@socialneuron/mcp-server 1.7.12 → 1.7.15

package/dist/http.js

@@ -1,60 +1,18 @@
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/lib/posthog.ts
-import { createHash } from "node:crypto";
-import { PostHog } from "posthog-node";
-function hashUserId(userId) {
-  return createHash("sha256").update(`${POSTHOG_SALT}:${userId}`).digest("hex").substring(0, 32);
-}
-function initPostHog() {
-  if (isTelemetryDisabled()) return;
-  const key = process.env.POSTHOG_KEY || process.env.VITE_POSTHOG_KEY;
-  const host = process.env.POSTHOG_HOST || process.env.VITE_POSTHOG_HOST || "https://eu.i.posthog.com";
-  if (!key) return;
-  client = new PostHog(key, { host, flushAt: 5, flushInterval: 1e4 });
-}
-async function captureToolEvent(args) {
-  if (!client) return;
-  let userId;
-  try {
-    userId = await getDefaultUserId();
-  } catch {
-    userId = "anonymous_mcp";
-  }
-  client.capture({
-    distinctId: hashUserId(userId),
-    event: `mcp_tool_${args.status}`,
-    properties: {
-      tool_name: args.toolName,
-      duration_ms: args.durationMs,
-      ...args.details
-    }
-  });
-}
-async function shutdownPostHog() {
-  if (client) {
-    await client.shutdown();
-    client = null;
-  }
-}
-var POSTHOG_SALT, client;
-var init_posthog = __esm({
-  "src/lib/posthog.ts"() {
-    "use strict";
-    init_supabase();
-    POSTHOG_SALT = "socialneuron-mcp-ph-v1";
-    client = null;
-  }
-});
-
 // src/lib/request-context.ts
 import { AsyncLocalStorage } from "node:async_hooks";
 function getRequestUserId() {
@@ -291,83 +249,12 @@ var init_credentials = __esm({
   }
 });
 
-// src/lib/validation-cache.ts
-var validation_cache_exports = {};
-__export(validation_cache_exports, {
-  clearValidationCache: () => clearValidationCache,
-  keyFingerprint: () => keyFingerprint,
-  readValidationCache: () => readValidationCache,
-  writeValidationCache: () => writeValidationCache
-});
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, chmodSync } from "node:fs";
-import { join as join2 } from "node:path";
-import { homedir as homedir2 } from "node:os";
-function keyFingerprint(apiKey) {
-  return apiKey.substring(0, 6) + "..." + apiKey.slice(-4);
-}
-function readValidationCache(apiKey) {
-  try {
-    const raw = readFileSync2(CACHE_FILE, "utf-8");
-    const cached = JSON.parse(raw);
-    if (cached.keyFingerprint !== keyFingerprint(apiKey)) {
-      return null;
-    }
-    if (Date.now() - cached.cachedAt > CACHE_TTL_MS) {
-      return null;
-    }
-    if (!cached.result.valid) {
-      return null;
-    }
-    if (cached.result.expiresAt) {
-      const expiresMs = new Date(cached.result.expiresAt).getTime();
-      if (expiresMs <= Date.now()) {
-        return null;
-      }
-    }
-    return cached.result;
-  } catch {
-    return null;
-  }
-}
-function writeValidationCache(apiKey, result) {
-  if (!result.valid) return;
-  try {
-    mkdirSync2(CONFIG_DIR2, { recursive: true });
-    const entry = {
-      keyFingerprint: keyFingerprint(apiKey),
-      result,
-      cachedAt: Date.now()
-    };
-    writeFileSync2(CACHE_FILE, JSON.stringify(entry, null, 2), { mode: 384 });
-    try {
-      chmodSync(CACHE_FILE, 384);
-    } catch {
-    }
-  } catch {
-  }
-}
-function clearValidationCache() {
-  try {
-    writeFileSync2(CACHE_FILE, "{}", { mode: 384 });
-  } catch {
-  }
-}
-var CONFIG_DIR2, CACHE_FILE, CACHE_TTL_MS;
-var init_validation_cache = __esm({
-  "src/lib/validation-cache.ts"() {
-    "use strict";
-    CONFIG_DIR2 = join2(homedir2(), ".config", "socialneuron");
-    CACHE_FILE = join2(CONFIG_DIR2, "validation-cache.json");
-    CACHE_TTL_MS = 5 * 60 * 1e3;
-  }
-});
-
 // src/auth/api-keys.ts
 var api_keys_exports = {};
 __export(api_keys_exports, {
   validateApiKey: () => validateApiKey
 });
-async function validateApiKey(apiKey) {
+async function validateApiKey(apiKey, _attempt = 0) {
   const supabaseUrl = getSupabaseUrl();
   try {
     const anonKey = process.env.SUPABASE_ANON_KEY || process.env.SOCIALNEURON_ANON_KEY || process.env.VITE_SUPABASE_ANON_KEY || CLOUD_SUPABASE_ANON_KEY;
@@ -384,21 +271,90 @@ async function validateApiKey(apiKey) {
     );
     if (!response.ok) {
       const text = await response.text();
-      return { valid: false, error: `Validation failed: ${text}` };
+      const retryable = response.status === 429 || response.status >= 500;
+      if (retryable && _attempt < VALIDATE_MAX_RETRIES) {
+        await sleep(300 * (_attempt + 1));
+        return validateApiKey(apiKey, _attempt + 1);
+      }
+      return {
+        valid: false,
+        retryable,
+        error: `Validation failed (HTTP ${response.status}): ${text}`
+      };
     }
-    const result = await response.json();
-    return result;
+    return await response.json();
   } catch (err) {
+    if (_attempt < VALIDATE_MAX_RETRIES) {
+      await sleep(300 * (_attempt + 1));
+      return validateApiKey(apiKey, _attempt + 1);
+    }
     return {
       valid: false,
+      retryable: true,
       error: err instanceof Error ? err.message : String(err)
     };
   }
 }
+var VALIDATE_MAX_RETRIES, sleep;
 var init_api_keys = __esm({
   "src/auth/api-keys.ts"() {
     "use strict";
     init_supabase();
+    VALIDATE_MAX_RETRIES = 2;
+    sleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
+  }
+});
+
+// src/lib/posthog.ts
+var posthog_exports = {};
+__export(posthog_exports, {
+  captureToolEvent: () => captureToolEvent,
+  initPostHog: () => initPostHog,
+  shutdownPostHog: () => shutdownPostHog
+});
+import { createHash } from "node:crypto";
+import { PostHog } from "posthog-node";
+function hashUserId(userId) {
+  return createHash("sha256").update(`${POSTHOG_SALT}:${userId}`).digest("hex").substring(0, 32);
+}
+function initPostHog() {
+  if (isTelemetryDisabled()) return;
+  const key = process.env.POSTHOG_KEY || process.env.VITE_POSTHOG_KEY;
+  const host = process.env.POSTHOG_HOST || process.env.VITE_POSTHOG_HOST || "https://eu.i.posthog.com";
+  if (!key) return;
+  client = new PostHog(key, { host, flushAt: 5, flushInterval: 1e4 });
+}
+async function captureToolEvent(args) {
+  if (!client) return;
+  let userId;
+  try {
+    userId = await getDefaultUserId();
+  } catch {
+    userId = "anonymous_mcp";
+  }
+  client.capture({
+    distinctId: hashUserId(userId),
+    event: `mcp_tool_${args.status}`,
+    properties: {
+      tool_name: args.toolName,
+      duration_ms: args.durationMs,
+      ...args.details
+    }
+  });
+}
+async function shutdownPostHog() {
+  if (client) {
+    await client.shutdown();
+    client = null;
+  }
+}
+var POSTHOG_SALT, client;
+var init_posthog = __esm({
+  "src/lib/posthog.ts"() {
+    "use strict";
+    init_supabase();
+    POSTHOG_SALT = "socialneuron-mcp-ph-v1";
+    client = null;
   }
 });
 
@@ -464,8 +420,8 @@ async function getDefaultUserId() {
 async function getDefaultProjectId() {
   const userId = await getDefaultUserId().catch(() => null);
   if (userId) {
-    const cached = projectIdCache.get(userId);
-    if (cached) return cached;
+    const cached2 = projectIdCache.get(userId);
+    if (cached2) return cached2;
   }
   const envProjectId = process.env.SOCIALNEURON_PROJECT_ID;
   if (envProjectId) {
@@ -475,7 +431,10 @@ async function getDefaultProjectId() {
   if (!userId) return null;
   try {
     const supabase = getSupabaseClient();
-    const { data } = await supabase.from("projects").select("id").eq("user_id", userId).order("created_at", { ascending: false }).limit(1).single();
+    const { data: memberships } = await supabase.from("organization_members").select("organization_id").eq("user_id", userId);
+    const orgIds = (memberships ?? []).map((m) => m.organization_id);
+    if (orgIds.length === 0) return null;
+    const { data } = await supabase.from("projects").select("id").in("organization_id", orgIds).order("created_at", { ascending: false }).limit(1).maybeSingle();
     if (data?.id) {
       projectIdCache.set(userId, data.id);
       return data.id;
@@ -489,33 +448,27 @@ async function initializeAuth() {
   const apiKey = await loadApiKey2();
   if (apiKey) {
     authenticatedApiKey = apiKey;
-    const { readValidationCache: readValidationCache2, writeValidationCache: writeValidationCache2 } = await Promise.resolve().then(() => (init_validation_cache(), validation_cache_exports));
-    const cached = readValidationCache2(apiKey);
-    let result;
-    if (cached) {
-      result = cached;
-      console.error("[MCP] Using cached validation (skip remote check)");
-    } else {
-      const { validateApiKey: validateApiKey2 } = await Promise.resolve().then(() => (init_api_keys(), api_keys_exports));
-      result = await validateApiKey2(apiKey);
-      if (result.valid) {
-        writeValidationCache2(apiKey, result);
-      }
-    }
+    const _quietAuth = !process.argv.includes("--verbose") && (process.env.SN_CLI_QUIET === "1" || ["setup", "login", "logout", "whoami", "health", "sn", "repl"].includes(
+      process.argv[2] ?? ""
+    ));
+    const { validateApiKey: validateApiKey2 } = await Promise.resolve().then(() => (init_api_keys(), api_keys_exports));
+    const result = await validateApiKey2(apiKey);
     if (result.valid && result.userId) {
       _authMode = "api-key";
       authenticatedUserId = result.userId;
       authenticatedScopes = result.scopes && result.scopes.length > 0 ? result.scopes : ["mcp:read"];
       authenticatedEmail = result.email || null;
       authenticatedExpiresAt = result.expiresAt || null;
-      console.error(
-        "[MCP] Authenticated via API key (prefix: " + apiKey.substring(0, 6) + "..." + apiKey.slice(-4) + ")"
-      );
-      console.error("[MCP] Scopes: " + authenticatedScopes.join(", "));
+      if (!_quietAuth) {
+        console.error(
+          "[MCP] Authenticated via API key (prefix: " + apiKey.substring(0, 6) + "..." + apiKey.slice(-4) + ")"
+        );
+        console.error("[MCP] Scopes: " + authenticatedScopes.join(", "));
+      }
       if (authenticatedExpiresAt) {
         const expiresMs = new Date(authenticatedExpiresAt).getTime();
         const daysLeft = Math.ceil((expiresMs - Date.now()) / (1e3 * 60 * 60 * 24));
-        console.error("[MCP] Key expires: " + authenticatedExpiresAt);
+        if (!_quietAuth) console.error("[MCP] Key expires: " + authenticatedExpiresAt);
         if (daysLeft <= 7) {
           console.error(
             `[MCP] Warning: API key expires in ${daysLeft} day(s). Run: npx @socialneuron/mcp-server login`
@@ -525,8 +478,13 @@ async function initializeAuth() {
       return;
     } else {
       authenticatedApiKey = null;
+      if (result.retryable) {
+        throw new Error(
+          "Temporary issue reaching the auth service \u2014 your session is likely still valid. Wait a moment and retry. If it persists, run `sn login`."
+        );
+      }
       throw new Error(
-        "[MCP] Fatal: API key invalid or expired. Run: npx @socialneuron/mcp-server setup"
+        "API key invalid, expired, or revoked. Run `sn login` to reconnect (or `socialneuron-mcp login`)."
       );
     }
   }
@@ -583,14 +541,13 @@ async function logMcpToolInvocation(args) {
     });
   } catch {
   }
-  captureToolEvent(args).catch(() => {
+  Promise.resolve().then(() => (init_posthog(), posthog_exports)).then(({ captureToolEvent: captureToolEvent2 }) => captureToolEvent2(args)).catch(() => {
   });
 }
 var SUPABASE_URL, SUPABASE_SERVICE_KEY, client2, _authMode, authenticatedUserId, authenticatedScopes, authenticatedEmail, authenticatedExpiresAt, authenticatedApiKey, MCP_RUN_ID, CLOUD_SUPABASE_URL, CLOUD_SUPABASE_ANON_KEY, projectIdCache;
 var init_supabase = __esm({
   "src/lib/supabase.ts"() {
     "use strict";
-    init_posthog();
     init_request_context();
     SUPABASE_URL = process.env.SOCIALNEURON_SUPABASE_URL || process.env.SUPABASE_URL || "";
     SUPABASE_SERVICE_KEY = process.env.SOCIALNEURON_SERVICE_KEY || process.env.SUPABASE_SERVICE_ROLE_KEY || "";
@@ -611,7 +568,7 @@ var init_supabase = __esm({
 // src/http.ts
 import express from "express";
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import {
   mcpAuthRouter,
@@ -720,6 +677,8 @@ var TOOL_SCOPES = {
   get_mcp_usage: "mcp:read",
   list_plan_approvals: "mcp:read",
   search_tools: "mcp:read",
+  search: "mcp:read",
+  fetch: "mcp:read",
   // mcp:read (pipeline readiness + status are read-only)
   check_pipeline_readiness: "mcp:read",
   get_pipeline_status: "mcp:read",
@@ -747,7 +706,13 @@ var TOOL_SCOPES = {
   record_intel_signal: "mcp:write",
   record_campaign_spend: "mcp:write",
   // mcp:read
-  get_active_campaigns: "mcp:read"
+  get_active_campaigns: "mcp:read",
+  // mcp:read / mcp:write (Skills)
+  list_skills: "mcp:read",
+  run_skill: "mcp:write",
+  // mcp:read (Loop observability — growth-loop KPIs + content learning state)
+  get_loop_pulse: "mcp:read",
+  get_bandit_state: "mcp:read"
 };
 function hasScope(userScopes, required) {
   if (userScopes.includes(required)) return true;
@@ -847,6 +812,10 @@ var OVERRIDES = {
   generate_performance_digest: { readOnlyHint: true, destructiveHint: false, idempotentHint: true },
   detect_anomalies: { readOnlyHint: true, destructiveHint: false, idempotentHint: true }
 };
+function buildToolSecuritySchemes(toolName) {
+  const scope = TOOL_SCOPES[toolName];
+  return scope ? [{ type: "oauth2", scopes: [scope] }] : [];
+}
 function buildAnnotationsMap() {
   const map = /* @__PURE__ */ new Map();
   for (const [toolName, scope] of Object.entries(TOOL_SCOPES)) {
@@ -891,17 +860,37 @@ function applyAnnotations(server) {
           destructiveHint: ann.destructiveHint,
           idempotentHint: ann.idempotentHint,
           openWorldHint: ann.openWorldHint
-        }
+        },
+        securitySchemes: buildToolSecuritySchemes(toolName)
       });
       applied++;
     }
   }
-  console.log(`[annotations] Applied annotations to ${applied}/${entries.length} tools`);
+  console.error(`[annotations] Applied annotations to ${applied}/${entries.length} tools`);
 }
 
 // src/lib/register-tools.ts
 init_supabase();
 
+// src/lib/www-authenticate.ts
+function buildWwwAuthenticateHeader(opts) {
+  const SANITIZE_CONTROL = /[\x00-\x1f\x7f]/g;
+  const sanitize = (s) => s.replace(/[\\"]/g, "_").replace(SANITIZE_CONTROL, " ");
+  const params = ['realm="socialneuron"'];
+  if (opts.error) {
+    params.push(`error="${sanitize(opts.error)}"`);
+  }
+  if (opts.errorDescription) {
+    params.push(`error_description="${sanitize(opts.errorDescription)}"`);
+  }
+  if (opts.scope) {
+    params.push(`scope="${sanitize(opts.scope)}"`);
+  }
+  const issuer = opts.issuerUrl.replace(/\/+$/, "");
+  params.push(`resource_metadata="${issuer}/.well-known/oauth-protected-resource"`);
+  return `Bearer ${params.join(", ")}`;
+}
+
 // src/lib/agent-harness/constants.json
 var constants_default = {
   ZERO_WIDTH_CHARS: "[\\u200B\\u200C\\u200D\\u2060\\uFEFF\\u{E0020}-\\u{E007F}]",
@@ -1112,10 +1101,16 @@ async function callEdgeFunction(functionName, body, options) {
       } catch {
         errorMessage = responseText || `HTTP ${response.status}`;
       }
-      if (response.status === 401 || response.status === 403) {
+      if (response.status === 401) {
+        return {
+          data: null,
+          error: `Authentication failed (HTTP 401). Run 'npx @socialneuron/mcp-server login' to re-authenticate.`
+        };
+      }
+      if (response.status === 403) {
         return {
           data: null,
-          error: `Authentication failed (HTTP ${response.status}). Run 'npx @socialneuron/mcp-server login' to re-authenticate.`
+          error: `Forbidden (HTTP 403): ${errorMessage}. This action isn't permitted for your account, plan, or scope \u2014 your connection is still valid.`
         };
       }
       if (response.status === 429) {
@@ -1216,6 +1211,20 @@ function checkRateLimit(category, key) {
 
 // src/tools/ideation.ts
 init_supabase();
+
+// src/lib/version.ts
+var MCP_VERSION = "1.7.15";
+
+// src/tools/ideation.ts
+function asEnvelope(data) {
+  return {
+    _meta: {
+      version: MCP_VERSION,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    data
+  };
+}
 function registerIdeationTools(server) {
   server.tool(
     "generate_content",
@@ -1377,7 +1386,14 @@ Content Type: ${content_type}`;
         };
       }
       const text = data?.text ?? "(empty response)";
+      const structuredContent = asEnvelope({
+        text,
+        content_type,
+        platform: platform2 ?? null,
+        model: model ?? "gemini-2.5-flash"
+      });
       return {
+        structuredContent,
         content: [{ type: "text", text }]
       };
     }
@@ -1411,7 +1427,10 @@ Content Type: ${content_type}`;
       const { data, error } = await callEdgeFunction(
         "fetch-trends",
         {
-          source,
+          // Forward as `trend_source`: the mcp-gateway overwrites top-level `source`
+          // with 'mcp' (attribution) before reaching the EF, which collided with the
+          // routing param. The EF reads `trend_source ?? source`.
+          trend_source: source,
           category: category ?? "general",
           niche,
           url,
@@ -1580,7 +1599,14 @@ ${content}`,
       const header = `Adapted for ${target_platform}${source_platform ? ` (from ${source_platform})` : ""}:
 
 `;
+      const structuredContent = asEnvelope({
+        text,
+        source_platform: source_platform ?? null,
+        target_platform,
+        model: "gemini-2.5-flash"
+      });
       return {
+        structuredContent,
         content: [{ type: "text", text: header + text }]
       };
     }
@@ -1590,12 +1616,9 @@ ${content}`,
 // src/tools/content.ts
 import { z as z2 } from "zod";
 init_supabase();
-init_request_context();
-
-// src/lib/version.ts
-var MCP_VERSION = "1.7.7";
 
