0,
+                });
+            }
+            catch {
+                results.push({
+                    project_id: proj.id,
+                    name: proj.name,
+                    sent: 0, delivered: 0, opened: 0, clicked: 0, bounced: 0, complained: 0,
+                    open_rate: 0, click_rate: 0,
+                });
+            }
+        }
+        const totals = {
+            sent: results.reduce((s, r) => s + r.sent, 0),
+            delivered: results.reduce((s, r) => s + r.delivered, 0),
+            opened: results.reduce((s, r) => s + r.opened, 0),
+            clicked: results.reduce((s, r) => s + r.clicked, 0),
+            bounced: results.reduce((s, r) => s + r.bounced, 0),
+            complained: results.reduce((s, r) => s + r.complained, 0),
+        };
+        return j({
+            organization: org ? { name: org.name, plan: org.plan } : null,
+            period: `last_${days}_days`,
+            projects: results,
+            totals: {
+                ...totals,
+                open_rate: totals.sent > 0 ? Math.round((totals.opened / totals.sent) * 1000) / 10 : 0,
+                click_rate: totals.sent > 0 ? Math.round((totals.clicked / totals.sent) * 1000) / 10 : 0,
+            },
+        });
+    });
+    server.registerTool('abuse_monitor_status', {
+        description: 'Return per-tenant abuse monitor metrics for a site, including complaint rate and pause level.',
+        inputSchema: {
+            siteId: z.string().uuid(),
+        },
+    }, async ({ siteId }) => {
+        const { data: site, error: siteErr } = await db()
+            .from('sites')
+            .select('id')
+            .eq('id', siteId)
+            .eq('project_id', getProjectId())
+            .maybeSingle();
+        if (siteErr || !site)
+            return j({ error: siteErr?.message ?? 'Site not found', code: 'NOT_FOUND' });
+        const { data, error } = await db()
+            .from('tenant_email_metrics')
+            .select('site_id, window_30d_sent, window_30d_complaints, window_30d_opens, complaint_rate, pause_level, paused_at, pause_reason, updated_at')
+            .eq('site_id', siteId)
+            .maybeSingle();
+        if (error)
+            return j({ error: error.message });
+        const since = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString();
+        const { count: reputationSignals30d, error: reputationErr } = await db()
+            .from('email_events')
+            .select('id', { count: 'exact', head: true })
+            .eq('site_id', siteId)
+            .eq('event_type', 'bounce')
+            .eq('bounce_category', 'reputation_signal')
+            .gte('occurred_at', since);
+        if (reputationErr)
+            return j({ error: reputationErr.message });
+        return j({
+            site_id: siteId,
+            metrics: data ?? null,
+            reputation_signals_30d: reputationSignals30d ?? 0,
+        });
+    });
+    server.registerTool('abuse_monitor_override', {
+        description: 'Create a temporary abuse monitor override for a paused site. Overrides expire automatically and are capped at 72 hours.',
+        inputSchema: {
+            siteId: z.string().uuid(),
+            reason: z.string().min(3).max(500),
+            ttlHours: z.number().int().min(1).max(72),
+        },
+    }, async ({ siteId, reason, ttlHours }) => {
+        const projectId = getProjectId();
+        const { data: site, error: siteErr } = await db()
+            .from('sites')
+            .select('id')
+            .eq('id', siteId)
+            .eq('project_id', projectId)
+            .maybeSingle();
+        if (siteErr || !site)
+            return j({ error: siteErr?.message ?? 'Site not found', code: 'NOT_FOUND' });
+        const expiresAt = new Date(Date.now() + ttlHours * 3600 * 1000).toISOString();
+        const { data: metrics } = await db()
+            .from('tenant_email_metrics')
+            .select('complaint_rate, pause_level')
+            .eq('site_id', siteId)
+            .maybeSingle();
+        const { error } = await db().from('audit_log').insert({
+            project_id: projectId,
+            actor_type: 'mcp_tool',
+            actor_id: 'abuse_monitor_override',
+            action: 'abuse_override',
+            resource_type: 'site',
+            resource_id: siteId,
+            entity_id: siteId,
+            metadata: { reason, expires_at: expiresAt },
+            details: { reason, expires_at: expiresAt },
+        });
+        if (error)
+            return j({ error: error.message });
+        return j({
+            ok: true,
+            site_id: siteId,
+            expires_at: expiresAt,
+            complaint_rate: metrics?.complaint_rate ?? null,
+            pause_level: metrics?.pause_level ?? null,
+            warning: Number(metrics?.complaint_rate ?? 0) >= 0.001
+                ? 'Complaint rate is still at or above 0.10%; use this override only for verified false positives.'