-// src/tools/content.ts
+// src/lib/budget.ts
+init_request_context();
 var MAX_CREDITS_PER_RUN = Math.max(0, Number(process.env.SOCIALNEURON_MAX_CREDITS_PER_RUN || 0));
 var MAX_ASSETS_PER_RUN = Math.max(0, Number(process.env.SOCIALNEURON_MAX_ASSETS_PER_RUN || 0));
 var _globalCreditsUsed = 0;
@@ -1636,7 +1659,35 @@ function getCurrentBudgetStatus() {
     remainingAssets: MAX_ASSETS_PER_RUN > 0 ? Math.max(0, MAX_ASSETS_PER_RUN - assetsGen) : null
   };
 }
-function asEnvelope(data) {
+function checkCreditBudget(estimatedCost) {
+  if (MAX_CREDITS_PER_RUN <= 0) {
+    return { ok: true };
+  }
+  const used = getCreditsUsed();
+  if (used + estimatedCost > MAX_CREDITS_PER_RUN) {
+    return {
+      ok: false,
+      message: `Credit budget exceeded for this MCP run. Used=${used}, next~=${estimatedCost}, limit=${MAX_CREDITS_PER_RUN}.`
+    };
+  }
+  return { ok: true };
+}
+function checkAssetBudget(requestedCount = 1) {
+  if (MAX_ASSETS_PER_RUN <= 0) {
+    return { ok: true };
+  }
+  const generated = getAssetsGenerated();
+  if (generated + requestedCount > MAX_ASSETS_PER_RUN) {
+    return {
+      ok: false,
+      message: `Asset budget exceeded for this MCP run. Generated=${generated}, next=${requestedCount}, limit=${MAX_ASSETS_PER_RUN}.`
+    };
+  }
+  return { ok: true };
+}
+
+// src/tools/content.ts
+function asEnvelope2(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -1663,35 +1714,9 @@ var IMAGE_CREDIT_ESTIMATES = {
   "flux-max": 50,
   "gpt4o-image": 40,
   imagen4: 35,
-  "imagen4-fast": 25,
+  "imagen4-fast": 35,
   seedream: 20
 };
-function checkCreditBudget(estimatedCost) {
-  if (MAX_CREDITS_PER_RUN <= 0) {
-    return { ok: true };
-  }
-  const used = getCreditsUsed();
-  if (used + estimatedCost > MAX_CREDITS_PER_RUN) {
-    return {
-      ok: false,
-      message: `Credit budget exceeded for this MCP run. Used=${used}, next~=${estimatedCost}, limit=${MAX_CREDITS_PER_RUN}.`
-    };
-  }
-  return { ok: true };
-}
-function checkAssetBudget() {
-  if (MAX_ASSETS_PER_RUN <= 0) {
-    return { ok: true };
-  }
-  const generated = getAssetsGenerated();
-  if (generated + 1 > MAX_ASSETS_PER_RUN) {
-    return {
-      ok: false,
-      message: `Asset budget exceeded for this MCP run. Generated=${generated}, next=1, limit=${MAX_ASSETS_PER_RUN}.`
-    };
-  }
-  return { ok: true };
-}
 function registerContentTools(server) {
   server.tool(
     "generate_video",
@@ -1810,7 +1835,7 @@ function registerContentTools(server) {
             {
               type: "text",
               text: JSON.stringify(
-                asEnvelope({
+                asEnvelope2({
                   jobId,
                   taskId: data.taskId,
                   asyncJobId: data.asyncJobId,
@@ -1940,7 +1965,7 @@ function registerContentTools(server) {
             {
               type: "text",
               text: JSON.stringify(
-                asEnvelope({
+                asEnvelope2({
                   jobId,
                   taskId: data.taskId,
                   asyncJobId: data.asyncJobId,
@@ -2043,7 +2068,7 @@ function registerContentTools(server) {
                 {
                   type: "text",
                   text: JSON.stringify(
-                    asEnvelope({
+                    asEnvelope2({
                       jobId: job.id,
                       jobType: job.job_type,
                       model: job.model,
@@ -2104,7 +2129,7 @@ function registerContentTools(server) {
           all_urls: allUrls ?? null
         };
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope(enriched), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope2(enriched), null, 2) }]
         };
       }
       return {
@@ -2233,7 +2258,7 @@ Return ONLY valid JSON in this exact format:
         try {
           const parsed = JSON.parse(rawContent);
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope(parsed), null, 2) }]
+            content: [{ type: "text", text: JSON.stringify(asEnvelope2(parsed), null, 2) }]
           };
         } catch {
           return {
@@ -2261,20 +2286,8 @@ Return ONLY valid JSON in this exact format:
     "Generate a voiceover audio file for video narration. Returns an R2-hosted audio URL. Use after create_storyboard to add narration to each scene, or standalone for podcast intros and ad reads. Costs ~2 credits per generation.",
     {
       text: z2.string().max(5e3).describe("The script/text to convert to speech."),
-      voice: z2.enum([
-        "rachel",
-        "drew",
-        "clyde",
-        "paul",
-        "domi",
-        "dave",
-        "fin",
-        "sarah",
-        "antoni",
-        "thomas",
-        "charlie"
-      ]).optional().describe(
-        "Voice selection. rachel=warm female, drew=confident male, paul=authoritative male, sarah=friendly female. Defaults to rachel."
+      voice: z2.enum(["rachel", "domi"]).optional().describe(
+        "Voice selection. rachel=warm female, domi=confident female. Defaults to rachel."
       ),
       speed: z2.number().min(0.5).max(2).optional().describe("Speech speed multiplier. 1.0 is normal. Defaults to 1.0."),
       response_format: z2.enum(["text", "json"]).optional().describe("Response format. Defaults to text.")
@@ -2302,11 +2315,15 @@ Return ONLY valid JSON in this exact format:
           isError: true
         };
       }
+      const ELEVENLABS_VOICE_IDS = {
+        rachel: "21m00Tcm4TlvDq8ikWAM",
+        domi: "AZnzlk1XvdvUeBnXmlld"
+      };
       const { data, error } = await callEdgeFunction(
         "elevenlabs-tts",
         {
           text,
-          voice: voice ?? "rachel",
+          voiceId: ELEVENLABS_VOICE_IDS[voice ?? "rachel"],
           speed: speed ?? 1
         },
         { timeoutMs: 6e4 }
@@ -2332,7 +2349,7 @@ Return ONLY valid JSON in this exact format:
             {
               type: "text",
               text: JSON.stringify(
-                asEnvelope({
+                asEnvelope2({
                   audioUrl: data.audioUrl,
                   durationSeconds: data.durationSeconds,
                   voice: voice ?? "rachel"
@@ -2481,7 +2498,7 @@ Return ONLY valid JSON in this exact format:
             {
               type: "text",
               text: JSON.stringify(
-                asEnvelope({
+                asEnvelope2({
                   carouselId: data.carousel.id,
                   templateId,
                   style: resolvedStyle,
@@ -2871,7 +2888,7 @@ var PLATFORM_CASE_MAP = {
 };
 var TIKTOK_AUDIT_APPROVED = false;
 var MCP_NOT_LIVE_FOR_POSTING = /* @__PURE__ */ new Set(["LinkedIn", "Pinterest", "Reddit"]);
-function asEnvelope2(data) {
+function asEnvelope3(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -2969,7 +2986,24 @@ function registerDistributionTools(server) {
         linkedin: z3.object({
           article_url: z3.string().optional()
         }).optional(),
-        twitter: z3.object({}).passthrough().optional()
+        twitter: z3.object({
+          paid_partnership: z3.boolean().optional().describe(
+            "Set true for sponsored, affiliate, or branded campaign content. Forwarded to X as paid_partnership and persisted on posts.metadata.paid_partnership."
+          ),
+          disclosure: z3.union([
+            z3.string(),
+            z3.object({
+              label: z3.string().optional(),
+              text: z3.string().optional(),
+              source: z3.string().optional(),
+              required: z3.boolean().optional()
+            }).passthrough()
+          ]).optional().describe(
+            "Campaign disclosure metadata for X posts. String values become disclosure.text; object values persist to posts.metadata.disclosure."
+          ),
+          disclosure_text: z3.string().optional(),
+          disclosure_label: z3.string().optional()
+        }).passthrough().optional()
       }).optional().describe(
         'Platform-specific metadata. Example: {"tiktok":{"privacy_status":"PUBLIC_TO_EVERYONE"}, "youtube":{"title":"My Video"}}'
       ),
@@ -3013,11 +3047,11 @@ function registerDistributionTools(server) {
       visual_gate_result: z3.object({ passed: z3.boolean() }).passthrough().optional().describe(
         "Visual QA gate verdict from the carousel/image generation pipeline. Required when mediaType is CAROUSEL_ALBUM, IMAGE, or VIDEO and VISUAL_GATE_ENFORCE is enabled on the EF. Produce with visual_quality_check tool. Must have passed=true for the gate to allow the publish."
       ),
-      origin: z3.literal("hermes").optional().describe(
-        "Mark this post as authored by an autonomous agent loop (Hermes-style). When set to 'hermes', the post is recorded with posts.origin='hermes' so the hermes_watch_results weekly review can compare engagement against your human posts. Omit (default) for posts where a human composed or approved the content. Only honoured for MCP service-role callers \u2014 JWT/frontend callers are downgraded to human."
+      origin: z3.enum(["human", "hermes", "user"]).optional().describe(
+        "Originator lineage for the post. 'hermes' marks the post as scheduled by the Hermes autonomous agent \u2014 surfaces the Hermes badge + filter in Distribution. Default 'human'. Use only when calling from an autonomous workflow (cron, Slack bot, etc.)."
       ),
       hermes_run_id: z3.string().optional().describe(
-        "Hermes cron run identifier, persisted alongside origin='hermes' for traceability (e.g. cron_<id>_<timestamp>). Ignored unless origin=hermes."
+        "Hermes cron run identifier \u2014 e.g. 'cron_<id>_<timestamp>'. Persists to posts.hermes_run_id when origin='hermes'. Use for traceability between drafts and the cron that produced them."
       )
     },
     async ({
@@ -3300,11 +3334,11 @@ Created with Social Neuron`;
           // Forward visual gate verdict + source so the EF can enforce on media posts.
           ...visual_gate_result ? { visualGateResult: visual_gate_result } : {},
           visualGateSource: "mcp",
-          // Forward autonomous-agent provenance for hermes_watch_results accounting.
-          // EF gates origin='hermes' on isServiceRoleCall && body.source==='mcp' — both true
-          // for mcp-gateway-routed calls — so JWT/frontend callers can never claim it.
+          // Originator lineage (Hermes integration, 2026-05-22). EF validates origin
+          // against the posts.origin CHECK constraint and persists hermesRunId when
+          // origin === 'hermes'.
           ...origin ? { origin } : {},
-          ...hermes_run_id ? { hermes_run_id } : {}
+          ...hermes_run_id ? { hermesRunId: hermes_run_id } : {}
         },
         { timeoutMs: 3e4 }
       );
@@ -3349,12 +3383,15 @@ Created with Social Neuron`;
         }
       }
       if (format === "json") {
+        const structuredContent = asEnvelope3(data);
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope2(data), null, 2) }],
+          structuredContent,
+          content: [{ type: "text", text: JSON.stringify(structuredContent, null, 2) }],
           isError: !data.success
         };
       }
       return {
+        structuredContent: asEnvelope3(data),
         content: [{ type: "text", text: lines.join("\n") }],
         isError: !data.success
       };
@@ -3387,7 +3424,7 @@ Created with Social Neuron`;
             content: [
               {
                 type: "text",
-                text: JSON.stringify(asEnvelope2({ accounts: [] }), null, 2)
+                text: JSON.stringify(asEnvelope3({ accounts: [] }), null, 2)
               }
             ]
           };
@@ -3410,7 +3447,7 @@ Created with Social Neuron`;
       if (format === "json") {
         return {
           content: [
-            { type: "text", text: JSON.stringify(asEnvelope2({ accounts }), null, 2) }
+            { type: "text", text: JSON.stringify(asEnvelope3({ accounts }), null, 2) }
           ]
         };
       }
@@ -3462,10 +3499,10 @@ Created with Social Neuron`;
       const rows = result.posts ?? [];
       if (rows.length === 0) {
         if (format === "json") {
+          const structuredContent2 = asEnvelope3({ posts: [] });
           return {
-            content: [
-              { type: "text", text: JSON.stringify(asEnvelope2({ posts: [] }), null, 2) }
-            ]
+            structuredContent: structuredContent2,
+            content: [{ type: "text", text: JSON.stringify(structuredContent2, null, 2) }]
           };
         }
         return {
@@ -3478,11 +3515,11 @@ Created with Social Neuron`;
         };
       }
       const posts = rows;
+      const structuredContent = asEnvelope3({ posts });
       if (format === "json") {
         return {
-          content: [
-            { type: "text", text: JSON.stringify(asEnvelope2({ posts }), null, 2) }
-          ]
+          structuredContent,
+          content: [{ type: "text", text: JSON.stringify(structuredContent, null, 2) }]
         };
       }
       const statusIcon = {
@@ -3507,6 +3544,7 @@ Created with Social Neuron`;
         lines.push(line);
       }
       return {
+        structuredContent,
         content: [{ type: "text", text: lines.join("\n") }]
       };
     }
@@ -3590,7 +3628,7 @@ Created with Social Neuron`;
               {
                 type: "text",
                 text: JSON.stringify(
-                  asEnvelope2({
+                  asEnvelope3({
                     slots,
                     total_candidates: candidates.length,
                     conflicts_avoided: conflictsAvoided
@@ -3879,7 +3917,7 @@ Created with Social Neuron`;
                 {
                   type: "text",
                   text: JSON.stringify(
-                    asEnvelope2({
+                    asEnvelope3({
                       dry_run: true,
                       plan_id: effectivePlanId,
                       approvals: approvalSummary,
@@ -4067,7 +4105,7 @@ Created with Social Neuron`;
               {
                 type: "text",
                 text: JSON.stringify(
-                  asEnvelope2({
+                  asEnvelope3({
                     plan_id: effectivePlanId,
                     approvals: approvalSummary,
                     posts: results,
@@ -4341,6 +4379,17 @@ function registerMediaTools(server) {
           projectId: project_id
         };
       } else {
+        if (process.env.MCP_TRANSPORT !== "stdio") {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Local file paths are not accepted on the cloud MCP server. Pass the bytes via the \`file_data\` parameter (base64, up to 10MB) or supply a public URL via \`source\`.`
+              }
+            ],
+            isError: true
+          };
+        }
         let fileBuffer;
         try {
           fileBuffer = await readFile(src);
@@ -4383,7 +4432,8 @@ function registerMediaTools(server) {
             const putResp = await fetch(putUrl, {
               method: "PUT",
               headers: { "Content-Type": ct },
-              body: fileBuffer
+              // Uint8Array: Buffer no longer satisfies BodyInit under @types/node 26 fetch types
+              body: new Uint8Array(fileBuffer)
             });
             if (!putResp.ok) {
               return {
@@ -4565,7 +4615,7 @@ function registerMediaTools(server) {
 // src/tools/analytics.ts
 init_supabase();
 import { z as z5 } from "zod";
-function asEnvelope3(data) {
+function asEnvelope4(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -4618,22 +4668,20 @@ function registerAnalyticsTools(server) {
       const rows = result?.rows ?? [];
       if (rows.length === 0) {
         if (format === "json") {
+          const structuredContent = asEnvelope4({
+            platform: platform2 ?? null,
+            days: lookbackDays,
+            totalViews: 0,
+            totalEngagement: 0,
+            postCount: 0,
+            posts: []
+          });
           return {
+            structuredContent,
             content: [
               {
                 type: "text",
-                text: JSON.stringify(
-                  asEnvelope3({
-                    platform: platform2 ?? null,
-                    days: lookbackDays,
-                    totalViews: 0,
-                    totalEngagement: 0,
-                    postCount: 0,
-                    posts: []
-                  }),
-                  null,
-                  2
-                )
+                text: JSON.stringify(structuredContent, null, 2)
               }
             ]
           };
@@ -4723,20 +4771,18 @@ function registerAnalyticsTools(server) {
         lines.push(`  Errors: ${errored}`);
       }
       if (format === "json") {
+        const structuredContent = asEnvelope4({
+          success: true,
+          postsProcessed: result.postsProcessed,
+          queued,
+          errored
+        });
         return {
+          structuredContent,
           content: [
             {
               type: "text",
-              text: JSON.stringify(
-                asEnvelope3({
-                  success: true,
-                  postsProcessed: result.postsProcessed,
-                  queued,
-                  errored
-                }),
-                null,
-                2
-              )
+              text: JSON.stringify(structuredContent, null, 2)
             }
           ]
         };
@@ -4746,11 +4792,11 @@ function registerAnalyticsTools(server) {
   );
 }
 function formatAnalytics(summary, days, format) {
+  const structuredContent = asEnvelope4({ ...summary, days });
   if (format === "json") {
     return {
-      content: [
-        { type: "text", text: JSON.stringify(asEnvelope3({ ...summary, days }), null, 2) }
-      ]
+      structuredContent,
+      content: [{ type: "text", text: JSON.stringify(structuredContent, null, 2) }]
     };
   }
   const lines = [
@@ -4775,6 +4821,7 @@ function formatAnalytics(summary, days, format) {
     }
   }
   return {
+    structuredContent,
     content: [{ type: "text", text: lines.join("\n") }]
   };
 }
@@ -4782,7 +4829,7 @@ function formatAnalytics(summary, days, format) {
 // src/tools/brand.ts
 import { z as z6 } from "zod";
 init_supabase();
-function asEnvelope4(data) {
+function asEnvelope5(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -4837,8 +4884,10 @@ function registerBrandTools(server) {
         };
       }
       if ((response_format || "text") === "json") {
+        const structuredContent = asEnvelope5(data);
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope4(data), null, 2) }]
+          structuredContent,
+          content: [{ type: "text", text: JSON.stringify(structuredContent, null, 2) }]
         };
       }
       const lines = [
@@ -4879,18 +4928,10 @@ function registerBrandTools(server) {
     },
     async ({ project_id, response_format }) => {
       const projectId = project_id || await getDefaultProjectId();
-      if (!projectId) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: "No project_id provided and no default project is configured."
-            }
-          ],
-          isError: true
-        };
-      }
-      const { data: result, error: efError } = await callEdgeFunction("mcp-data", { action: "brand-profile", projectId });
+      const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
+        action: "brand-profile",
+        ...projectId ? { projectId } : {}
+      });
       if (efError || result && !result.success) {
         return {
           content: [
@@ -4910,20 +4951,24 @@ function registerBrandTools(server) {
           ]
         };
       }
+      const structuredContent = asEnvelope5(data);
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope4(data), null, 2) }]
+          structuredContent,
+          content: [{ type: "text", text: JSON.stringify(structuredContent, null, 2) }]
         };
       }
+      const brandContext = data.brand_context;
       const lines = [
         `Active Brand Profile`,
-        `Project: ${projectId}`,
-        `Brand Name: ${data.brand_name || data.brand_context?.name || "N/A"}`,
+        `Project: ${data.project_id || projectId || "default"}`,
+        `Brand Name: ${data.brand_name || brandContext?.name || "N/A"}`,
         `Version: ${data.version ?? "N/A"}`,
         `Updated: ${data.updated_at || "N/A"}`,
         `Extraction Method: ${data.extraction_method || "manual"}`
       ];
       return {
+        structuredContent,
         content: [{ type: "text", text: lines.join("\n") }]
       };
     }
@@ -4998,7 +5043,7 @@ function registerBrandTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope4(payload), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope5(payload), null, 2) }]
         };
       }
       return {
@@ -5088,7 +5133,7 @@ Version: ${payload.version ?? "N/A"}`
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope4(payload), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope5(payload), null, 2) }],
           isError: false
         };
       }
@@ -5794,7 +5839,7 @@ var PLATFORM_ENUM = [
   "bluesky"
 ];
 var DAY_NAMES = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
-function asEnvelope5(data) {
+function asEnvelope6(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -5840,19 +5885,17 @@ function registerInsightsTools(server) {
       }
       if (rows.length === 0) {
         if (format === "json") {
+          const structuredContent2 = asEnvelope6({
+            insights: [],
+            days: lookbackDays,
+            insightType: insight_type ?? null
+          });
           return {
+            structuredContent: structuredContent2,
             content: [
               {
                 type: "text",
-                text: JSON.stringify(
-                  asEnvelope5({
-                    insights: [],
-                    days: lookbackDays,
-                    insightType: insight_type ?? null
-                  }),
-                  null,
-                  2
-                )
+                text: JSON.stringify(structuredContent2, null, 2)
               }
             ]
           };
@@ -5867,20 +5910,18 @@ function registerInsightsTools(server) {
         };
       }
       const insights = rows;
+      const structuredContent = asEnvelope6({
+        insights,
+        days: lookbackDays,
+        insightType: insight_type ?? null
+      });
       if (format === "json") {
         return {
+          structuredContent,
           content: [
             {
               type: "text",
-              text: JSON.stringify(
-                asEnvelope5({
-                  insights,
-                  days: lookbackDays,
-                  insightType: insight_type ?? null
-                }),
-                null,
-                2
-              )
+              text: JSON.stringify(structuredContent, null, 2)
             }
           ]
         };
@@ -5905,6 +5946,7 @@ function registerInsightsTools(server) {
         lines.push(line);
       }
       return {
+        structuredContent,
         content: [{ type: "text", text: lines.join("\n") }]
       };
     }
@@ -5998,7 +6040,7 @@ function registerInsightsTools(server) {
             {
               type: "text",
               text: JSON.stringify(
-                asEnvelope5({
+                asEnvelope6({
                   platform: platform2 ?? null,
                   days: lookbackDays,
                   recordsAnalyzed: rows.length,
@@ -6035,7 +6077,7 @@ function registerInsightsTools(server) {
 
 // src/tools/youtube-analytics.ts
 import { z as z10 } from "zod";
-function asEnvelope6(data) {
+function asEnvelope7(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -6090,7 +6132,7 @@ function registerYouTubeAnalyticsTools(server) {
               {
                 type: "text",
                 text: JSON.stringify(
-                  asEnvelope6({ action, startDate: start_date, endDate: end_date, analytics: a }),
+                  asEnvelope7({ action, startDate: start_date, endDate: end_date, analytics: a }),
                   null,
                   2
                 )
@@ -6127,7 +6169,7 @@ function registerYouTubeAnalyticsTools(server) {
               {
                 type: "text",
                 text: JSON.stringify(
-                  asEnvelope6({
+                  asEnvelope7({
                     action,
                     startDate: start_date,
                     endDate: end_date,
@@ -6156,7 +6198,7 @@ function registerYouTubeAnalyticsTools(server) {
               {
                 type: "text",
                 text: JSON.stringify(
-                  asEnvelope6({
+                  asEnvelope7({
                     action,
                     videoId: video_id,
                     startDate: start_date,
@@ -6196,7 +6238,7 @@ function registerYouTubeAnalyticsTools(server) {
               {
                 type: "text",
                 text: JSON.stringify(
-                  asEnvelope6({
+                  asEnvelope7({
                     action,
                     startDate: start_date,
                     endDate: end_date,
@@ -6222,7 +6264,7 @@ function registerYouTubeAnalyticsTools(server) {
       }
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope6(result), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope7(result), null, 2) }]
         };
       }
       return {
@@ -6235,7 +6277,7 @@ function registerYouTubeAnalyticsTools(server) {
 // src/tools/comments.ts
 import { z as z11 } from "zod";
 init_supabase();
-function asEnvelope7(data) {
+function asEnvelope8(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -6280,7 +6322,7 @@ function registerCommentsTools(server) {
             {
               type: "text",
               text: JSON.stringify(
-                asEnvelope7({ comments, nextPageToken: result.nextPageToken ?? null }),
+                asEnvelope8({ comments, nextPageToken: result.nextPageToken ?? null }),
                 null,
                 2
               )
@@ -6350,7 +6392,7 @@ function registerCommentsTools(server) {
       const result = data;
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope7(result), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope8(result), null, 2) }]
         };
       }
       return {
@@ -6402,7 +6444,7 @@ function registerCommentsTools(server) {
       const result = data;
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope7(result), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope8(result), null, 2) }]
         };
       }
       return {
@@ -6457,7 +6499,7 @@ function registerCommentsTools(server) {
             {
               type: "text",
               text: JSON.stringify(
-                asEnvelope7({
+                asEnvelope8({
                   success: true,
                   commentId: comment_id,
                   moderationStatus: moderation_status
@@ -6516,7 +6558,7 @@ function registerCommentsTools(server) {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope7({ success: true, commentId: comment_id }), null, 2)
+              text: JSON.stringify(asEnvelope8({ success: true, commentId: comment_id }), null, 2)
             }
           ]
         };
@@ -6531,7 +6573,7 @@ function registerCommentsTools(server) {
 // src/tools/ideation-context.ts
 init_supabase();
 import { z as z12 } from "zod";
-function asEnvelope8(data) {
+function asEnvelope9(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -6583,7 +6625,7 @@ function registerIdeationContextTools(server) {
       const context = result.context;
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope8(context), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope9(context), null, 2) }]
         };
       }
       const lines = [
@@ -6603,7 +6645,7 @@ function registerIdeationContextTools(server) {
 
 // src/tools/credits.ts
 import { z as z13 } from "zod";
-function asEnvelope9(data) {
+function asEnvelope10(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -6640,7 +6682,7 @@ function registerCreditsTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope9(payload), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope10(payload), null, 2) }]
         };
       }
       return {
@@ -6674,7 +6716,7 @@ Monthly used: ${payload.monthlyUsed}` + (payload.monthlyLimit ? ` / ${payload.mo
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope9(payload), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope10(payload), null, 2) }]
         };
       }
       return {
@@ -6698,7 +6740,7 @@ Assets remaining: ${payload.remainingAssets ?? "unlimited"}`
 // src/tools/loop-summary.ts
 init_supabase();
 import { z as z14 } from "zod";
-function asEnvelope10(data) {
+function asEnvelope11(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -6749,7 +6791,7 @@ function registerLoopSummaryTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope10(payload), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope11(payload), null, 2) }]
         };
       }
       return {
@@ -6771,7 +6813,7 @@ Next Action: ${payload.recommendedNextAction}`
 
 // src/tools/usage.ts
 import { z as z15 } from "zod";
-function asEnvelope11(data) {
+function asEnvelope12(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -6804,7 +6846,7 @@ function registerUsageTools(server) {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope11({ tools: rows, totalCalls, totalCredits }), null, 2)
+              text: JSON.stringify(asEnvelope12({ tools: rows, totalCalls, totalCredits }), null, 2)
             }
           ]
         };
@@ -6843,7 +6885,7 @@ ${"=".repeat(40)}
 
 // src/tools/autopilot.ts
 import { z as z16 } from "zod";
-function asEnvelope12(data) {
+function asEnvelope13(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -6883,7 +6925,7 @@ function registerAutopilotTools(server) {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope12(configs), null, 2)
+              text: JSON.stringify(asEnvelope13(configs), null, 2)
             }
           ]
         };
@@ -7024,7 +7066,7 @@ Schedule: ${JSON.stringify(updated.schedule_config)}`
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope12(statusData), null, 2)
+              text: JSON.stringify(asEnvelope13(statusData), null, 2)
             }
           ]
         };
@@ -7108,7 +7150,7 @@ ${"=".repeat(40)}
       }
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope12(created), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope13(created), null, 2) }]
         };
       }
       return {
@@ -7129,7 +7171,7 @@ Active: ${is_active}`
 
 // src/tools/recipes.ts
 import { z as z17 } from "zod";
-function asEnvelope13(data) {
+function asEnvelope14(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -7178,7 +7220,7 @@ function registerRecipeTools(server) {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope13(recipes))
+              text: JSON.stringify(asEnvelope14(recipes))
             }
           ]
         };
@@ -7247,7 +7289,7 @@ ${lines.join("\n\n")}`
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope13(recipe))
+              text: JSON.stringify(asEnvelope14(recipe))
             }
           ]
         };
@@ -7284,7 +7326,7 @@ ${lines.join("\n\n")}`
     "Execute a recipe template with the provided inputs. This creates a recipe run that processes each step sequentially. Long-running recipes will return a run_id you can check with get_recipe_run_status.",
     {
       slug: z17.string().describe('Recipe slug (e.g., "weekly-instagram-calendar")'),
-      inputs: z17.record(z17.unknown()).describe(
+      inputs: z17.record(z17.string(), z17.unknown()).describe(
         "Input values matching the recipe input schema. Use get_recipe_details to see required inputs."
       ),
       response_format: z17.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
@@ -7307,7 +7349,7 @@ ${lines.join("\n\n")}`
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope13(result))
+              text: JSON.stringify(asEnvelope14(result))
             }
           ]
         };
@@ -7363,7 +7405,7 @@ ${result?.message || "Use get_recipe_run_status to check progress."}`
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope13(run))
+              text: JSON.stringify(asEnvelope14(run))
             }
           ]
         };
@@ -7395,14 +7437,111 @@ ${JSON.stringify(run.outputs, null, 2)}
 
 // src/tools/extraction.ts
 import { z as z18 } from "zod";
-function asEnvelope14(data) {
-  return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
-}
-function isYouTubeUrl(url) {
+
+// src/lib/urlExtraction.ts
+function classifyYouTubeUrl(url) {
   if (/youtube\.com\/watch|youtu\.be\//.test(url)) return "video";
   if (/youtube\.com\/@/.test(url)) return "channel";
   return false;
 }
+function unwrapEf(result, label) {
+  if (result.error) return { error: result.error };
+  const env = result.data;
+  if (!env || env.success === false) {
+    return { error: env?.error ?? `No data returned from ${label}` };
+  }
+  return { payload: env.data ?? void 0 };
+}
+function segmentsToTranscript(segments) {
+  if (!Array.isArray(segments)) return "";
+  return segments.map((s) => (s?.text ?? "").trim()).filter(Boolean).join(" ");
+}
+async function extractUrlContent(url, opts = {}) {
+  const extractType = opts.extractType ?? "auto";
+  const youtubeType = classifyYouTubeUrl(url);
+  if (youtubeType === "video") {
+    const [txRes, metaRes] = await Promise.all([
+      callEdgeFunction(
+        "scrape-youtube",
+        { action: "transcript", videoUrl: url },
+        { timeoutMs: 3e4 }
+      ),
+      callEdgeFunction(
+        "scrape-youtube",
+        { action: "metadata", videoUrl: url },
+        { timeoutMs: 3e4 }
+      )
+    ]);
+    const tx = unwrapEf(txRes, "scrape-youtube transcript");
+    const meta = unwrapEf(metaRes, "scrape-youtube metadata");
+    if (tx.error && meta.error) {
+      return { error: `Failed to extract YouTube video: ${meta.error ?? tx.error}` };
+    }
+    const m = meta.payload;
+    return {
+      content: {
+        source_type: "youtube_video",
+        url,
+        title: m?.title ?? "",
+        description: m?.description ?? "",
+        transcript: segmentsToTranscript(tx.payload?.segments),
+        video_metadata: m ? {
+          views: typeof m.viewCount === "number" ? m.viewCount : 0,
+          likes: typeof m.likes === "number" ? m.likes : 0,
+          duration: typeof m.duration === "number" ? m.duration : 0,
+          tags: Array.isArray(m.tags) ? m.tags : [],
+          channel_name: m.channelName ?? ""
+        } : void 0
+      }
+    };
+  }
+  if (youtubeType === "channel") {
+    const res2 = await callEdgeFunction(
+      "scrape-youtube",
+      { action: "channel_videos", videoUrl: url },
+      { timeoutMs: 3e4 }
+    );
+    const ch = unwrapEf(res2, "scrape-youtube channel");
+    if (ch.error) return { error: `Failed to extract YouTube channel: ${ch.error}` };
+    const videos = ch.payload?.videos ?? [];
+    return {
+      content: {
+        source_type: "youtube_channel",
+        url,
+        title: url,
+        description: videos.length ? `${videos.length} recent videos:
+${videos.map((v) => `- ${v.title ?? "Untitled"}`).join("\n")}` : "No videos found for this channel."
+      }
+    };
+  }
+  const res = await callEdgeFunction(
+    "fetch-url-content",
+    { url, extractType: extractType === "auto" ? "product" : extractType },
+    { timeoutMs: 3e4 }
+  );
+  const result = unwrapEf(res, "fetch-url-content");
+  if (result.error || !result.payload) {
+    return { error: `Failed to extract URL content: ${result.error ?? "No data returned"}` };
+  }
+  const info = result.payload;
+  return {
+    content: {
+      source_type: extractType === "product" ? "product" : "article",
+      url,
+      title: info.name ?? "",
+      description: info.description ?? "",
+      features: info.features,
+      benefits: info.benefits,
+      usp: info.usp,
+      suggested_hooks: info.suggestedHookAngles
+    }
+  };
+}
+
+// src/tools/extraction.ts
+function asEnvelope15(data) {
+  return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
+}
 function formatExtractedContentAsText(content) {
   const lines = [];
   lines.push(`Source: ${content.source_type} (${content.url})`);
@@ -7447,15 +7586,15 @@ ${content.suggested_hooks.map((h) => `  - ${h}`).join("\n")}`
 function registerExtractionTools(server) {
   server.tool(
     "extract_url_content",
-    "Extract text content from any URL \u2014 YouTube video transcripts, article text, or product page features/benefits/USP. YouTube URLs auto-route to transcript extraction with optional comments. Use before generate_content to repurpose existing content, or before plan_content_week to base a content plan on a source URL.",
+    "Extract text content from any URL \u2014 YouTube video transcript + metadata (title/views/channel), or article text, or product page features/benefits/USP. YouTube URLs auto-route to transcript+metadata extraction; channel URLs return a recent-video list. Use before generate_content to repurpose existing content, or before plan_content_week to base a content plan on a source URL.",
     {
       url: z18.string().url().describe("URL to extract content from"),
-      extract_type: z18.enum(["auto", "transcript", "article", "product"]).default("auto").describe("Type of extraction"),
-      include_comments: z18.boolean().default(false).describe("Include top comments (YouTube only)"),
-      max_results: z18.number().min(1).max(100).default(10).describe("Max comments to include"),
+      extract_type: z18.enum(["auto", "transcript", "article", "product"]).default("auto").describe(
+        "auto = product-style extraction; transcript = YouTube (auto-detected by URL); article = blog/news main text + key points; product = e-commerce features/benefits/USP."
+      ),
       response_format: z18.enum(["text", "json"]).default("text")
     },
-    async ({ url, extract_type, include_comments, max_results, response_format }) => {
+    async ({ url, extract_type, response_format }) => {
       const ssrfCheck = await validateUrlForSSRF(url);
       if (!ssrfCheck.isValid) {
         return {
@@ -7463,106 +7602,20 @@ function registerExtractionTools(server) {
           isError: true
         };
       }
-      const youtubeType = isYouTubeUrl(url);
       try {
-        let extracted;
-        if (youtubeType === "video") {
-          const { data, error } = await callEdgeFunction(
-            "scrape-youtube",
-            {
-              url,
-              includeComments: include_comments,
-              maxComments: max_results
-            },
-            { timeoutMs: 3e4 }
-          );
-          if (error || !data) {
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: `Failed to extract YouTube video: ${error ?? "No data returned"}`
-                }
-              ],
-              isError: true
-            };
-          }
-          extracted = {
-            source_type: "youtube_video",
-            url,
-            title: data.title ?? "",
-            description: data.description ?? "",
-            transcript: data.transcript,
-            video_metadata: data.metadata ? {
-              views: data.metadata.views ?? 0,
-              likes: data.metadata.likes ?? 0,
-              duration: data.metadata.duration ?? 0,
-              tags: data.metadata.tags ?? [],
-              channel_name: data.metadata.channelName ?? ""
-            } : void 0
-          };
-        } else if (youtubeType === "channel") {
-          const { data, error } = await callEdgeFunction(
-            "scrape-youtube",
-            {
-              url,
-              type: "channel"
-            },
-            { timeoutMs: 3e4 }
-          );
-          if (error || !data) {
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: `Failed to extract YouTube channel: ${error ?? "No data returned"}`
-                }
-              ],
-              isError: true
-            };
-          }
-          extracted = {
-            source_type: "youtube_channel",
-            url,
-            title: data.title ?? "",
-            description: data.description ?? ""
-          };
-        } else {
-          const body = { url };
-          if (extract_type !== "auto") body.type = extract_type;
-          const { data, error } = await callEdgeFunction(
-            "fetch-url-content",
-            body,
-            { timeoutMs: 3e4 }
-          );
-          if (error || !data) {
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: `Failed to extract URL content: ${error ?? "No data returned"}`
-                }
-              ],
-              isError: true
-            };
-          }
-          const sourceType = extract_type === "product" ? "product" : data.type === "product" ? "product" : "article";
-          extracted = {
-            source_type: sourceType,
-            url,
-            title: data.title ?? "",
-            description: data.description ?? "",
-            transcript: data.content,
-            features: data.features,
-            benefits: data.benefits,
-            usp: data.usp,
-            suggested_hooks: data.suggestedHooks
+        const { content: extracted, error } = await extractUrlContent(url, {
+          extractType: extract_type
+        });
+        if (error || !extracted) {
+          return {
+            content: [{ type: "text", text: error ?? "No data returned" }],
+            isError: true
           };
         }
         if (response_format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope14(extracted), null, 2) }
+              { type: "text", text: JSON.stringify(asEnvelope15(extracted), null, 2) }
             ],
             isError: false
           };
@@ -7584,7 +7637,7 @@ function registerExtractionTools(server) {
 
 // src/tools/quality.ts
 import { z as z19 } from "zod";
-function asEnvelope15(data) {
+function asEnvelope16(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
 function registerQualityTools(server) {
@@ -7637,7 +7690,7 @@ function registerQualityTools(server) {
       });
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope15(result), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope16(result), null, 2) }],
           isError: false
         };
       }
@@ -7712,7 +7765,7 @@ function registerQualityTools(server) {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope15({ posts: postsWithQuality, summary }), null, 2)
+              text: JSON.stringify(asEnvelope16({ posts: postsWithQuality, summary }), null, 2)
             }
           ],
           isError: false
@@ -8046,7 +8099,7 @@ function buildCorrectiveHint(overflowIssues, spellingIssues) {
 }
 