+                : null,
+        });
+    });
+    server.registerTool('get_site_insights', {
+        description: 'Get pre-computed AI insights for a site — anomalies, deliverability alerts, send-time recommendations, and attribution summaries. Call this before making campaign decisions to check for active warnings.',
+        inputSchema: {
+            site_id: z.string().uuid().describe('Site UUID'),
+            include_dismissed: z.boolean().optional().default(false),
+        },
+    }, async ({ site_id, include_dismissed }) => {
+        const projectId = getProjectId();
+        const { data: site, error: siteError } = await db()
+            .from('sites')
+            .select('id')
+            .eq('project_id', projectId)
+            .eq('id', site_id)
+            .maybeSingle();
+        if (siteError)
+            return txt(`Error: ${siteError.message}`);
+        if (!site)
+            return j({ error: 'Site not found', code: 'NOT_FOUND' });
+        let q = db()
+            .from('ai_insights')
+            .select('id, site_id, type, severity, headline, detail, action, evidence, dismissed_at, acted_at, generated_at')
+            .eq('project_id', projectId)
+            .or(`site_id.is.null,site_id.eq.${site_id}`)
+            .order('generated_at', { ascending: false })
+            .limit(10);
+        if (!include_dismissed)
+            q = q.is('dismissed_at', null);
+        const { data, error } = await q;
+        if (error)
+            return txt(`Error: ${error.message}`);
+        const rank = { critical: 0, warning: 1, info: 2 };
+        return j((data ?? []).sort((a, b) => (rank[a.severity] ?? 9) - (rank[b.severity] ?? 9)));
+    });
+    server.registerTool('create_social_campaign', {
+        description: 'Create a social media campaign with a UTM-tracked link. Returns the tracked URL to paste into the social post.',
+        inputSchema: {
+            name: z.string(),
+            platform: z.enum(['instagram', 'linkedin', 'twitter', 'facebook', 'tiktok', 'youtube', 'pinterest', 'uploadpost', 'other']),
+            destination_url: z.string().url(),
+            site_id: z.string().uuid().optional(),
+            utm_campaign: z.string().optional(),
+            utm_content: z.string().optional(),
+            notes: z.string().optional(),
+        },
+    }, async (p) => {
+        const projectId = getProjectId();
+        const utm = buildSocialTrackedUrl(p);
+        const insert = {
+            project_id: projectId,
+            site_id: p.site_id ?? null,
+            name: p.name,
+            platform: p.platform,
+            destination_url: p.destination_url,
+            utm_source: utm.utm_source,
+            utm_medium: utm.utm_medium,
+            utm_campaign: utm.utm_campaign,
+            utm_content: p.utm_content ?? null,
+            tracked_url: utm.tracked_url,
+            notes: p.notes ?? null,
+            status: 'draft',
+        };
+        const { data, error } = await db().from('social_campaigns').insert(insert).select().single();
+        if (error)
+            return txt(`Error: ${error.message}`);
+        return j({ id: data.id, tracked_url: data.tracked_url, campaign: data });
+    });
+    server.registerTool('list_social_campaigns', {
+        description: 'List social campaigns with their signup attribution and manual metrics. Use to compare channel performance.',
+        inputSchema: {
+            site_id: z.string().uuid().optional(),
+            status: z.enum(['active', 'paused', 'completed']).optional(),
+        },
+    }, async (p) => {
+        const projectId = getProjectId();
+        await db().rpc('refresh_social_signups', { p_project_id: projectId });
+        let q = db()
+            .from('social_campaigns')
+            .select('id, site_id, name, platform, status, tracked_url, utm_source, utm_campaign, signups_attributed, impressions, engagements, link_clicks, publisher, publisher_post_id, publish_status, publish_error, scheduled_at, published_at, created_at')
+            .eq('project_id', projectId)
+            .order('created_at', { ascending: false });
+        if (p.site_id)
+            q = q.eq('site_id', p.site_id);
+        if (p.status)
+            q = q.eq('status', p.status);
+        const { data, error } = await q;
+        if (error)
+            return txt(`Error: ${error.message}`);