 // src/tools/visualQuality.ts
-function asEnvelope16(data) {
+function asEnvelope17(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
 var VALID_STYLES = ["dark-cinematic", "clean-editorial", "bold-authority"];
@@ -8171,7 +8224,7 @@ function registerVisualQualityTools(server) {
             {
               type: "text",
               text: JSON.stringify(
-                asEnvelope16({ ...result, correctiveHint: hint || null }),
+                asEnvelope17({ ...result, correctiveHint: hint || null }),
                 null,
                 2
               )
@@ -8241,7 +8294,7 @@ function registerVisualQualityTools(server) {
         return { content: [{ type: "text", text: lines.join("\n") }], isError: false };
       }
       return {
-        content: [{ type: "text", text: JSON.stringify(asEnvelope16(data), null, 2) }],
+        content: [{ type: "text", text: JSON.stringify(asEnvelope17(data), null, 2) }],
         isError: false
       };
     }
@@ -8277,7 +8330,7 @@ function extractJsonArray(text) {
 function toRecord(value) {
   return value && typeof value === "object" ? value : void 0;
 }
-function asEnvelope17(data) {
+function asEnvelope18(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
 function tomorrowIsoDate() {
@@ -8290,9 +8343,6 @@ function addDaysToIsoDate(dateStr, days) {
   d.setDate(d.getDate() + days);
   return d.toISOString().split("T")[0];
 }
-function isYouTubeUrl2(url) {
-  return /youtube\.com\/watch|youtu\.be\/|youtube\.com\/@/.test(url);
-}
 function formatPlanAsText(plan) {
   const lines = [];
   lines.push(`WEEKLY CONTENT PLAN: "${plan.topic}"`);
@@ -8390,20 +8440,22 @@ function registerPlanningTools(server) {
         let sourceContext = "";
         if (source_url) {
           try {
-            const fnName = isYouTubeUrl2(source_url) ? "scrape-youtube" : "fetch-url-content";
-            const { data } = await callEdgeFunction(
-              fnName,
-              { url: source_url },
-              { timeoutMs: 3e4 }
-            );
-            if (data) {
-              const parts = [
-                data.title ? String(data.title) : "",
-                data.description ? String(data.description) : "",
-                data.transcript ? String(data.transcript).slice(0, 2e3) : "",
-                data.content ? String(data.content).slice(0, 2e3) : ""
-              ].filter(Boolean);
-              sourceContext = parts.join("\n\n");
+            const ssrf = await validateUrlForSSRF(source_url);
+            if (ssrf.isValid) {
+              const { content } = await extractUrlContent(source_url);
+              if (content) {
+                const parts = [
+                  content.title,
+                  content.description,
+                  content.transcript ? content.transcript.slice(0, 2e3) : "",
+                  content.features?.length ? `Features:
+${content.features.join("\n")}` : "",
+                  content.benefits?.length ? `Benefits:
+${content.benefits.join("\n")}` : "",
+                  content.usp ?? ""
+                ].filter(Boolean);
+                sourceContext = parts.join("\n\n");
+              }
             }
           } catch {
           }
@@ -8609,13 +8661,16 @@ ${rawText.slice(0, 1e3)}`
             };
           }
         }
+        const structuredContent = asEnvelope18(plan);
         if (response_format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope17(plan), null, 2) }],
+            structuredContent,
+            content: [{ type: "text", text: JSON.stringify(structuredContent, null, 2) }],
             isError: false
           };
         }
         return {
+          structuredContent,
           content: [{ type: "text", text: formatPlanAsText(plan) }],
           isError: false
         };
@@ -8686,7 +8741,7 @@ ${rawText.slice(0, 1e3)}`
         };
         if (response_format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope17(result), null, 2) }],
+            content: [{ type: "text", text: JSON.stringify(asEnvelope18(result), null, 2) }],
             isError: false
           };
         }
@@ -8745,7 +8800,7 @@ ${rawText.slice(0, 1e3)}`
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope17(payload), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope18(payload), null, 2) }],
           isError: false
         };
       }
@@ -8817,7 +8872,7 @@ ${rawText.slice(0, 1e3)}`
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope17(payload), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope18(payload), null, 2) }],
           isError: false
         };
       }
@@ -8870,7 +8925,7 @@ ${rawText.slice(0, 1e3)}`
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope17(payload), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope18(payload), null, 2) }],
           isError: false
         };
       }
@@ -8890,7 +8945,7 @@ ${rawText.slice(0, 1e3)}`
 // src/tools/plan-approvals.ts
 import { z as z22 } from "zod";
 init_supabase();
-function asEnvelope18(data) {
+function asEnvelope19(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -8965,7 +9020,7 @@ function registerPlanApprovalTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope18(payload), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope19(payload), null, 2) }],
           isError: false
         };
       }
@@ -9017,7 +9072,7 @@ function registerPlanApprovalTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope18(payload), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope19(payload), null, 2) }],
           isError: false
         };
       }
@@ -9095,7 +9150,7 @@ function registerPlanApprovalTools(server) {
       }
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope18(data), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope19(data), null, 2) }],
           isError: false
         };
       }
@@ -9304,13 +9359,15 @@ var TOOL_CATALOG = [
     name: "capture_screenshot",
     description: "Capture a screenshot of a URL",
     module: "screenshot",
-    scope: "mcp:read"
+    scope: "mcp:read",
+    localOnly: true
   },
   {
     name: "capture_app_page",
     description: "Capture a screenshot of an app page",
     module: "screenshot",
-    scope: "mcp:read"
+    scope: "mcp:read",
+    localOnly: true
   },
   // remotion
   {
@@ -9498,7 +9555,7 @@ var TOOL_CATALOG = [
   // niche research
   {
     name: "find_winning_content",
-    description: "Find QA-gated high-performing short-form videos in the project's niche. Returns extracted hook patterns, content structures, and pre-compiled replication prompts (backed by niche_winners view, qa_score >= 0.5).",
+    description: "Find QA-gated high-performing short-form videos in the project's niche. Returns extracted hook patterns, content structures, and pre-compiled replication prompts.",
     module: "research",
     scope: "mcp:read"
   },
@@ -9523,6 +9580,18 @@ var TOOL_CATALOG = [
     module: "discovery",
     scope: "mcp:read"
   },
+  {
+    name: "search",
+    description: "Search public Social Neuron product, integration, developer, and MCP tool knowledge using the ChatGPT-compatible search schema.",
+    module: "discovery",
+    scope: "mcp:read"
+  },
+  {
+    name: "fetch",
+    description: "Fetch one public Social Neuron knowledge document by ID using the ChatGPT-compatible fetch schema.",
+    module: "discovery",
+    scope: "mcp:read"
+  },
   // pipeline
   {
     name: "check_pipeline_readiness",
@@ -9637,58 +9706,93 @@ var TOOL_CATALOG = [
   // agentic-harness — learning loop write-back
   {
     name: "write_agent_reflection",
-    description: "Persist a verbal reflection for an agent loop. Provenance keys are restricted (Anti-Goodhart safety): only content_history_id, outcome_event_id, prm_score_ids, and handoff_ids are accepted.",
+    description: "Persist a verbal reflection for an agent loop. Provenance keys are restricted to an allowlist: only content_history_id, outcome_event_id, prm_score_ids, and handoff_ids are accepted.",
     module: "harness",
-    scope: "mcp:write"
+    scope: "mcp:write",
+    internal: true
   },
   {
     name: "record_outcome",
-    description: "Record an outcome for a published decision event. Idempotent on (decision_event_id, horizon). Only horizon=24h triggers a content_bandits posterior update.",
+    description: "Record an outcome for a published decision event. Idempotent on (decision_event_id, horizon). Only horizon=24h triggers a learning-loop update.",
     module: "harness",
-    scope: "mcp:write"
+    scope: "mcp:write",
+    internal: true
   },
   // agentic-harness — learning loop read-back
   {
     name: "read_agent_reflection",
     description: "Read past agent reflections for a brand. Ordered by created_at DESC, id ASC (deterministic tiebreak). Only active reflections returned (superseded_by IS NULL). Optional generated_by_agent filter.",
     module: "harness",
-    scope: "mcp:read"
+    scope: "mcp:read",
+    internal: true
   },
   // hermes — autonomous agent integration (closed-loop content)
   {
     name: "save_draft_to_library",
-    description: "Save a draft post to the SN content library with origin=hermes. Used by Hermes to persist drafts before the founder approves them.",
+    description: "Save a draft post to the SN content library for review before publishing. Drafts land in the content library pending approval.",
     module: "hermes",
-    scope: "mcp:write"
+    scope: "mcp:write",
+    internal: true
   },
   {
     name: "record_voice_lesson",
-    description: "Persist a learned voice lesson to brand_profiles.brand_context.voiceProfile.voice_lessons via atomic RPC. Used by Hermes reflection cron.",
+    description: "Persist a learned voice lesson to the brand voice profile.",
     module: "hermes",
-    scope: "mcp:write"
+    scope: "mcp:write",
+    internal: true
   },
   {
     name: "record_observation",
-    description: 'Record an agent observation (e.g. "topic X engagement up 23%") for the UnifiedAnalytics > Playbook surface.',
+    description: 'Record an agent observation (e.g. "topic X engagement up 23%") for the analytics playbook.',
     module: "hermes",
-    scope: "mcp:write"
+    scope: "mcp:write",
+    internal: true
   },
   {
     name: "record_intel_signal",
-    description: "Record a research/trend signal from Hermes watchers (news, HN, competitor, etc.) for Niche Intelligence. Dedupes by URL.",
+    description: "Record a research/trend signal (news, competitor, community sources) for niche intelligence. Dedupes by URL.",
     module: "hermes",
-    scope: "mcp:write"
+    scope: "mcp:write",
+    internal: true
   },
   {
     name: "record_campaign_spend",
-    description: "Log a campaign cost line (hermes_drafts, carousel_renders, analytics_pulls, paid_amplification, other). Ownership-checked.",
+    description: "Log a campaign cost line item. Ownership-checked.",
     module: "hermes",
-    scope: "mcp:write"
+    scope: "mcp:write",
+    internal: true
   },
   {
     name: "get_active_campaigns",
-    description: "List currently-running campaigns with thesis, budget, hero format, and current spend. Used by Hermes pitch skill to bias drafts.",
+    description: "List currently-running campaigns with thesis, budget, hero format, and current spend.",
     module: "hermes",
+    scope: "mcp:read",
+    internal: true
+  },
+  // skills (workflow skills — multi-step brand-locked content pipelines)
+  {
+    name: "list_skills",
+    description: "List Social Neuron content workflow skills available to the user. A skill is a brand-locked multi-step pipeline inspired by documented viral patterns (MrBeast 3-second hook, Hormozi pattern interrupt, etc.).",
+    module: "skills",
+    scope: "mcp:read"
+  },
+  {
+    name: "run_skill",
+    description: "Run a Social Neuron workflow skill end-to-end (brand-locked content production). Returns a structured run preview with the step plan, credit cost, and a deep-link to launch in the SN dashboard.",
+    module: "skills",
+    scope: "mcp:write"
+  },
+  // loop observability (growth-loop KPIs + content learning state)
+  {
+    name: "get_loop_pulse",
+    description: "Read dynamic loop-health KPIs for the growth loop over the last 7 days (reflection/decision coverage, visual gate pass rate, learning-update application rate, per-platform uptake, autopilot lag) \u2014 each with an ok/warn/bad status. Use to decide whether the loop is closing or where it is stuck.",
+    module: "loop",
+    scope: "mcp:read"
+  },
+  {
+    name: "get_bandit_state",
+    description: "Read the current content learning state for a project \u2014 top-K arms per (arm_type, platform) with expected performance and uncertainty. Use to reason about which hook family / format / timing slot currently performs best per platform.",
+    module: "loop",
     scope: "mcp:read"
   }
 ];
@@ -9706,7 +9810,194 @@ function searchTools(query) {
 }
 
 // src/tools/discovery.ts
+init_supabase();
+init_request_context();
+var KNOWLEDGE_BASE_URL = "https://socialneuron.com/for-developers";
+var KNOWLEDGE_SEARCH_LIMIT = 10;
+var SearchOutputSchema = {
+  results: z23.array(
+    z23.object({
+      id: z23.string(),
+      title: z23.string(),
+      url: z23.string().url()
+    })
+  )
+};
+var FetchOutputSchema = {
+  id: z23.string(),
+  title: z23.string(),
+  text: z23.string(),
+  url: z23.string().url(),
+  metadata: z23.record(z23.string(), z23.string()).optional()
+};
+var STATIC_KNOWLEDGE_DOCUMENTS = [
+  {
+    id: "overview",
+    title: "Social Neuron MCP Overview",
+    url: `${KNOWLEDGE_BASE_URL}#mcp`,
+    text: [
+      "Social Neuron exposes an MCP server for creating, scheduling, and optimizing social content.",
+      "Use the hosted streamable HTTP endpoint at https://mcp.socialneuron.com/mcp for ChatGPT, Claude, and other remote MCP clients.",
+      "The npm package provides stdio transport for local tools and Codex-style workflows."
+    ].join("\n"),
+    metadata: { source: "public-developer-docs", category: "overview" }
+  },
+  {
+    id: "integrations",
+    title: "Supported Social Integrations",
+    url: "https://socialneuron.com/integrations",
+    text: [
+      "Social Neuron tracks platform availability on the integrations page.",
+      "YouTube, TikTok, Instagram, LinkedIn, X, and Facebook are live for supported posting workflows.",
+      "Threads and Bluesky are supported surfaces where live availability depends on the current integration status."
+    ].join("\n"),
+    metadata: { source: "public-integrations-page", category: "integrations" }
+  },
+  {
+    id: "chatgpt-connector",
+    title: "ChatGPT Connector Setup",
+    url: `${KNOWLEDGE_BASE_URL}#chatgpt`,
+    text: [
+      "In ChatGPT Developer Mode, create an MCP app using https://mcp.socialneuron.com/mcp as the MCP URL.",
+      "The connector uses OAuth for account linking and tool scopes for read, write, distribution, analytics, comments, and autopilot access.",
+      "Publishing tools should be treated as externally visible actions and require the distribute scope."
+    ].join("\n"),
+    metadata: { source: "public-developer-docs", category: "chatgpt" }
+  },
+  {
+    id: "privacy-security",
+    title: "Connector Security and Data Minimization",
+    url: `${KNOWLEDGE_BASE_URL}#security`,
+    text: [
+      "Social Neuron MCP tools enforce OAuth or API-key scopes before tool execution.",
+      "Read-only discovery tools expose public product and tool metadata, not private account content.",
+      "User-owned content and analytics require authenticated scopes and organization or project membership checks in backend functions."
+    ].join("\n"),
+    metadata: { source: "public-developer-docs", category: "security" }
+  }
+];
+function toolKnowledgeDocument(tool) {
+  const lines = [
+    `Tool: ${tool.name}`,
+    `Description: ${tool.description}`,
+    `Module: ${tool.module}`,
+    `Required scope: ${tool.scope}`
+  ];
+  if (tool.task_intent) lines.push(`Task intent: ${tool.task_intent}`);
+  if (tool.use_when) lines.push(`Use when: ${tool.use_when}`);
+  if (tool.avoid_when) lines.push(`Avoid when: ${tool.avoid_when}`);
+  if (tool.next_tools?.length) lines.push(`Common next tools: ${tool.next_tools.join(", ")}`);
+  return {
+    id: `tool:${tool.name}`,
+    title: `MCP tool: ${tool.name}`,
+    url: `${KNOWLEDGE_BASE_URL}#tool-${tool.name}`,
+    text: lines.join("\n"),
+    metadata: {
+      source: "mcp-tool-catalog",
+      category: "tool",
+      module: tool.module,
+      scope: tool.scope
+    }
+  };
+}
+function getKnowledgeDocuments() {
+  return [
+    ...STATIC_KNOWLEDGE_DOCUMENTS,
+    ...TOOL_CATALOG.filter((t) => !t.internal).map(toolKnowledgeDocument)
+  ];
+}
+function tokenize(input) {
+  return input.toLowerCase().split(/[^a-z0-9:_-]+/).map((token) => token.trim()).filter(Boolean);
+}
+function scoreDocument(queryTokens, doc) {
+  const title = doc.title.toLowerCase();
+  const text = doc.text.toLowerCase();
+  const metadata = JSON.stringify(doc.metadata ?? {}).toLowerCase();
+  return queryTokens.reduce((score, token) => {
+    if (doc.id.toLowerCase() === token) return score + 12;
+    if (doc.id.toLowerCase().includes(token)) score += 8;
+    if (title.includes(token)) score += 5;
+    if (text.includes(token)) score += 2;
+    if (metadata.includes(token)) score += 1;
+    return score;
+  }, 0);
+}
+function searchKnowledge(query) {
+  const docs = getKnowledgeDocuments();
+  const tokens = tokenize(query);
+  if (tokens.length === 0) {
+    return docs.slice(0, KNOWLEDGE_SEARCH_LIMIT);
+  }
+  return docs.map((doc) => ({ doc, score: scoreDocument(tokens, doc) })).filter(({ score }) => score > 0).sort((a, b) => b.score - a.score || a.doc.title.localeCompare(b.doc.title)).slice(0, KNOWLEDGE_SEARCH_LIMIT).map(({ doc }) => doc);
+}
 function registerDiscoveryTools(server) {
+  server.registerTool(
+    "search",
+    {
+      title: "Search Social Neuron Knowledge",
+      description: "Search public Social Neuron product, integration, developer, and MCP tool knowledge. Uses the standard ChatGPT MCP search schema and never returns private account content.",
+      inputSchema: {
+        query: z23.string().describe("Search query.")
+      },
+      outputSchema: SearchOutputSchema,
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      }
+    },
+    async ({ query }) => {
+      const structuredContent = {
+        results: searchKnowledge(query).map((doc) => ({
+          id: doc.id,
+          title: doc.title,
+          url: doc.url
+        }))
+      };
+      return {
+        structuredContent,
+        content: [{ type: "text", text: JSON.stringify(structuredContent) }]
+      };
+    }
+  );
+  server.registerTool(
+    "fetch",
+    {
+      title: "Fetch Social Neuron Knowledge",
+      description: "Fetch a public Social Neuron knowledge document by ID. Use IDs returned by the search tool.",
+      inputSchema: {
+        id: z23.string().describe("Document ID returned by search.")
+      },
+      outputSchema: FetchOutputSchema,
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      }
+    },
+    async ({ id }) => {
+      const doc = getKnowledgeDocuments().find((candidate) => candidate.id === id);
+      if (!doc) {
+        return {
+          content: [{ type: "text", text: `Document not found: ${id}` }],
+          isError: true
+        };
+      }
+      const structuredContent = {
+        id: doc.id,
+        title: doc.title,
+        text: doc.text,
+        url: doc.url,
+        ...doc.metadata ? { metadata: doc.metadata } : {}
+      };
+      return {
+        structuredContent,
+        content: [{ type: "text", text: JSON.stringify(structuredContent) }]
+      };
+    }
+  );
   server.tool(
     "search_tools",
     'Search available tools by name, description, module, or scope. Use "name" detail (~50 tokens) for quick lookup, "summary" (~500 tokens) for descriptions, "full" for complete input schemas. Start here if unsure which tool to call \u2014 filter by module (e.g. "planning", "content", "analytics") to narrow results.',
@@ -9716,13 +10007,20 @@ function registerDiscoveryTools(server) {
       scope: z23.string().optional().describe('Filter by required scope (e.g. "mcp:read", "mcp:write")'),
       detail: z23.enum(["name", "summary", "full"]).default("summary").describe(
         'Detail level: "name" for just tool names, "summary" for names + descriptions, "full" for complete info including scope and module'
+      ),
+      available_only: z23.boolean().default(false).describe(
+        "When true, only return tools allowed by the current API key/OAuth scopes. Use this after a permission_denied error."
       )
     },
-    async ({ query, module, scope, detail }) => {
+    async ({ query, module, scope, detail, available_only }) => {
+      const currentScopes = getRequestScopes() ?? getAuthenticatedScopes();
+      const hasKnownScopes = currentScopes.length > 0;
+      const isAvailable = (tool) => !hasKnownScopes || hasScope(currentScopes, tool.scope);
       let results = [...TOOL_CATALOG];
       if (query) {
         results = searchTools(query);
       }
+      results = results.filter((t) => !t.internal);
       if (module) {
         const moduleTools = getToolsByModule(module);
         results = results.filter((t) => moduleTools.some((mt) => mt.name === t.name));
@@ -9731,24 +10029,48 @@ function registerDiscoveryTools(server) {
         const scopeTools = getToolsByScope(scope);
         results = results.filter((t) => scopeTools.some((st) => st.name === t.name));
       }
+      if (available_only) {
+        results = results.filter(isAvailable);
+      }
+      const unavailableCount = hasKnownScopes ? results.filter((t) => !isAvailable(t)).length : 0;
       let output;
       switch (detail) {
         case "name":
           output = results.map((t) => t.name);
           break;
         case "summary":
-          output = results.map((t) => ({ name: t.name, description: t.description }));
+          output = results.map((t) => ({
+            name: t.name,
+            description: t.description,
+            ...hasKnownScopes || scope ? { required_scope: t.scope } : {},
+            ...hasKnownScopes ? { available: isAvailable(t) } : {},
+            ...t.task_intent ? { task_intent: t.task_intent } : {},
+            ...t.use_when ? { use_when: t.use_when } : {},
+            ...t.avoid_when ? { avoid_when: t.avoid_when } : {}
+          }));
           break;
         case "full":
         default:
-          output = results;
+          output = results.map((tool) => ({
+            ...tool,
+            required_scope: tool.scope,
+            ...hasKnownScopes ? { available: isAvailable(tool) } : {}
+          }));
           break;
       }
       return {
         content: [
           {
             type: "text",
-            text: JSON.stringify({ toolCount: results.length, tools: output }, null, 2)
+            text: JSON.stringify(
+              {
+                toolCount: results.length,
+                ...hasKnownScopes ? { scopes: { available: currentScopes, unavailable_matches: unavailableCount } } : {},
+                tools: output
+              },
+              null,
+              detail === "full" ? 2 : 0
+            )
           }
         ]
       };
@@ -9760,7 +10082,7 @@ function registerDiscoveryTools(server) {
 import { z as z24 } from "zod";
 import { randomUUID as randomUUID3 } from "node:crypto";
 init_supabase();
-function asEnvelope19(data) {
+function asEnvelope20(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
 var PLATFORM_ENUM2 = z24.enum([
@@ -9775,6 +10097,7 @@ var PLATFORM_ENUM2 = z24.enum([
 ]);
 var BASE_PLAN_CREDITS = 15;
 var SOURCE_EXTRACTION_CREDITS = 5;
+var SCHEDULE_POST_CREDITS = 1;
 function registerPipelineTools(server) {
   server.tool(
     "check_pipeline_readiness",
@@ -9804,6 +10127,7 @@ function registerPipelineTools(server) {
           throw new Error(readinessError ?? "No response from mcp-data");
         }
         const credits = readiness.credits;
+        const isUnlimited = readiness.is_unlimited === true;
         const connectedPlatforms = readiness.connected_platforms;
         const missingPlatforms = readiness.missing_platforms;
         const hasBrand = readiness.has_brand;
@@ -9812,7 +10136,7 @@ function registerPipelineTools(server) {
         const insightsFresh = readiness.insights_fresh;
         const blockers = [];
         const warnings = [];
-        if (credits < estimatedCost) {
+        if (!isUnlimited && credits < estimatedCost) {
           blockers.push(`Insufficient credits: ${credits} available, ~${estimatedCost} needed`);
         }
         if (missingPlatforms.length > 0) {
@@ -9851,7 +10175,7 @@ function registerPipelineTools(server) {
         };
         if (format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope19(result), null, 2) }]
+            content: [{ type: "text", text: JSON.stringify(asEnvelope20(result), null, 2) }]
           };
         }
         const lines = [];
@@ -9890,7 +10214,7 @@ function registerPipelineTools(server) {
   );
   server.tool(
     "run_content_pipeline",
-    "Run the full content pipeline: research trends \u2192 generate plan \u2192 quality check \u2192 auto-approve \u2192 schedule posts. Chains all stages in one call for maximum efficiency. Set dry_run=true to preview the plan without publishing. Check check_pipeline_readiness first to verify credits, OAuth, and brand profile are ready.",
+    "Run the full content pipeline: research trends \u2192 generate plan \u2192 quality check \u2192 auto-approve \u2192 schedule posts. Chains all stages in one call for maximum efficiency. Set dry_run=true to preview the plan without publishing. To schedule posts, set schedule_confirmed=true after the user explicitly approves publishing. Check check_pipeline_readiness first to verify credits, OAuth, and brand profile are ready.",
     {
       project_id: z24.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
       topic: z24.string().optional().describe("Content topic (required if no source_url)"),
@@ -9906,6 +10230,9 @@ function registerPipelineTools(server) {
       ),
       max_credits: z24.number().optional().describe("Credit budget cap"),
       dry_run: z24.boolean().default(false).describe("If true, skip scheduling and return plan only"),
+      schedule_confirmed: z24.boolean().default(false).describe(
+        "Required to schedule posts. Set true only after explicit user confirmation to publish/schedule."
+      ),
       skip_stages: z24.array(z24.enum(["research", "quality", "schedule"])).optional().describe("Stages to skip"),
       response_format: z24.enum(["text", "json"]).default("json")
     },
@@ -9920,6 +10247,7 @@ function registerPipelineTools(server) {
       auto_approve_threshold,
       max_credits,
       dry_run,
+      schedule_confirmed,
       skip_stages,
       response_format
     }) => {
@@ -9935,9 +10263,32 @@ function registerPipelineTools(server) {
         };
       }
       const skipSet = new Set(skip_stages ?? []);
-      try {
-        const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
-        const estimatedCost = BASE_PLAN_CREDITS + (source_url ? SOURCE_EXTRACTION_CREDITS : 0);
+      const schedulingRequested = !dry_run && !skipSet.has("schedule");
+      if (schedulingRequested && !schedule_confirmed) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: 'Scheduling requires explicit confirmation. Re-run with schedule_confirmed=true after the user approves publishing, or set dry_run=true / skip_stages=["schedule"].'
+            }
+          ],
+          isError: true
+        };
+      }
+      if (schedulingRequested && skipSet.has("quality")) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "Scheduling cannot run when the quality stage is skipped."
+            }
+          ],
+          isError: true
+        };
+      }
+      try {
+        const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+        const estimatedCost = BASE_PLAN_CREDITS + (source_url ? SOURCE_EXTRACTION_CREDITS : 0);
         const { data: budgetData } = await callEdgeFunction(
           "mcp-data",
           {
@@ -9948,8 +10299,9 @@ function registerPipelineTools(server) {
           { timeoutMs: 1e4 }
         );
         const availableCredits = budgetData?.credits ?? 0;
+        const isUnlimited = budgetData?.is_unlimited === true;
         const creditLimit = max_credits ?? availableCredits;
-        if (availableCredits < estimatedCost) {
+        if (!isUnlimited && availableCredits < estimatedCost) {
           return {
             content: [
               {
@@ -9976,6 +10328,7 @@ function registerPipelineTools(server) {
               approval_mode,
               auto_approve_threshold,
               dry_run,
+              schedule_confirmed,
               skip_stages: skip_stages ?? []
             },
             current_stage: "planning",
@@ -10041,7 +10394,9 @@ function registerPipelineTools(server) {
         stagesCompleted.push("planning");
         const rawText = String(planData.text ?? planData.content ?? "");
         const postsArray = extractJsonArray(rawText);
-        const posts = (postsArray ?? []).map((p) => ({
+        const requestedPlatformSet = new Set(platforms);
+        const maxPosts = platforms.length * days * posts_per_day;
+        const parsedPosts = (postsArray ?? []).map((p) => ({
           id: String(p.id ?? randomUUID3().slice(0, 8)),
           day: Number(p.day ?? 1),
           date: String(p.date ?? ""),
@@ -10055,6 +10410,23 @@ function registerPipelineTools(server) {
           visual_direction: p.visual_direction ? String(p.visual_direction) : void 0,
           media_type: p.media_type ? String(p.media_type) : void 0
         }));
+        const platformFilteredPosts = parsedPosts.filter(
+          (post) => requestedPlatformSet.has(post.platform)
+        );
+        const posts = platformFilteredPosts.slice(0, maxPosts);
+        if (parsedPosts.length > maxPosts) {
+          errors.push({
+            stage: "planning",
+            message: `AI returned ${parsedPosts.length} posts; truncated to ${maxPosts}.`
+          });
+        }
+        const invalidPlatformCount = parsedPosts.length - platformFilteredPosts.length;
+        if (invalidPlatformCount > 0) {
+          errors.push({
+            stage: "planning",
+            message: `Dropped ${invalidPlatformCount} post(s) with unrequested or invalid platform.`
+          });
+        }
         let postsApproved = 0;
         let postsFlagged = 0;
         if (!skipSet.has("quality")) {
@@ -10175,21 +10547,27 @@ function registerPipelineTools(server) {
         let postsScheduled = 0;
         if (!dry_run && !skipSet.has("schedule") && postsApproved > 0) {
           const approvedPosts = posts.filter((p) => p.status === "approved");
+          const scheduleBase = /* @__PURE__ */ new Date();
+          scheduleBase.setDate(scheduleBase.getDate() + 1);
+          const scheduleBaseMs = scheduleBase.getTime();
           for (const post of approvedPosts) {
             if (creditsUsed >= creditLimit) {
               errors.push({ stage: "schedule", message: "Credit limit reached" });
               break;
             }
+            const scheduledAt = post.schedule_at ?? new Date(scheduleBaseMs + (Math.max(1, post.day) - 1) * 864e5).toISOString();
             try {
               const { error: schedError } = await callEdgeFunction(
                 "schedule-post",
                 {
-                  platform: post.platform,
+                  platforms: [post.platform],
                   caption: post.caption,
                   title: post.title,
                   hashtags: post.hashtags,
-                  media_url: post.media_url,
-                  scheduled_at: post.schedule_at,
+                  mediaUrl: post.media_url,
+                  scheduledAt,
+                  planId,
+                  idempotencyKey: `pipeline-${planId}-${post.id}`,
                   ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
                 },
                 { timeoutMs: 15e3 }
@@ -10201,6 +10579,7 @@ function registerPipelineTools(server) {
                 });
               } else {
                 postsScheduled++;
+                creditsUsed += SCHEDULE_POST_CREDITS;
               }
             } catch (schedErr) {
               errors.push({
@@ -10255,7 +10634,7 @@ function registerPipelineTools(server) {
         if (response_format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope19(resultPayload), null, 2) }
+              { type: "text", text: JSON.stringify(asEnvelope20(resultPayload), null, 2) }
             ]
           };
         }
@@ -10336,7 +10715,7 @@ function registerPipelineTools(server) {
       }
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope19(data), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope20(data), null, 2) }]
         };
       }
       const lines = [];
@@ -10470,7 +10849,7 @@ function registerPipelineTools(server) {
         if (response_format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope19(resultPayload), null, 2) }
+              { type: "text", text: JSON.stringify(asEnvelope20(resultPayload), null, 2) }
             ]
           };
         }
@@ -10518,7 +10897,7 @@ function buildPlanPrompt(topic, platforms, days, postsPerDay, sourceUrl) {
 
 // src/tools/suggest.ts
 import { z as z25 } from "zod";
-function asEnvelope20(data) {
+function asEnvelope21(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
 function registerSuggestTools(server) {
@@ -10626,7 +11005,7 @@ function registerSuggestTools(server) {
         if (format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope20(resultPayload), null, 2) }
+              { type: "text", text: JSON.stringify(asEnvelope21(resultPayload), null, 2) }
             ]
           };
         }
@@ -10761,7 +11140,7 @@ function detectAnomalies(currentData, previousData, sensitivity = "medium", aver
 }
 
 // src/tools/digest.ts
-function asEnvelope21(data) {
+function asEnvelope22(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
 var PLATFORM_ENUM3 = z26.enum([
@@ -10930,7 +11309,7 @@ function registerDigestTools(server) {
         };
         if (format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope21(digest), null, 2) }]
+            content: [{ type: "text", text: JSON.stringify(asEnvelope22(digest), null, 2) }]
           };
         }
         const lines = [];
@@ -11029,7 +11408,7 @@ Best: ${best.id.slice(0, 8)}... (${best.platform}) \u2014 ${best.views.toLocaleS
         if (format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope21(resultPayload), null, 2) }
+              { type: "text", text: JSON.stringify(asEnvelope22(resultPayload), null, 2) }
             ]
           };
         }
@@ -11076,18 +11455,129 @@ var WEIGHTS = {
   structuralPatterns: 0.05
 };
 function norm(content) {
-  return content.toLowerCase().replace(/[^a-z0-9\s]/g, " ");
+  return content.toLowerCase().replace(/[^a-z0-9\s]/g, " ").replace(/\s+/g, " ").trim();
 }
 function findMatches(content, terms) {
   const n = norm(content);
-  return terms.filter((t) => n.includes(t.toLowerCase()));
+  return terms.filter((t) => {
+    const nt = norm(t);
+    return nt.length > 0 && n.includes(nt);
+  });
 }
 function findMissing(content, terms) {
   const n = norm(content);
-  return terms.filter((t) => !n.includes(t.toLowerCase()));
+  return terms.filter((t) => {
+    const nt = norm(t);
+    return nt.length > 0 && !n.includes(nt);
+  });
+}
+function asStringArray(v) {
+  if (Array.isArray(v)) return v.map((x) => String(x ?? "").trim()).filter(Boolean);
+  if (typeof v === "string") {
+    return v.split(/[,;\n]/).map((s) => s.trim()).filter(Boolean);
+  }
+  return [];
+}
+function extractAtomicTerms(entries) {
+  const out = [];
+  for (const raw of entries) {
+    const e = (raw || "").trim();
+    if (!e) continue;
+    const quoted = e.match(/['"“”‘’]([^'"“”‘’]{2,40})['"“”‘’]/g);
+    if (quoted) {
+      for (const q of quoted) out.push(q.replace(/['"“”‘’]/g, "").trim());
+      continue;
+    }
+    const words = e.split(/\s+/);
+    const isGuidancePhrase = words.length > 2 && /\b(tone|voice|style|approach|language)\b/i.test(e);
+    if (!e.includes("(") && words.length <= 3 && !isGuidancePhrase) out.push(e);
+  }
+  return Array.from(new Set(out.map((t) => t.trim()).filter(Boolean)));
+}
+function hasField(obj, key) {
+  return Object.prototype.hasOwnProperty.call(obj, key) && obj[key] != null;
+}
+function unionTerms(existing, incoming) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const t of [...existing, ...incoming]) {
+    if (t && !seen.has(t)) {
+      seen.add(t);
+      out.push(t);
+    }
+  }
+  return out;
+}
+function mergeVoiceVocabulary(resolved, raw) {
+  const voice = raw.voice;
+  if (!voice || typeof voice !== "object") return resolved;
+  const vp = asStringArray(voice.preferredTerms);
+  const vb = asStringArray(voice.bannedTerms);
+  if (!vp.length && !vb.length) return resolved;
+  const existing = resolved.vocabularyRules ?? {};
+  return {
+    ...resolved,
+    vocabularyRules: {
+      preferredTerms: unionTerms(asStringArray(existing.preferredTerms), vp),
+      bannedTerms: unionTerms(asStringArray(existing.bannedTerms), vb)
+    }
+  };
+}
+function resolveBrandProfile(raw) {
+  if (!raw || typeof raw !== "object") return {};
+  const r = raw;
+  const name = typeof r.name === "string" ? r.name : void 0;
+  const voiceProfile = r.voiceProfile;
+  const vocabularyRules = r.vocabularyRules;
+  if (voiceProfile && vocabularyRules) {
+    return mergeVoiceVocabulary(raw, r);
+  }
+  if (voiceProfile) {
+    return mergeVoiceVocabulary(
+      {
+        name,
+        voiceProfile,
+        vocabularyRules: {
+          bannedTerms: extractAtomicTerms(asStringArray(voiceProfile.avoidPatterns)),
+          preferredTerms: asStringArray(voiceProfile.languagePatterns)
+        },
+        targetAudience: r.targetAudience,
+        writingStyleRules: r.writingStyleRules
+      },
+      r
+    );
+  }
+  const isFlat = hasField(r, "voiceTone") || hasField(r, "voiceTags") || hasField(r, "discouragedTerms") || hasField(r, "preferredTerms");
+  if (isFlat) {
+    const ta = r.targetAudience;
+    const psy = ta?.psychographics;
+    const painPoints = ta ? asStringArray(psy?.painPoints ?? ta.painPoints) : [];
+    const interests = ta ? asStringArray(psy?.interests ?? ta.interests) : [];
+    return mergeVoiceVocabulary(
+      {
+        name,
+        voiceProfile: {
+          tone: [...asStringArray(r.voiceTags), ...asStringArray(r.voiceTone)],
+          style: asStringArray(r.voiceStyle),
+          languagePatterns: [],
+          avoidPatterns: []
+        },
+        vocabularyRules: {
+          bannedTerms: asStringArray(r.discouragedTerms),
+          preferredTerms: asStringArray(r.preferredTerms)
+        },
+        targetAudience: painPoints.length || interests.length ? { psychographics: { painPoints, interests } } : void 0
+      },
+      r
+    );
+  }
+  const stub = { name };
+  if (vocabularyRules)
+    stub.vocabularyRules = vocabularyRules;
+  return mergeVoiceVocabulary(stub, r);
 }
 var FABRICATION_PATTERNS = [
-  { regex: /\b\d+[,.]?\d*\s*(%|percent)/gi, label: "unverified percentage" },
+  { regex: /\b\d+(?:[,.]\d+)?\s*(?:%|percent\b)/gi, label: "unverified percentage" },
   { regex: /\b(award[- ]?winning|best[- ]selling|#\s*1)\b/gi, label: "unverified ranking" },
   {
     regex: /\b(guaranteed|proven to|studies show|scientifically proven)\b/gi,
@@ -11303,24 +11793,25 @@ function computeBrandConsistency(content, profile, threshold = 60) {
       fabricationWarnings: []
     };
   }
+  const resolved = resolveBrandProfile(profile);
   const dimensions = {
-    toneAlignment: scoreTone(content, profile),
-    vocabularyAdherence: scoreVocab(content, profile),
-    avoidCompliance: scoreAvoid(content, profile),
-    audienceRelevance: scoreAudience(content, profile),
-    brandMentions: scoreBrand(content, profile),
-    structuralPatterns: scoreStructure(content, profile)
+    toneAlignment: scoreTone(content, resolved),
+    vocabularyAdherence: scoreVocab(content, resolved),
+    avoidCompliance: scoreAvoid(content, resolved),
+    audienceRelevance: scoreAudience(content, resolved),
+    brandMentions: scoreBrand(content, resolved),
+    structuralPatterns: scoreStructure(content, resolved)
   };
   const overall = Math.round(
     Object.values(dimensions).reduce((sum, d) => sum + d.score * d.weight, 0)
   );
   const preferred = [
-    ...profile.voiceProfile?.languagePatterns || [],
-    ...profile.vocabularyRules?.preferredTerms || []
+    ...resolved.voiceProfile?.languagePatterns || [],
+    ...resolved.vocabularyRules?.preferredTerms || []
   ];
   const banned = [
-    ...profile.voiceProfile?.avoidPatterns || [],
-    ...profile.vocabularyRules?.bannedTerms || []
+    ...resolved.voiceProfile?.avoidPatterns || [],
+    ...resolved.vocabularyRules?.bannedTerms || []
   ];
   const fabrications = detectFabricationPatterns(content);
   return {
@@ -11351,11 +11842,11 @@ function hexToLab(hex) {
   const lb = srgbToLinear(b);
   const x = lr * 0.4124564 + lg * 0.3575761 + lb * 0.1804375;
   const y = lr * 0.2126729 + lg * 0.7151522 + lb * 0.072175;
-  const z36 = lr * 0.0193339 + lg * 0.119192 + lb * 0.9503041;
+  const z39 = lr * 0.0193339 + lg * 0.119192 + lb * 0.9503041;
   const f = (t) => t > 8856e-6 ? Math.cbrt(t) : 7.787 * t + 16 / 116;
   const fx = f(x / 0.95047);
   const fy = f(y / 1);
-  const fz = f(z36 / 1.08883);
+  const fz = f(z39 / 1.08883);
   return { L: 116 * fy - 16, a: 500 * (fx - fy), b: 200 * (fy - fz) };
 }
 function deltaE2000(lab1, lab2) {
@@ -11507,7 +11998,7 @@ function exportFigma(palette, typography) {
 }
 
 // src/tools/brandRuntime.ts
-function asEnvelope22(data) {
+function asEnvelope23(data) {
   return {
     _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
     data
@@ -11588,8 +12079,9 @@ function registerBrandRuntimeTools(server) {
           pagesScraped: meta.pagesScraped || 0
         }
       };
-      const envelope = asEnvelope22(runtime);
+      const envelope = asEnvelope23(runtime);
       return {
+        structuredContent: envelope,
         content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
       };
     }
@@ -11730,7 +12222,7 @@ function registerBrandRuntimeTools(server) {
       }
       const profile = row.profile_data;
       const checkResult = computeBrandConsistency(content, profile);
-      const envelope = asEnvelope22(checkResult);
+      const envelope = asEnvelope23(checkResult);
       return {
         content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
       };
@@ -11764,7 +12256,7 @@ function registerBrandRuntimeTools(server) {
         content_colors,
         threshold ?? 10
       );
-      const envelope = asEnvelope22(auditResult);
+      const envelope = asEnvelope23(auditResult);
       return {
         content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
       };
@@ -11799,7 +12291,7 @@ function registerBrandRuntimeTools(server) {
         row.profile_data.typography,
         format
       );
-      const envelope = asEnvelope22({ format, tokens: output });
+      const envelope = asEnvelope23({ format, tokens: output });
       return {
         content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
       };
@@ -11810,57 +12302,6 @@ function registerBrandRuntimeTools(server) {
 // src/tools/carousel.ts
 import { z as z28 } from "zod";
 init_supabase();
-init_request_context();
-var MAX_CREDITS_PER_RUN2 = Math.max(0, Number(process.env.SOCIALNEURON_MAX_CREDITS_PER_RUN || 0));
-var MAX_ASSETS_PER_RUN2 = Math.max(0, Number(process.env.SOCIALNEURON_MAX_ASSETS_PER_RUN || 0));
-var _globalCreditsUsed2 = 0;
-var _globalAssetsGenerated2 = 0;
-function getCreditsUsed2() {
-  const ctx = requestContext.getStore();
-  return ctx ? ctx.creditsUsed : _globalCreditsUsed2;
-}
-function addCreditsUsed2(amount) {
-  const ctx = requestContext.getStore();
-  if (ctx) {
-    ctx.creditsUsed += amount;
-  } else {
-    _globalCreditsUsed2 += amount;
-  }
-}
-function getAssetsGenerated2() {
-  const ctx = requestContext.getStore();
-  return ctx ? ctx.assetsGenerated : _globalAssetsGenerated2;
-}
-function addAssetsGenerated2(count) {
-  const ctx = requestContext.getStore();
-  if (ctx) {
-    ctx.assetsGenerated += count;
-  } else {
-    _globalAssetsGenerated2 += count;
-  }
-}
-function checkCreditBudget2(estimatedCost) {
-  if (MAX_CREDITS_PER_RUN2 <= 0) return { ok: true };
-  const used = getCreditsUsed2();
-  if (used + estimatedCost > MAX_CREDITS_PER_RUN2) {
-    return {
-      ok: false,
-      message: `Credit budget exceeded: ${used} used + ${estimatedCost} estimated > ${MAX_CREDITS_PER_RUN2} limit. Use a smaller slide count or cheaper image model.`
-    };
-  }
-  return { ok: true };
-}
-function checkAssetBudget2() {
-  if (MAX_ASSETS_PER_RUN2 <= 0) return { ok: true };
-  const gen = getAssetsGenerated2();
-  if (gen >= MAX_ASSETS_PER_RUN2) {
-    return {
-      ok: false,
-      message: `Asset limit reached: ${gen}/${MAX_ASSETS_PER_RUN2} assets generated this run.`
-    };
-  }
-  return { ok: true };
-}
 var IMAGE_CREDIT_ESTIMATES2 = {
   midjourney: 20,
   "nano-banana": 15,
@@ -11869,7 +12310,7 @@ var IMAGE_CREDIT_ESTIMATES2 = {
   "flux-max": 50,
   "gpt4o-image": 40,
   imagen4: 35,
-  "imagen4-fast": 25,
+  "imagen4-fast": 35,
   seedream: 20
 };
 async function fetchBrandVisualContext(projectId) {
@@ -11993,14 +12434,14 @@ function registerCarouselTools(server) {
       const carouselTextCost = 10 + slideCount * 2;
       const perImageCost = IMAGE_CREDIT_ESTIMATES2[image_model] ?? 30;
       const totalEstimatedCost = carouselTextCost + slideCount * perImageCost;
-      const budgetCheck = checkCreditBudget2(totalEstimatedCost);
+      const budgetCheck = checkCreditBudget(totalEstimatedCost);
       if (!budgetCheck.ok) {
         return {
           content: [{ type: "text", text: budgetCheck.message }],
           isError: true
         };
       }
-      const assetBudget = checkAssetBudget2();
+      const assetBudget = checkAssetBudget(slideCount);
       if (!assetBudget.ok) {
         return {
           content: [{ type: "text", text: assetBudget.message }],
@@ -12047,8 +12488,15 @@ function registerCarouselTools(server) {
         };
       }
       const carousel = carouselData.carousel;
+      const imageAssetBudget = checkAssetBudget(carousel.slides.length);
+      if (!imageAssetBudget.ok) {
+        return {
+          content: [{ type: "text", text: imageAssetBudget.message }],
+          isError: true
+        };
+      }
       const textCredits = carousel.credits?.used ?? carouselTextCost;
-      addCreditsUsed2(textCredits);
+      addCreditsUsed(textCredits);
       const imageJobs = await Promise.all(
         carousel.slides.map(async (slide) => {
           const promptParts = [];
@@ -12078,8 +12526,8 @@ function registerCarouselTools(server) {
             }
             const jobId = data.asyncJobId ?? data.taskId ?? null;
             if (jobId) {
-              addCreditsUsed2(perImageCost);
-              addAssetsGenerated2(1);
+              addCreditsUsed(perImageCost);
+              addAssetsGenerated(1);
             }
             return {
               slideNumber: slide.slideNumber,
@@ -12185,19 +12633,19 @@ function registerCarouselTools(server) {
 