+        return j({ campaigns: data ?? [] });
+    });
+    server.registerTool('schedule_social_post', {
+        description: 'Schedule a social campaign post via a connected BYO publisher (UploadPost, Buffer). Returns publisherPostId on success.',
+        inputSchema: {
+            campaign_id: z.string().uuid().describe('UUID of the social campaign in Sendinel'),
+            content: z.string().min(1).describe('Post body text'),
+            publisher: z.enum(socialPublishers).describe('Which BYO publisher to route through'),
+            scheduled_at: z.string().optional().describe('ISO 8601 datetime. Omit for immediate publish.'),
+            media_urls: z.array(z.string().url()).optional().describe('Optional image/video URLs'),
+        },
+    }, async (p) => {
+        const projectId = getProjectId();
+        const scheduledAt = p.scheduled_at ? new Date(p.scheduled_at) : undefined;
+        if (scheduledAt && Number.isNaN(scheduledAt.getTime()))
+            return txt('Error: scheduled_at must be a valid ISO 8601 datetime.');
+        const admin = adminDb();
+        const { data: campaign, error: campaignError } = await admin
+            .from('social_campaigns')
+            .select('id, project_id, platform, tracked_url')
+            .eq('project_id', projectId)
+            .eq('id', p.campaign_id)
+            .maybeSingle();
+        if (campaignError)
+            return txt(`Error: ${campaignError.message}`);
+        if (!campaign)
+            return j({ error: 'Campaign not found', code: 'NOT_FOUND' });
+        const { data: project, error: projectError } = await admin
+            .from('projects')
+            .select('org_id')
+            .eq('id', campaign.project_id)
+            .maybeSingle();
+        if (projectError)
+            return txt(`Error: ${projectError.message}`);
+        if (!project?.org_id)
+            return j({ error: 'Project not found', code: 'NOT_FOUND' });
+        const { data: connection, error: connectionError } = await admin
+            .from('social_platform_connections')
+            .select('encrypted_access_token')
+            .eq('org_id', project.org_id)
+            .eq('platform', p.publisher)
+            .maybeSingle();
+        if (connectionError)
+            return txt(`Error: ${connectionError.message}`);
+        if (!connection?.encrypted_access_token) {
+            return j({ error: `No ${p.publisher} connection found. Connect it in Settings -> Integrations.`, code: 'NO_CONNECTION' });
+        }
+        try {
+            const result = await publishViaByoPublisher(p.publisher, decrypt(connection.encrypted_access_token), {
+                content: p.content,
+                platform: campaign.platform,
+                scheduledAt,
+                mediaUrls: p.media_urls,
+                link: campaign.tracked_url,
+            });
+            const publishStatus = result.scheduledAt || scheduledAt ? 'scheduled' : 'published';
+            const { error: updateError } = await admin
+                .from('social_campaigns')
+                .update({
+                publisher: p.publisher,
+                publisher_post_id: result.publisherPostId,
+                scheduled_at: result.scheduledAt?.toISOString() ?? scheduledAt?.toISOString() ?? null,
+                publish_status: publishStatus,
+                publish_error: null,
+                platform_post_url: result.postUrl ?? null,
+                status: 'active',
+                updated_at: new Date().toISOString(),
+            })
+                .eq('project_id', projectId)
+                .eq('id', p.campaign_id);
+            if (updateError)
+                return txt(`Error: ${updateError.message}`);
+            return j({ success: true, publisherPostId: result.publisherPostId, publish_status: publishStatus, post_url: result.postUrl ?? null });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Publish failed';
+            await admin
+                .from('social_campaigns')
+                .update({
+                publisher: p.publisher,
+                publish_status: 'failed',
+                publish_error: message.slice(0, 500),
+                updated_at: new Date().toISOString(),
+            })
+                .eq('project_id', projectId)
+                .eq('id', p.campaign_id);
+            return txt(`Error: ${message}`);
+        }
+    });
+}