 // src/tools/niche-research.ts
 import { z as z29 } from "zod";
-function asEnvelope23(data) {
+function asEnvelope24(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
 function registerNicheResearchTools(server) {
   server.tool(
     "find_winning_content",
-    "Find QA-gated high-performing short-form videos in the project's niche. Returns extracted hook patterns, content structures, and pre-compiled replication prompts you can use to generate new content on a different topic. Backed by niche_winners view (qa_score >= 0.5 + replication_prompt populated).",
+    "Find QA-gated high-performing short-form videos in the project's niche. Returns extracted hook patterns, content structures, and pre-compiled replication prompts you can use to generate new content on a different topic. Only QA-gated winners with a populated replication prompt are returned.",
     {
       project_id: z29.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
       platform: z29.enum(["tiktok", "instagram", "youtube", "reddit", "twitter"]).optional().describe("Filter to one platform. Omit for all platforms."),
       days: z29.number().int().min(1).max(365).default(30).describe("Window: only return winners scanned within this many days."),
       limit: z29.number().int().min(1).max(50).default(10).describe("Number of winners to return (1-50)."),
-      min_qa_score: z29.number().min(0).max(1).default(0.5).describe("Minimum QA score (0..1). Default 0.5 matches the niche_winners view floor."),
+      min_qa_score: z29.number().min(0).max(1).default(0.5).describe("Minimum QA score (0..1). Default 0.5."),
       response_format: z29.enum(["text", "json"]).optional()
     },
     async ({ project_id, platform: platform2, days, limit, min_qa_score, response_format }) => {
@@ -12219,7 +12667,7 @@ function registerNicheResearchTools(server) {
               {
                 type: "text",
                 text: JSON.stringify(
-                  asEnvelope23({
+                  asEnvelope24({
                     winners,
                     count: winners.length,
                     filters: result?.filters ?? {}
@@ -12516,6 +12964,16 @@ import { z as z31 } from "zod";
 import fs from "node:fs/promises";
 import path from "node:path";
 var CALENDAR_URI = "ui://content-calendar/mcp-app.html";
+var RecentPostOutputSchema = z31.object({
+  id: z31.string(),
+  platform: z31.string(),
+  status: z31.string(),
+  title: z31.string().nullable(),
+  external_post_id: z31.string().nullable(),
+  published_at: z31.string().nullable(),
+  scheduled_at: z31.string().nullable(),
+  created_at: z31.string()
+});
 function startOfCurrentWeekMonday() {
   const now = /* @__PURE__ */ new Date();
   const day = now.getDay();
@@ -12535,6 +12993,11 @@ function registerContentCalendarApp(server) {
           "ISO date for the week start (YYYY-MM-DD); defaults to the current week's Monday."
         )
       },
+      outputSchema: {
+        start_date: z31.string(),
+        posts: z31.array(RecentPostOutputSchema),
+        scopes: z31.array(z31.string())
+      },
       _meta: {
         ui: {
           resourceUri: CALENDAR_URI,
@@ -12573,11 +13036,17 @@ function registerContentCalendarApp(server) {
         if (!ts) return false;
         return ts.split("T")[0] >= fromDate;
       });
+      const structuredContent = {
+        start_date: fromDate,
+        posts,
+        scopes: userScopes
+      };
       return {
+        structuredContent,
         content: [
           {
             type: "text",
-            text: JSON.stringify({ posts, scopes: userScopes })
+            text: `Loaded ${posts.length} calendar post${posts.length === 1 ? "" : "s"} from ${fromDate}.`
           }
         ]
       };
@@ -12834,7 +13303,7 @@ var writeReflectionSchema = {
     prm_score_ids: z33.array(z33.string()).optional().describe("PRM score IDs that informed this reflection."),
     handoff_ids: z33.array(z33.string()).optional().describe("Handoff event IDs that triggered this reflection.")
   }).strict().describe(
-    "Source evidence for this reflection. Only these four keys are accepted (Anti-Goodhart guard \u2014 unknown keys are rejected to prevent spurious provenance claims)."
+    "Source evidence for this reflection. Only these four keys are accepted \u2014 unknown keys are rejected to prevent spurious provenance claims."
   ),
   brand_id: z33.string().describe("Brand profile UUID this reflection belongs to."),
   pipeline_id: z33.string().optional().describe("Optional: pipeline run UUID."),
@@ -12852,7 +13321,7 @@ var readReflectionSchema = {
 var recordOutcomeSchema = {
   decision_event_id: z33.string().describe("UUID of the decision_events row to record an outcome for."),
   horizon: z33.enum(["1h", "6h", "24h"]).describe(
-    "Observation horizon. Only horizon=24h with a non-null reward triggers a content_bandits posterior update; 1h/6h are stored but inert for learning."
+    "Observation horizon. Only horizon=24h with a non-null reward triggers a learning-loop update; 1h/6h are stored but inert for learning."
   ),
   reward: z33.number().min(0).max(1).describe("Normalised reward signal in [0, 1]. Higher = better outcome."),
   outcome_metrics: z33.record(z33.string(), z33.number()).optional().describe(
@@ -12862,7 +13331,7 @@ var recordOutcomeSchema = {
 function registerHarnessTools(server, _ctx) {
   server.tool(
     "write_agent_reflection",
-    "Persist a verbal reflection for an agent loop. Provenance keys are restricted (Anti-Goodhart safety): only content_history_id, outcome_event_id, prm_score_ids, and handoff_ids are accepted \u2014 unknown keys are rejected at the input layer. Requires mcp:write scope. Returns the created reflection UUID on success.",
+    "Persist a verbal reflection for an agent loop. Provenance keys are restricted to an allowlist: only content_history_id, outcome_event_id, prm_score_ids, and handoff_ids are accepted \u2014 unknown keys are rejected at the input layer. Requires mcp:write scope. Returns the created reflection UUID on success.",
     writeReflectionSchema,
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     async (args) => {
@@ -12890,7 +13359,7 @@ function registerHarnessTools(server, _ctx) {
   );
   server.tool(
     "record_outcome",
-    "Record an outcome for a published decision event. Idempotent on (decision_event_id, horizon) \u2014 safe to call multiple times. Returns idempotent:true when the row already existed (UPDATE), idempotent:false on fresh INSERT. Note: only horizon=24h with reward != null triggers a content_bandits posterior update; 1h/6h outcomes are stored but are inert for the learning loop. Requires mcp:write scope.",
+    "Record an outcome for a published decision event. Idempotent on (decision_event_id, horizon) \u2014 safe to call multiple times. Returns idempotent:true when the row already existed (UPDATE), idempotent:false on fresh INSERT. Note: only horizon=24h with reward != null triggers a learning-loop update; 1h/6h outcomes are stored but are inert for the learning loop. Requires mcp:write scope.",
     recordOutcomeSchema,
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     async (args) => {
@@ -12952,7 +13421,7 @@ function registerHarnessTools(server, _ctx) {
 
 // src/tools/hermes.ts
 import { z as z34 } from "zod";
-function asEnvelope24(data) {
+function asEnvelope25(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -12974,13 +13443,13 @@ var PLATFORM = z34.enum([
 function registerHermesTools(server) {
   server.tool(
     "save_draft_to_library",
-    "Save a draft post to the SN content library. Use when an autonomous agent (Hermes) wants to persist a draft before the founder approves it. Lands in ContentLibrary with status='draft', origin='hermes'. The draft can then be approved/edited in the SN UI.",
+    "Save a draft post to the SN content library. Use when an autonomous agent wants to persist a draft for review before publishing. Lands in the content library with status='draft'. The draft can then be approved/edited in the SN UI.",
     {
       platform: PLATFORM.describe("Target platform for the draft."),
       copy: z34.string().min(1).max(8e3).describe("The draft post body."),
       project_id: z34.string().optional().describe("SN project UUID. Optional but recommended."),
       media_url: z34.string().url().optional().describe("Optional cover/media URL (R2 signed URL)."),
-      hermes_run_id: z34.string().optional().describe("Hermes cron run id, for traceability."),
+      hermes_run_id: z34.string().optional().describe("Agent run id, for traceability."),
       source_intel_ids: z34.array(z34.string()).optional().describe("Optional list of intel_signals.id rows that informed this draft."),
       response_format: z34.enum(["text", "json"]).optional()
     },
@@ -13003,7 +13472,7 @@ function registerHermesTools(server) {
       const payload = { content_id: data?.content_id ?? null };
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope24(payload), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope25(payload), null, 2) }]
         };
       }
       return {
@@ -13047,7 +13516,7 @@ function registerHermesTools(server) {
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope24(payload), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope25(payload), null, 2) }]
         };
       }
       return {
@@ -13062,11 +13531,11 @@ function registerHermesTools(server) {
   );
   server.tool(
     "record_observation",
-    'Record an agent observation ("Hermes noticed X this week"). Surfaces in UnifiedAnalytics > Playbook tab. Use for weekly reflection digests and mid-campaign pulse summaries.',
+    'Record an agent observation (e.g. "topic X engagement up 23% this week"). Surfaces in the analytics Playbook. Use for weekly reflection digests and mid-campaign pulse summaries.',
     {
-      summary: z34.string().min(1).max(2e3).describe("One-paragraph summary, founder-facing."),
+      summary: z34.string().min(1).max(2e3).describe("One-paragraph summary, shown to the account owner."),
       deltas: z34.record(z34.string(), z34.union([z34.number(), z34.string(), z34.boolean()])).optional().describe("Optional structured key/value payload (e.g. {topic_x_er_pct: 23})."),
-      run_id: z34.string().optional().describe("Hermes cron run id for traceability."),
+      run_id: z34.string().optional().describe("Agent run id for traceability."),
       response_format: z34.enum(["text", "json"]).optional()
     },
     async ({ summary, deltas, run_id, response_format }) => {
@@ -13077,7 +13546,7 @@ function registerHermesTools(server) {
       const payload = { observation_id: data?.observation_id ?? null };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope24(payload), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope25(payload), null, 2) }]
         };
       }
       return {
@@ -13121,7 +13590,7 @@ function registerHermesTools(server) {
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope24(payload), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope25(payload), null, 2) }]
         };
       }
       return {
@@ -13136,7 +13605,7 @@ function registerHermesTools(server) {
   );
   server.tool(
     "record_campaign_spend",
-    "Log a campaign cost line. Use when Hermes incurs spend that should be attributed to a campaign \u2014 drafts, renders, paid amp. Categories: hermes_drafts / carousel_renders / analytics_pulls / paid_amplification / other. Read aggregate via get_active_campaigns.",
+    "Log a campaign cost line. Use when an autonomous agent incurs spend that should be attributed to a campaign \u2014 drafts, renders, paid amp. Read aggregate via get_active_campaigns.",
     {
       campaign_id: z34.string().min(1).max(200).describe("Campaign identifier (slug)."),
       category: z34.enum([
@@ -13165,7 +13634,7 @@ function registerHermesTools(server) {
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope24(payload), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope25(payload), null, 2) }]
         };
       }
       return {
@@ -13180,7 +13649,7 @@ function registerHermesTools(server) {
   );
   server.tool(
     "get_active_campaigns",
-    "List currently-running campaigns with thesis, budget, hero format, and current spend. Used by Hermes pitch skill to bias drafts toward active campaign themes.",
+    "List currently-running campaigns with thesis, budget, hero format, and current spend. Use to bias drafts toward active campaign themes.",
     {
       response_format: z34.enum(["text", "json"]).optional()
     },
@@ -13195,7 +13664,7 @@ function registerHermesTools(server) {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope24({ campaigns }), null, 2)
+              text: JSON.stringify(asEnvelope25({ campaigns }), null, 2)
             }
           ]
         };
@@ -13226,6 +13695,338 @@ ${"=".repeat(40)}
   );
 }
 
+// src/tools/skills.ts
+import { z as z35 } from "zod";
+
+// src/lib/skills-manifest.ts
+var SKILLS_MANIFEST = [
+  {
+    id: "skill-brand-locked-viral-hook-reel",
+    name: "Brand-locked viral hook reel",
+    studio: "video",
+    category: "hook",
+    shortDescription: "Pulls your brand voice + the hook pattern that actually worked last cycle, then renders a 12s reel with stacked camera moves and brand-cloned voice.",
+    hookFormula: "Pattern interrupt in first 0.5s + escalating stakes every 2s + brand-locked voice + cloned-from-winning-past-post structure.",
+    estimatedCredits: 580,
+    estimatedSeconds: 158,
+    featured: true,
+    stepCount: 9,
+    inspiredBy: ["MrBeast", "Alex Hormozi"]
+  }
+];
+function getSkill(id) {
+  return SKILLS_MANIFEST.find((s) => s.id === id);
+}
+function listSkills(opts) {
+  let entries = SKILLS_MANIFEST;
+  if (opts?.studio) entries = entries.filter((s) => s.studio === opts.studio);
+  if (opts?.featuredOnly) entries = entries.filter((s) => s.featured);
+  return entries;
+}
+
+// src/tools/skills.ts
+function asEnvelope26(data) {
+  return {
+    _meta: {
+      version: MCP_VERSION,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    data
+  };
+}
+var STUDIO_VALUES = ["video", "avatar", "carousel", "voice", "caption", "edit"];
+function renderSkillSummary(skill) {
+  const lines = [];
+  lines.push(`${skill.name} (${skill.id})`);
+  lines.push(`  Studio: ${skill.studio} \xB7 Category: ${skill.category}`);
+  if (skill.featured) lines.push("  \u2B50 Featured");
+  lines.push(`  ${skill.shortDescription}`);
+  lines.push(`  Hook: ${skill.hookFormula}`);
+  lines.push(
+    `  Cost: ~${skill.estimatedCredits} credits \xB7 ~${skill.estimatedSeconds}s \xB7 ${skill.stepCount} steps`
+  );
+  lines.push(`  Inspired by: ${skill.inspiredBy.join(", ")}`);
+  return lines.join("\n");
+}
+function registerSkillsTools(server) {
+  server.tool(
+    "list_skills",
+    'List Social Neuron content workflow skills available to the authenticated user. A skill is a brand-locked multi-step pipeline (research \u2192 hook \u2192 script \u2192 visuals \u2192 voice \u2192 captions \u2192 assembly \u2192 quality gate \u2192 schedule) inspired by documented viral patterns (MrBeast 3-second hook, Hormozi pattern interrupt, etc.). Use this tool when the user asks "what can SN do", "what skills are available", "show me viral templates", or before calling run_skill so you can pick the right one.',
+    {
+      studio: z35.enum(STUDIO_VALUES).optional().describe("Filter to one studio (video, avatar, carousel, voice, caption, edit)."),
+      featured_only: z35.boolean().optional().describe("Return only featured (recommended) skills. Defaults to false."),
+      response_format: z35.enum(["text", "json"]).optional().describe("Response format. Defaults to text \u2014 human-readable summary.")
+    },
+    async ({ studio, featured_only, response_format }) => {
+      const skills = listSkills({ studio, featuredOnly: featured_only });
+      const format = response_format ?? "text";
+      if (format === "json") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope26({ count: skills.length, skills }), null, 2)
+            }
+          ]
+        };
+      }
+      if (skills.length === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No skills match the filter." + (studio ? ` Studio "${studio}" has no skills yet.` : "") + "\n\nAvailable studios with skills: " + Array.from(new Set(SKILLS_MANIFEST.map((s) => s.studio))).join(", ")
+            }
+          ]
+        };
+      }
+      const blocks = skills.map(renderSkillSummary).join("\n\n");
+      const header = `${skills.length} skill${skills.length === 1 ? "" : "s"} available
+${"=".repeat(40)}`;
+      return {
+        content: [{ type: "text", text: `${header}
+
+${blocks}` }]
+      };
+    }
+  );
+  server.tool(
+    "run_skill",
+    "Run a Social Neuron workflow skill end-to-end (brand-locked content production). Returns a structured run preview with the exact step plan, credit cost, and a deep-link to launch the run in the SN dashboard. A future release executes in-process so you can stream step-by-step progress back to the user. Call list_skills first to discover available skill ids.",
+    {
+      skill_id: z35.string().describe(
+        'The id of the skill to run (e.g. "skill-brand-locked-viral-hook-reel"). Use list_skills to discover available ids.'
+      ),
+      topic: z35.string().min(1).describe('What the content is about (e.g. "why we built Social Neuron").'),
+      audience: z35.string().optional().describe(
+        'Who the content is for (e.g. "first-time founders"). Defaults to brand persona.'
+      ),
+      hook: z35.string().optional().describe(
+        "Optional explicit hook. If omitted, the skill drafts and scores 3-5 candidates."
+      ),
+      cta: z35.string().optional().describe("Optional call-to-action override. Defaults to brand standard CTA."),
+      response_format: z35.enum(["text", "json"]).optional().describe("Response format. Defaults to text.")
+    },
+    async ({ skill_id, topic, audience, hook, cta, response_format }) => {
+      const skill = getSkill(skill_id);
+      const format = response_format ?? "text";
+      if (!skill) {
+        const knownIds = SKILLS_MANIFEST.map((s) => s.id).join(", ");
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Unknown skill_id "${skill_id}". Available skills: ${knownIds}. Call list_skills for descriptions.`
+            }
+          ],
+          isError: true
+        };
+      }
+      const runUrl = "https://socialneuron.com/dashboard/creation?skill=" + encodeURIComponent(skill.id);
+      const inputs = { topic, audience, hook, cta };
+      const previewedAt = (/* @__PURE__ */ new Date()).toISOString();
+      if (format === "json") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                asEnvelope26({
+                  status: "preview",
+                  skill,
+                  inputs,
+                  runUrl,
+                  previewedAt,
+                  note: "This release returns a preview. A future release will execute in-process."
+                }),
+                null,
+                2
+              )
+            }
+          ]
+        };
+      }
+      const lines = [
+        `Ready to run: ${skill.name}`,
+        "=".repeat(40),
+        "",
+        skill.shortDescription,
+        "",
+        `Hook formula: ${skill.hookFormula}`,
+        `Inspired by:  ${skill.inspiredBy.join(", ")}`,
+        "",
+        "Inputs",
+        `  topic    : ${topic}`,
+        `  audience : ${audience ?? "(brand persona)"}`,
+        `  hook     : ${hook ?? "(auto-drafted from 3-5 candidates, scored)"}`,
+        `  cta      : ${cta ?? "(brand default)"}`,
+        "",
+        "Plan",
+        `  ${skill.stepCount} steps \xB7 ~${skill.estimatedCredits} credits \xB7 ~${skill.estimatedSeconds}s wall time`,
+        "",
+        `Launch in dashboard: ${runUrl}`,
+        "",
+        "\u26A0\uFE0F  Preview only. End-to-end MCP execution arrives in a future release."
+      ];
+      return {
+        content: [{ type: "text", text: lines.join("\n") }]
+      };
+    }
+  );
+}
+
+// src/tools/loopPulse.ts
+import { z as z36 } from "zod";
+function asEnvelope27(data) {
+  return {
+    _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+    data
+  };
+}
+function registerLoopPulseTools(server) {
+  server.tool(
+    "get_loop_pulse",
+    'Read the dynamic loop-health KPIs for the Social Neuron growth loop over the last 7 days. Returns reflection coverage, decision coverage, visual gate pass rate, learning-update application rate, per-platform learning uptake, autopilot lag, and pattern aggregation counts \u2014 each with a status ("ok" / "warn" / "bad") and a why-line explaining what the metric measures. Use this to decide whether the loop is closing or where it is stuck before recommending next moves.',
+    {
+      response_format: z36.enum(["text", "json"]).optional().describe("Output format. Defaults to text.")
+    },
+    async ({ response_format }) => {
+      const format = response_format ?? "text";
+      const { data, error } = await callEdgeFunction("mc-loop-pulse", {});
+      if (error || !data) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Failed to read loop pulse: ${error || "no data"}`
+            }
+          ],
+          isError: true
+        };
+      }
+      if (format === "json") {
+        return {
+          content: [{ type: "text", text: JSON.stringify(asEnvelope27(data), null, 2) }]
+        };
+      }
+      const rank = { bad: 0, warn: 1, unknown: 2, ok: 3 };
+      const sorted = [...data.kpis].sort((a, b) => rank[a.status] - rank[b.status]);
+      const lines = [
+        `LOOP PULSE \u2014 overall: ${data.overall.toUpperCase()}`,
+        "",
+        ...sorted.map((k) => {
+          const unit = k.unit ?? "";
+          const val = k.value == null ? "\u2014" : `${k.value}${unit}`;
+          return `[${k.status.toUpperCase().padEnd(4)}] ${k.label}: ${val}
+        ${k.why}`;
+        }),
+        "",
+        `Generated ${data.generated_at}`
+      ];
+      return {
+        content: [{ type: "text", text: lines.join("\n") }]
+      };
+    }
+  );
+}
+
+// src/tools/banditState.ts
+import { z as z37 } from "zod";
+init_supabase();
+function asEnvelope28(data) {
+  return {
+    _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+    data
+  };
+}
+function registerBanditStateTools(server) {
+  server.tool(
+    "get_bandit_state",
+    "Read the current content learning state for a project. Returns top-K arms per (arm_type, platform) with expected performance and uncertainty. Use this to reason about which hook family / format / timing slot currently performs best on each platform before recommending next moves. Arm types: hook_family, length_bucket (xs/s/m/l/xl by platform), posting_time_bucket (morning/midday/evening/late), content_format (video/carousel/image/caption/text/avatar/storyboard).",
+    {
+      project_id: z37.string().uuid().optional().describe("Project UUID. Defaults to the authenticated user default project."),
+      platform: z37.enum([
+        "instagram",
+        "tiktok",
+        "youtube",
+        "linkedin",
+        "twitter",
+        "facebook",
+        "threads",
+        "bluesky"
+      ]).optional().describe(
+        "Lowercase platform name. Omit to return both platform-scoped and legacy platform-agnostic arms."
+      ),
+      arm_type: z37.enum([
+        "hook_family",
+        "hook_type",
+        "format",
+        "timing_slot",
+        "topic_cluster",
+        "caption_style",
+        "platform",
+        "story_type",
+        "emoji_type",
+        "length_bucket",
+        "posting_time_bucket",
+        "content_format"
+      ]).optional().describe("Arm dimension. Omit to return all types grouped."),
+      top_k: z37.number().min(1).max(50).optional().describe("Max arms per (arm_type) group. Default 5."),
+      response_format: z37.enum(["text", "json"]).optional().describe("Output format. Defaults to text.")
+    },
+    async ({ project_id, platform: platform2, arm_type, top_k, response_format }) => {
+      const format = response_format ?? "text";
+      const projectId = project_id ?? await getDefaultProjectId();
+      if (!projectId) {
+        return {
+          content: [
+            { type: "text", text: "No project_id provided and no default project available." }
+          ],
+          isError: true
+        };
+      }
+      const { data, error } = await callEdgeFunction("mc-bandit-state", {
+        project_id: projectId,
+        platform: platform2,
+        arm_type,
+        top_k
+      });
+      if (error || !data) {
+        return {
+          content: [{ type: "text", text: `Failed to read bandit state: ${error || "no data"}` }],
+          isError: true
+        };
+      }
+      if (format === "json") {
+        return { content: [{ type: "text", text: JSON.stringify(asEnvelope28(data), null, 2) }] };
+      }
+      const lines = [
+        `BANDIT STATE \u2014 project ${data.project_id.slice(0, 8)}${data.platform_filter ? ` \xB7 ${data.platform_filter}` : ""}`,
+        `${data.total_arms} arms across ${data.groups.length} arm types`,
+        ""
+      ];
+      for (const group of data.groups) {
+        lines.push(`[${group.arm_type}] ${group.summary}`);
+        const renderArm = (a) => {
+          const conf = a.posterior_stdev < 0.05 ? "high" : a.posterior_stdev < 0.15 ? "med" : "low";
+          return `   ${a.arm_name.padEnd(18)} mean=${a.posterior_mean.toFixed(3)} \xB1${a.posterior_stdev.toFixed(3)} (${conf} conf \xB7 ${a.total_pulls} pulls)`;
+        };
+        if (group.platform_scoped.length > 0) {
+          lines.push(`  Per-platform top arms:`);
+          group.platform_scoped.forEach((a) => lines.push(renderArm(a)));
+        }
+        if (group.platform_agnostic.length > 0) {
+          lines.push(`  Platform-agnostic (legacy) top arms:`);
+          group.platform_agnostic.forEach((a) => lines.push(renderArm(a)));
+        }
+        lines.push("");
+      }
+      lines.push(`Generated ${data.generated_at}`);
+      return { content: [{ type: "text", text: lines.join("\n") }] };
+    }
+  );
+}
+
 // src/lib/register-tools.ts
 function wrapToolWithScanner(toolName, handler) {
   return async function scannerWrappedHandler(...handlerArgs) {
@@ -13278,7 +14079,8 @@ function wrapToolWithScanner(toolName, handler) {
 }
 function applyScopeEnforcement(server, scopeResolver) {
   const originalTool = server.tool.bind(server);
-  server.tool = function wrappedTool(...args) {
+  const originalRegisterTool = server.registerTool?.bind(server);
+  const wrapRegistration = (...args) => {
     const name = args[0];
     const requiredScope = TOOL_SCOPES[name];
     const handlerIndex = args.findIndex(
@@ -13289,27 +14091,11 @@ function applyScopeEnforcement(server, scopeResolver) {
       const scannerWrappedHandler = wrapToolWithScanner(name, originalHandler);
       args[handlerIndex] = async function scopeEnforcedHandler(...handlerArgs) {
         if (!requiredScope) {
-          return {
-            content: [
-              {
-                type: "text",
-                text: `Permission denied: '${name}' has no scope defined. Contact support.`
-              }
-            ],
-            isError: true
-          };
+          return scopeDeniedResult(name, void 0, scopeResolver());
         }
         const userScopes = scopeResolver();
         if (!hasScope(userScopes, requiredScope)) {
-          return {
-            content: [
-              {
-                type: "text",
-                text: `Permission denied: '${name}' requires scope '${requiredScope}'. Generate a new key with the required scope at https://socialneuron.com/settings/developer`
-              }
-            ],
-            isError: true
-          };
+          return scopeDeniedResult(name, requiredScope, userScopes);
         }
         const startedAt = Date.now();
         try {
@@ -13336,8 +14122,58 @@ function applyScopeEnforcement(server, scopeResolver) {
         }
       };
     }
-    return originalTool(...args);
+    return args;
+  };
+  server.tool = function wrappedTool(...args) {
+    return originalTool(...wrapRegistration(...args));
   };
+  if (originalRegisterTool) {
+    server.registerTool = function wrappedRegisterTool(...args) {
+      return originalRegisterTool(...wrapRegistration(...args));
+    };
+  }
+}
+function scopeDeniedResult(name, requiredScope, userScopes) {
+  const error = requiredScope ? {
+    error: "permission_denied",
+    tool: name,
+    required_scope: requiredScope,
+    available_scopes: userScopes,
+    recover_with: [
+      "Call search_tools with available_only=true to find tools this key can use.",
+      "Use a read-only alternative if one is available for the task.",
+      "Regenerate the API key with the required scope or upgrade the plan tier."
+    ],
+    developer_url: "https://socialneuron.com/settings/developer"
+  } : {
+    error: "tool_scope_missing",
+    tool: name,
+    available_scopes: userScopes,
+    recover_with: ["Contact support; this tool is not mapped to a required scope."]
+  };
+  const challenge = requiredScope ? buildWwwAuthenticateHeader({
+    issuerUrl: getChallengeIssuerUrl(),
+    error: "insufficient_scope",
+    errorDescription: `Tool ${name} requires scope ${requiredScope}.`,
+    scope: requiredScope
+  }) : void 0;
+  return {
+    content: [{ type: "text", text: JSON.stringify(error, null, 2) }],
+    ...challenge ? { _meta: { "mcp/www_authenticate": [challenge] } } : {},
+    isError: true
+  };
+}
+function getChallengeIssuerUrl() {
+  if (process.env.OAUTH_ISSUER_URL) return process.env.OAUTH_ISSUER_URL;
+  const mcpServerUrl = process.env.MCP_SERVER_URL;
+  if (mcpServerUrl) {
+    try {
+      const parsed = new URL(mcpServerUrl);
+      return `${parsed.protocol}//${parsed.host}`;
+    } catch {
+    }
+  }
+  return "https://mcp.socialneuron.com";
 }
 var RESPONSE_CHAR_LIMIT = 1e5;
 function truncateResponse(result) {
@@ -13408,6 +14244,9 @@ function registerAllTools(server, options) {
   registerConnectionTools(server);
   registerHarnessTools(server, void 0);
   registerHermesTools(server);
+  registerSkillsTools(server);
+  registerLoopPulseTools(server);
+  registerBanditStateTools(server);
   if (!options?.skipApps) {
     registerContentCalendarApp(server);
   }
@@ -13415,17 +14254,17 @@ function registerAllTools(server, options) {
 }
 
 // src/prompts.ts
-import { z as z35 } from "zod";
+import { z as z38 } from "zod";
 function registerPrompts(server) {
   server.prompt(
     "create_weekly_content_plan",
     "Generate a full week of social media content (7 days, multiple platforms). Returns a structured plan with topics, formats, and posting times.",
     {
-      niche: z35.string().describe('Your content niche or industry (e.g., "fitness coaching", "SaaS marketing")'),
-      platforms: z35.string().optional().describe(
+      niche: z38.string().describe('Your content niche or industry (e.g., "fitness coaching", "SaaS marketing")'),
+      platforms: z38.string().optional().describe(
         'Comma-separated platforms to target (default: "YouTube, Instagram, TikTok, LinkedIn")'
       ),
-      tone: z35.string().optional().describe('Brand tone of voice (e.g., "professional", "casual", "bold and edgy")')
+      tone: z38.string().optional().describe('Brand tone of voice (e.g., "professional", "casual", "bold and edgy")')
     },
     ({ niche, platforms, tone }) => {
       const targetPlatforms = platforms || "YouTube, Instagram, TikTok, LinkedIn";
@@ -13467,8 +14306,8 @@ After building the plan, use \`save_content_plan\` to save it.`
     "analyze_top_content",
     "Analyze your best-performing posts to identify patterns and replicate success. Returns insights on hooks, formats, timing, and topics that resonate.",
     {
-      timeframe: z35.string().optional().describe('Analysis period (default: "30 days"). E.g., "7 days", "90 days"'),
-      platform: z35.string().optional().describe('Filter to a specific platform (e.g., "youtube", "instagram")')
+      timeframe: z38.string().optional().describe('Analysis period (default: "30 days"). E.g., "7 days", "90 days"'),
+      platform: z38.string().optional().describe('Filter to a specific platform (e.g., "youtube", "instagram")')
     },
     ({ timeframe, platform: platform2 }) => {
       const period = timeframe || "30 days";
@@ -13505,10 +14344,10 @@ Format as a clear, actionable performance report.`
     "repurpose_content",
     "Take one piece of content and transform it into 8-10 pieces across multiple platforms and formats.",
     {
-      source: z35.string().describe(
+      source: z38.string().describe(
         "The source content to repurpose \u2014 a URL, transcript, or the content text itself"
       ),
-      target_platforms: z35.string().optional().describe(
+      target_platforms: z38.string().optional().describe(
         'Comma-separated target platforms (default: "Twitter, LinkedIn, Instagram, TikTok, YouTube")'
       )
     },
@@ -13550,9 +14389,9 @@ For each piece, include the platform, format, character count, and suggested pos
     "setup_brand_voice",
     "Define or refine your brand voice profile so all generated content stays on-brand. Walks through tone, audience, values, and style.",
     {
-      brand_name: z35.string().describe("Your brand or business name"),
-      industry: z35.string().optional().describe('Your industry or niche (e.g., "B2B SaaS", "fitness coaching")'),
-      website: z35.string().optional().describe("Your website URL for context")
+      brand_name: z38.string().describe("Your brand or business name"),
+      industry: z38.string().optional().describe('Your industry or niche (e.g., "B2B SaaS", "fitness coaching")'),
+      website: z38.string().optional().describe("Your website URL for context")
     },
     ({ brand_name, industry, website }) => {
       const industryContext = industry ? ` in the ${industry} space` : "";
@@ -13793,13 +14632,13 @@ function registerResources(server) {
           pro: {
             price: "$49/mo",
             credits: 1500,
-            mcp_access: "Read + Analytics",
+            mcp_access: "Read + Analytics + Write + Distribute",
             features: [
               "All Starter features",
               "Closed-loop optimization",
-              "5 autopilot runs / month",
+              "Full agent engine via MCP (generate, gate, publish)",
               "All 10 platforms",
-              "MCP read + analytics"
+              "MCP read + analytics + write + distribute"
             ]
           },
           team: {
@@ -13904,6 +14743,7 @@ function registerResources(server) {
 init_request_context();
 
 // src/lib/token-verifier.ts
+import { createHash as createHash3 } from "node:crypto";
 import * as jose from "jose";
 var jwks = null;
 function getJWKS(supabaseUrl) {
@@ -13913,39 +14753,89 @@ function getJWKS(supabaseUrl) {
   }
   return jwks;
 }
-var apiKeyCache = /* @__PURE__ */ new Map();
-var API_KEY_CACHE_TTL_MS = 1e4;
+var tokenValidationCache = /* @__PURE__ */ new Map();
+var CONNECTOR_TOKEN_VALIDATION_CACHE_TTL_MS = 3e5;
+var DEFAULT_MCP_RESOURCE = "https://mcp.socialneuron.com";
+function cacheKey(token) {
+  return createHash3("sha256").update(token).digest("hex");
+}
 function evictFromCache(token) {
-  apiKeyCache.delete(token);
+  tokenValidationCache.delete(cacheKey(token));
+}
+async function verifyCachedOpaqueToken(token, validate, ttlMs) {
+  const key = cacheKey(token);
+  const cached2 = tokenValidationCache.get(key);
+  const now = Date.now();
+  if (cached2 && cached2.expiresAt > now) {
+    const tokenExpiresAtMs2 = cached2.authInfo.expiresAt ? cached2.authInfo.expiresAt * 1e3 : void 0;
+    if (!tokenExpiresAtMs2 || tokenExpiresAtMs2 > now) {
+      return cached2.authInfo;
+    }
+  }
+  if (cached2) tokenValidationCache.delete(key);
+  const authInfo = await validate();
+  const tokenExpiresAtMs = authInfo.expiresAt ? authInfo.expiresAt * 1e3 : void 0;
+  const cacheExpiresAt = Math.min(Date.now() + ttlMs, tokenExpiresAtMs ?? Number.POSITIVE_INFINITY);
+  if (cacheExpiresAt > Date.now()) {
+    tokenValidationCache.set(key, {
+      authInfo,
+      expiresAt: cacheExpiresAt
+    });
+  }
+  if (tokenValidationCache.size > 100) {
+    const now2 = Date.now();
+    for (const [k, v] of tokenValidationCache) {
+      if (v.expiresAt <= now2) tokenValidationCache.delete(k);
+    }
+  }
+  return authInfo;
 }
 function createTokenVerifier(options) {
   const { supabaseUrl, supabaseAnonKey } = options;
+  const expectedResource = normalizeResource(
+    options.resource ?? process.env.MCP_RESOURCE_URL ?? process.env.MCP_SERVER_URL
+  ) ?? DEFAULT_MCP_RESOURCE;
   return {
     async verifyAccessToken(token) {
       if (token.startsWith("snk_")) {
-        const cached = apiKeyCache.get(token);
-        if (cached && cached.expiresAt > Date.now()) {
-          return cached.authInfo;
-        }
-        if (cached) apiKeyCache.delete(token);
-        const authInfo = await verifyApiKey(token, supabaseUrl, supabaseAnonKey);
-        apiKeyCache.set(token, { authInfo, expiresAt: Date.now() + API_KEY_CACHE_TTL_MS });
-        if (apiKeyCache.size > 100) {
-          const now = Date.now();
-          for (const [k, v] of apiKeyCache) {
-            if (v.expiresAt <= now) apiKeyCache.delete(k);
-          }
-        }
-        return authInfo;
+        return verifyApiKey(token, supabaseUrl, supabaseAnonKey);
+      }
+      if (token.startsWith("sno_")) {
+        return verifyCachedOpaqueToken(
+          token,
+          () => verifyConnectorToken(token, supabaseUrl, supabaseAnonKey, expectedResource),
+          CONNECTOR_TOKEN_VALIDATION_CACHE_TTL_MS
+        );
       }
       return verifySupabaseJwt(token, supabaseUrl);
     }
   };
 }
+function normalizeResource(value) {
+  if (!value) return void 0;
+  try {
+    const parsed = new URL(value);
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch {
+    return value.replace(/\/$/, "");
+  }
+}
+function audienceIncludesExpected(audience, expectedResource) {
+  if (typeof audience === "string") {
+    return normalizeResource(audience) === expectedResource;
+  }
+  if (Array.isArray(audience)) {
+    return audience.some((item) => audienceIncludesExpected(item, expectedResource));
+  }
+  return false;
+}
 async function verifySupabaseJwt(token, supabaseUrl) {
   const jwksKeySet = getJWKS(supabaseUrl);
   const { payload } = await jose.jwtVerify(token, jwksKeySet, {
-    issuer: `${supabaseUrl}/auth/v1`
+    issuer: `${supabaseUrl}/auth/v1`,
+    audience: "authenticated",
+    algorithms: ["RS256", "ES256"],
+    clockTolerance: "30s"
   });
   const userId = payload.sub;
   if (!userId) {
@@ -14004,9 +14894,59 @@ async function verifyApiKey(apiKey, supabaseUrl, supabaseAnonKey) {
     throw err;
   }
 }
+async function verifyConnectorToken(accessToken, supabaseUrl, supabaseAnonKey, expectedResource) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 1e4);
+  try {
+    const response = await fetch(
+      `${supabaseUrl}/functions/v1/mcp-auth?action=validate-connector-token`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${supabaseAnonKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ access_token: accessToken, resource: expectedResource }),
+        signal: controller.signal
+      }
+    );
+    if (!response.ok) {
+      throw new Error(`Connector token validation failed: HTTP ${response.status}`);
+    }
+    const data = await response.json();
+    if (!data.valid || !data.userId) {
+      throw new Error(data.error ?? "Invalid connector token");
+    }
+    const expiresAt = data.expiresAt ? Math.floor(new Date(data.expiresAt).getTime() / 1e3) : void 0;
+    if (expiresAt && expiresAt < Math.floor(Date.now() / 1e3)) {
+      throw new Error("Connector token expired");
+    }
+    const tokenResource = data.resource ?? data.audience ?? data.aud;
+    if (!audienceIncludesExpected(tokenResource, expectedResource)) {
+      throw new Error("Connector token audience/resource mismatch");
+    }
+    return {
+      token: accessToken,
+      clientId: data.clientId ?? "connector-oauth",
+      scopes: data.scopes ?? ["mcp:read"],
+      expiresAt,
+      extra: { userId: data.userId, email: data.email, resource: expectedResource }
+    };
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error("Connector token validation timed out");
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
 
 // src/lib/oauth-provider.ts
-import { InvalidClientMetadataError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import {
+  InvalidClientMetadataError,
+  TooManyRequestsError
+} from "@modelcontextprotocol/sdk/server/auth/errors.js";
 init_supabase();
 var ALLOWED_REDIRECT_URIS = /* @__PURE__ */ new Set([
   // Claude Code local callback
@@ -14024,11 +14964,18 @@ var ALLOWED_REDIRECT_URIS = /* @__PURE__ */ new Set([
   "https://glama.ai/callback",
   "https://mcp.so/callback"
 ]);
+var ALLOWED_LOOPBACK_CALLBACK_PATHS = /* @__PURE__ */ new Set([
+  "/oauth/callback",
+  "/oauth/callback/debug",
+  // Codex uses an ephemeral loopback server with this callback path.
+  "/callback"
+]);
+var CODEX_LOOPBACK_CALLBACK_PATH_RE = /^\/callback\/[A-Za-z0-9_-]+$/;
 function isAllowedRedirectUri(uri) {
   if (ALLOWED_REDIRECT_URIS.has(uri)) return true;
   try {
     const parsed = new URL(uri);
-    if ((parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") && (parsed.pathname === "/oauth/callback" || parsed.pathname === "/oauth/callback/debug") && parsed.protocol === "http:") {
+    if ((parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") && (ALLOWED_LOOPBACK_CALLBACK_PATHS.has(parsed.pathname) || CODEX_LOOPBACK_CALLBACK_PATH_RE.test(parsed.pathname)) && parsed.protocol === "http:") {
       return true;
     }
     if (parsed.protocol === "https:") {
@@ -14038,6 +14985,45 @@ function isAllowedRedirectUri(uri) {
   }
   return false;
 }
+var MAX_CLIENT_NAME_BYTES = 512;
+var MAX_REDIRECT_URIS = 10;
+var MAX_REDIRECT_URI_BYTES = 2048;
+var MAX_METADATA_BYTES = 8192;
+var MAX_CACHED_CLIENTS = 1e3;
+var MAX_PERSISTED_CLIENTS = 5e3;
+var OAUTH_CLIENT_RETENTION_DAYS = 90;
+function byteLength(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function assertMaxBytes(label, value, maxBytes) {
+  if (value !== void 0 && byteLength(value) > maxBytes) {
+    throw new InvalidClientMetadataError(`${label} exceeds ${maxBytes} bytes`);
+  }
+}
+function assertRegistrationWithinBounds(client3) {
+  assertMaxBytes("client_name", client3.client_name, MAX_CLIENT_NAME_BYTES);
+  if ((client3.redirect_uris?.length ?? 0) > MAX_REDIRECT_URIS) {
+    throw new InvalidClientMetadataError(`redirect_uris exceeds ${MAX_REDIRECT_URIS} entries`);
+  }
+  for (const uri of client3.redirect_uris ?? []) {
+    assertMaxBytes("redirect_uri", uri, MAX_REDIRECT_URI_BYTES);
+  }
+  const metadataBytes = byteLength(JSON.stringify(clientToRow(client3).metadata));
+  if (metadataBytes > MAX_METADATA_BYTES) {
+    throw new InvalidClientMetadataError(`client metadata exceeds ${MAX_METADATA_BYTES} bytes`);
+  }
+}
+function cacheClient(cache, clientId, client3) {
+  if (cache.has(clientId)) {
+    cache.delete(clientId);
+  }
+  cache.set(clientId, client3);
+  while (cache.size > MAX_CACHED_CLIENTS) {
+    const oldestClientId = cache.keys().next().value;
+    if (!oldestClientId) break;
+    cache.delete(oldestClientId);
+  }
+}
 function rowToClient(row) {
   return {
     client_id: row.client_id,
@@ -14082,8 +15068,8 @@ function createClientsStore() {
   }
   return {
     async getClient(clientId) {
-      const cached = cache.get(clientId);
-      if (cached) return cached;
+      const cached2 = cache.get(clientId);
+      if (cached2) return cached2;
       if (!supabaseAvailable) return void 0;
       try {
         const supabase = getSupabaseClient();
@@ -14094,7 +15080,7 @@ function createClientsStore() {
         }
         if (!data || Array.isArray(data) && data.length === 0) return void 0;
         const client3 = rowToClient(data);
-        cache.set(clientId, client3);
+        cacheClient(cache, clientId, client3);
         void supabase.from("mcp_oauth_clients").update({ last_used_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("client_id", clientId);
         return client3;
       } catch (err) {
@@ -14110,18 +15096,38 @@ function createClientsStore() {
           }
         }
       }
-      cache.set(client3.client_id, client3);
+      assertRegistrationWithinBounds(client3);
       if (supabaseAvailable) {
         try {
           const supabase = getSupabaseClient();
-          const { error } = await supabase.from("mcp_oauth_clients").insert(clientToRow(client3));
-          if (error) {
-            markUnavailable(error.message);
+          const retentionCutoff = new Date(
+            Date.now() - OAUTH_CLIENT_RETENTION_DAYS * 24 * 60 * 60 * 1e3
+          ).toISOString();
+          const { error: pruneError } = await supabase.from("mcp_oauth_clients").delete().lt("last_used_at", retentionCutoff);
+          if (pruneError) {
+            markUnavailable(pruneError.message);
+          } else {
+            const { count, error: countError } = await supabase.from("mcp_oauth_clients").select("client_id", { count: "exact", head: true });
+            if (countError) {
+              markUnavailable(countError.message);
+            } else {
+              if ((count ?? 0) >= MAX_PERSISTED_CLIENTS) {
+                throw new TooManyRequestsError(
+                  "OAuth client registration capacity reached; retry later"
+                );
+              }
+              const { error } = await supabase.from("mcp_oauth_clients").insert(clientToRow(client3));
+              if (error) {
+                markUnavailable(error.message);
+              }
+            }
           }
         } catch (err) {
+          if (err instanceof TooManyRequestsError) throw err;
           markUnavailable(err instanceof Error ? err.message : "unknown error");
         }
       }
+      cacheClient(cache, client3.client_id, client3);
       return client3;
     }
   };
@@ -14154,6 +15160,10 @@ function createOAuthProvider(options) {
       if (params.redirectUri) {
         consentUrl.searchParams.set("redirect_uri", params.redirectUri);
       }
+      const resource = params.resource;
+      if (resource) {
+        consentUrl.searchParams.set("resource", resource.href);
+      }
       res.redirect(consentUrl.toString());
     },
     async challengeForAuthorizationCode(_client, _authorizationCode) {
@@ -14161,7 +15171,7 @@ function createOAuthProvider(options) {
         "Local PKCE validation is disabled \u2014 challengeForAuthorizationCode should not be called. PKCE is verified server-side by the mcp-auth Edge Function."
       );
     },
-    async exchangeAuthorizationCode(_client, authorizationCode, codeVerifier, redirectUri) {
+    async exchangeAuthorizationCode(client3, authorizationCode, codeVerifier, redirectUri, resource) {
       if (!codeVerifier) {
         throw new Error("code_verifier is required for PKCE exchange");
       }
@@ -14179,8 +15189,14 @@ function createOAuthProvider(options) {
             code_verifier: codeVerifier,
             authorization_code: authorizationCode,
             return_token: true,
+            // Forward client_id so the Edge Function can match it against
+            // the client that the code was originally issued to.
+            client_id: client3.client_id,
             // Pass redirect_uri for server-side verification (OAuth spec)
-            ...redirectUri && { redirect_uri: redirectUri }
+            ...redirectUri && { redirect_uri: redirectUri },
+            // ChatGPT sends resource; backend should bind issued connector
+            // tokens to that MCP resource/audience.
+            ...resource && { resource: resource.href }
           }),
           signal: controller.signal
         });
@@ -14203,13 +15219,55 @@ function createOAuthProvider(options) {
       return {
         access_token: data.access_token,
         token_type: "bearer",
-        expires_in: data.expires_in ?? 7776e3,
-        // 90 days default
-        scope: data.scopes?.join(" ")
+        expires_in: data.expires_in ?? (data.access_token.startsWith("snk_") ? 7776e3 : 3600),
+        scope: data.scopes?.join(" "),
+        ...data.refresh_token ? { refresh_token: data.refresh_token } : {}
       };
     },
-    async exchangeRefreshToken(_client, _refreshToken, _scopes) {
-      throw new Error("Refresh tokens are not supported. Generate a new API key.");
+    async exchangeRefreshToken(client3, refreshToken, scopes, resource) {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 1e4);
+      try {
+        const response = await fetch(
+          `${supabaseUrl}/functions/v1/mcp-auth?action=refresh-connector-token`,
+          {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${supabaseAnonKey}`,
+              "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+              client_id: client3.client_id,
+              refresh_token: refreshToken,
+              ...scopes && scopes.length > 0 ? { scopes } : {},
+              ...resource ? { resource: resource.href } : {}
+            }),
+            signal: controller.signal
+          }
+        );
+        if (!response.ok) {
+          const err = await response.json().catch(() => ({ error: "Refresh failed" }));
+          throw new Error(err.error ?? `HTTP ${response.status}`);
+        }
+        const data = await response.json();
+        if (!data.access_token) {
+          throw new Error(data.error ?? "No access token returned from refresh");
+        }
+        return {
+          access_token: data.access_token,
+          token_type: "bearer",
+          expires_in: data.expires_in ?? 3600,
+          scope: data.scopes?.join(" "),
+          ...data.refresh_token ? { refresh_token: data.refresh_token } : {}
+        };
+      } catch (err) {
+        if (err instanceof Error && err.name === "AbortError") {
+          throw new Error("Refresh token exchange timed out");
+        }
+        throw err;
+      } finally {
+        clearTimeout(timer);
+      }
     },
     async verifyAccessToken(token) {
       return tokenVerifier2.verifyAccessToken(token);
@@ -14219,15 +15277,23 @@ function createOAuthProvider(options) {
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), 1e4);
       try {
-        await fetch(`${supabaseUrl}/functions/v1/mcp-auth?action=revoke-by-token`, {
+        const action = request.token.startsWith("sno_") || request.token_type_hint === "refresh_token" ? "revoke-connector-token" : "revoke-by-token";
+        const response = await fetch(`${supabaseUrl}/functions/v1/mcp-auth?action=${action}`, {
           method: "POST",
           headers: {
             Authorization: `Bearer ${supabaseAnonKey}`,
             "Content-Type": "application/json"
           },
-          body: JSON.stringify({ token: request.token }),
+          body: JSON.stringify({
+            token: request.token,
+            token_type_hint: request.token_type_hint,
+            client_id: _client.client_id
+          }),
           signal: controller.signal
         });
+        if (!response.ok) {
+          throw new Error(`Token revocation failed: HTTP ${response.status}`);
+        }
       } catch (err) {
         const msg = err instanceof Error ? err.message : "unknown";
         console.error(`[oauth] Token revocation call failed: ${msg}`);
@@ -14241,27 +15307,120 @@ function createOAuthProvider(options) {
 // src/http.ts
 init_posthog();
 
-// src/lib/www-authenticate.ts
-function buildWwwAuthenticateHeader(opts) {
-  const params = ['realm="socialneuron"'];
-  if (opts.error) {
-    params.push(`error="${opts.error.replace(/[\\"]/g, "_")}"`);
+// src/lib/discovery-catalog.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+var cached = null;
+function buildDiscoveryCatalog() {
+  if (!cached) cached = computeDiscoveryCatalog();
+  return cached;
+}
+async function computeDiscoveryCatalog() {
+  const schemaByName = /* @__PURE__ */ new Map();
+  try {
+    const probe = new McpServer({ name: "discovery-probe", version: MCP_VERSION });
+    registerAllTools(probe, { skipScreenshots: true });
+    const handlers = probe.server._requestHandlers;
+    const listHandler = handlers.get("tools/list");
+    if (listHandler) {
+      const out = await listHandler({ method: "tools/list", params: {} }, {});
+      for (const t of out.tools) {
+        const props = t.inputSchema?.properties;
+        if (props && Object.keys(props).length > 0) {
+          schemaByName.set(t.name, {
+            type: "object",
+            properties: props,
+            ...t.inputSchema?.required ? { required: t.inputSchema.required } : {}
+          });
+        }
+      }
+    }
+  } catch (err) {
+    console.error(
+      "[mcp] discovery schema build failed; serving names-only catalog:",
+      err?.message
+    );
   }
-  if (opts.errorDescription) {
-    params.push(`error_description="${opts.errorDescription.replace(/[\\"]/g, "_")}"`);
+  return TOOL_CATALOG.filter((t) => !t.localOnly && !t.internal).map((t) => ({
+    name: t.name,
+    description: t.description,
+    inputSchema: schemaByName.get(t.name) ?? { type: "object", properties: {} }
+  }));
+}
+
+// src/lib/origin-policy.ts
+var PRODUCTION_FALLBACK_ORIGINS = [
+  "https://socialneuron.com",
+  "https://www.socialneuron.com",
+  "https://app.socialneuron.com"
+];
+var DEVELOPMENT_FALLBACK_ORIGINS = [
+  "http://localhost:3000",
+  "http://localhost:3001",
+  "http://localhost:5173",
+  "http://localhost:8080",
+  "http://127.0.0.1:3000",
+  "http://127.0.0.1:3001",
+  "http://127.0.0.1:5173",
+  "http://127.0.0.1:8080"
+];
+function normalizeOrigin(value) {
+  const trimmed = value.trim();
+  if (!trimmed || trimmed === "*" || trimmed.toLowerCase() === "null") return null;
+  try {
+    const url = new URL(trimmed);
+    if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+    if (!url.hostname) return null;
+    return url.origin;
+  } catch {
+    return null;
   }
-  const issuer = opts.issuerUrl.replace(/\/+$/, "");
-  params.push(`resource_metadata="${issuer}/.well-known/oauth-protected-resource"`);
-  return `Bearer ${params.join(", ")}`;
+}
+function parseAllowedOrigins(raw) {
+  const origins = /* @__PURE__ */ new Set();
+  for (const entry of (raw ?? "").split(",")) {
+    const normalized = normalizeOrigin(entry);
+    if (normalized) origins.add(normalized);
+  }
+  return origins;
+}
+function buildOriginPolicy(input) {
+  const envOrigins = parseAllowedOrigins(input.allowedOriginsEnv);
+  if (envOrigins.size > 0) {
+    return { allowedOrigins: envOrigins, source: "env" };
+  }
+  const fallback = new Set(PRODUCTION_FALLBACK_ORIGINS);
+  for (const configuredUrl of input.configuredUrls ?? []) {
+    const normalized = normalizeOrigin(configuredUrl);
+    if (normalized) fallback.add(normalized);
+  }
+  if (input.nodeEnv !== "production") {
+    for (const origin of DEVELOPMENT_FALLBACK_ORIGINS) fallback.add(origin);
+  }
+  return { allowedOrigins: fallback, source: "fallback" };
+}
+function validateBrowserOrigin(originHeader, policy) {
+  if (originHeader === void 0) return { allowed: true, origin: null };
+  if (Array.isArray(originHeader)) return { allowed: false, reason: "invalid_origin" };
+  const normalized = normalizeOrigin(originHeader);
+  if (!normalized || !policy.allowedOrigins.has(normalized)) {
+    return { allowed: false, reason: "invalid_origin" };
+  }
+  return { allowed: true, origin: normalized };
 }
 
 // src/http.ts
+process.env.MCP_TRANSPORT = "http";
 var PORT = parseInt(process.env.PORT ?? "8080", 10);
 var SUPABASE_URL2 = process.env.SUPABASE_URL ?? "";
 var SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY ?? "";
 var MCP_SERVER_URL = process.env.MCP_SERVER_URL ?? `http://localhost:${PORT}/mcp`;
 var APP_BASE_URL = process.env.APP_BASE_URL ?? "https://www.socialneuron.com";
 var NODE_ENV = process.env.NODE_ENV ?? "development";
+var ORIGIN_POLICY = buildOriginPolicy({
+  allowedOriginsEnv: process.env.ALLOWED_ORIGINS,
+  configuredUrls: [APP_BASE_URL, MCP_SERVER_URL],
+  nodeEnv: NODE_ENV
+});
 function deriveOAuthIssuerUrl() {
   if (process.env.OAUTH_ISSUER_URL) {
     return process.env.OAUTH_ISSUER_URL;
@@ -14335,7 +15494,9 @@ var cleanupInterval = setInterval(
 );
 var app = express();
 app.disable("x-powered-by");
-app.use(express.json());
+var defaultJsonParser = express.json({ limit: "100kb" });
+var authenticatedMcpJsonParser = express.json({ limit: "16mb" });
+var unauthenticatedMcpJsonParser = express.json({ limit: "100kb" });
 app.set("trust proxy", 1);
 var ipBuckets = /* @__PURE__ */ new Map();
 var IP_RATE_MAX = 60;
@@ -14378,20 +15539,35 @@ app.use((_req, res, next) => {
   res.setHeader("X-Content-Type-Options", "nosniff");
   next();
 });
-app.use((_req, res, next) => {
-  res.setHeader("Access-Control-Allow-Origin", "*");
+app.use((req, res, next) => {
+  const originCheck = validateBrowserOrigin(req.headers.origin, ORIGIN_POLICY);
+  if (!originCheck.allowed) {
+    res.status(403).json({
+      error: "invalid_origin",
+      error_description: "Request Origin is not allowed."
+    });
+    return;
+  }
+  if (originCheck.origin) {
+    res.setHeader("Access-Control-Allow-Origin", originCheck.origin);
+    res.setHeader("Vary", "Origin");
+  }
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
   res.setHeader(
     "Access-Control-Allow-Headers",
     "Content-Type, Authorization, Mcp-Session-Id, MCP-Protocol-Version"
   );
   res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id, WWW-Authenticate");
-  if (_req.method === "OPTIONS") {
+  if (req.method === "OPTIONS") {
     res.status(204).end();
     return;
   }
   next();
 });
+app.use((req, res, next) => {
+  if (req.path === "/mcp") return next();
+  defaultJsonParser(req, res, next);
+});
 var oauthProvider = createOAuthProvider({
   supabaseUrl: SUPABASE_URL2,
   supabaseAnonKey: SUPABASE_ANON_KEY,
@@ -14429,6 +15605,26 @@ var authRouter = mcpAuthRouter({
   serviceDocumentationUrl: new URL("https://socialneuron.com/for-developers"),
   scopesSupported: SCOPES_SUPPORTED
 });
+function normalizeOAuthResourceParam(value) {
+  const values = Array.isArray(value) ? value : [value];
+  const strings = values.filter(
+    (item) => typeof item === "string" && item.length > 0
+  );
+  const issuer = OAUTH_ISSUER_URL.replace(/\/$/, "");
+  return strings.find((item) => item.replace(/\/$/, "") === issuer) ?? strings[0];
+}
+app.use((req, _res, next) => {
+  if ((req.path === "/authorize" || req.path === "/token") && Array.isArray(req.query.resource)) {
+    const normalized = normalizeOAuthResourceParam(req.query.resource);
+    if (normalized) {
+      const normalizedUrl = new URL(req.originalUrl, OAUTH_ISSUER_URL);
+      normalizedUrl.searchParams.delete("resource");
+      normalizedUrl.searchParams.set("resource", normalized);
+      req.url = `${normalizedUrl.pathname}${normalizedUrl.search}`;
+    }
+  }
+  next();
+});
 app.use((req, res, next) => {
   authRouter(req, res, (err) => {
     if (err) {
@@ -14477,6 +15673,16 @@ async function authenticateRequest(req, res, next) {
     });
   }
 }
+app.use("/mcp", (req, res, next) => {
+  if (req.method !== "POST") return next();
+  if (!req.headers.authorization?.startsWith("Bearer ")) return next();
+  authenticateRequest(req, res, next);
+});
+app.use("/mcp", (req, res, next) => {
+  if (req.method !== "POST") return next();
+  const parser = req.auth ? authenticatedMcpJsonParser : unauthenticatedMcpJsonParser;
+  parser(req, res, next);
+});
 app.get("/.well-known/mcp/server-card.json", (_req, res) => {
   res.json({
     serverInfo: {
@@ -14487,8 +15693,8 @@ app.get("/.well-known/mcp/server-card.json", (_req, res) => {
       required: true,
       schemes: ["oauth2"]
     },
-    toolCount: TOOL_CATALOG.length,
-    tools: TOOL_CATALOG.map((t) => ({
+    toolCount: TOOL_CATALOG.filter((t) => !t.localOnly && !t.internal).length,
+    tools: TOOL_CATALOG.filter((t) => !t.localOnly && !t.internal).map((t) => ({
       name: t.name,
       description: t.description,
       module: t.module,
@@ -14566,19 +15772,32 @@ app.post("/mcp", (req, res, next) => {
   const body = req.body;
   if (body?.jsonrpc !== "2.0") return next();
   if (body.method === "tools/list") {
-    res.json({
-      jsonrpc: "2.0",
-      id: body.id ?? null,
-      result: {
-        tools: TOOL_CATALOG.map((t) => ({
-          name: t.name,
-          description: t.description,
-          inputSchema: { type: "object", properties: {} }
-        }))
-      }
+    const hasBearer = req.headers.authorization?.startsWith("Bearer ");
+    if (hasBearer) {
+      next();
+      return;
+    }
+    buildDiscoveryCatalog().then((tools) => {
+      res.json({ jsonrpc: "2.0", id: body.id ?? null, result: { tools } });
+    }).catch(() => {
+      res.json({
+        jsonrpc: "2.0",
+        id: body.id ?? null,
+        result: {
+          tools: TOOL_CATALOG.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: { type: "object", properties: {} }
+          }))
+        }
+      });
     });
     return;
   }
+  if (req.auth) {
+    next();
+    return;
+  }
   authenticateRequest(req, res, next);
 });
 app.post("/mcp", async (req, res) => {
@@ -14631,7 +15850,7 @@ app.post("/mcp", async (req, res) => {
       });
       return;
     }
-    const server = new McpServer({
+    const server = new McpServer2({
       name: "socialneuron",
       version: MCP_VERSION
     });
@@ -14717,9 +15936,17 @@ app.delete("/mcp", authenticateRequest, async (req, res) => {
 });
 app.use((err, _req, res, _next) => {
   console.error("[MCP HTTP] Unhandled Express error:", err.stack || err.message || err);
-  if (!res.headersSent) {
-    res.status(500).json({ error: "internal_error", error_description: sanitizeError(err) });
+  if (res.headersSent) return;
+  const e = err;
+  const status = e.status ?? e.statusCode;
+  if (status === 413 || e.type === "entity.too.large") {
+    res.status(413).json({
+      error: "payload_too_large",
+      error_description: "Request body exceeds the allowed JSON limit."
+    });
+    return;
   }
+  res.status(500).json({ error: "internal_error", error_description: sanitizeError(err) });
 });
 var httpServer = app.listen(PORT, "0.0.0.0", () => {
   console.log(`[MCP HTTP] Social Neuron MCP Server listening on 0.0.0.0:${PORT}`);