@socialneuron/mcp-server 1.7.3 → 1.7.5

package/dist/http.js

@@ -570,6 +570,8 @@ var TOOL_SCOPES = {
   get_brand_runtime: "mcp:read",
   explain_brand_system: "mcp:read",
   check_brand_consistency: "mcp:read",
+  audit_brand_colors: "mcp:read",
+  export_design_tokens: "mcp:read",
   get_ideation_context: "mcp:read",
   get_credit_balance: "mcp:read",
   get_budget_status: "mcp:read",
@@ -591,6 +593,7 @@ var TOOL_SCOPES = {
   create_storyboard: "mcp:write",
   generate_voiceover: "mcp:write",
   generate_carousel: "mcp:write",
+  create_carousel: "mcp:write",
   upload_media: "mcp:write",
   // mcp:read (media)
   get_media_url: "mcp:read",
@@ -609,6 +612,11 @@ var TOOL_SCOPES = {
   list_autopilot_configs: "mcp:autopilot",
   update_autopilot_config: "mcp:autopilot",
   get_autopilot_status: "mcp:autopilot",
+  // Recipes
+  list_recipes: "mcp:read",
+  get_recipe_details: "mcp:read",
+  execute_recipe: "mcp:write",
+  get_recipe_run_status: "mcp:read",
   // mcp:read (content lifecycle — read-only tools)
   extract_url_content: "mcp:read",
   quality_check: "mcp:read",
@@ -1375,7 +1383,7 @@ init_supabase();
 init_request_context();
 
 // src/lib/version.ts
-var MCP_VERSION = "1.7.2";
+var MCP_VERSION = "1.7.5";
 
 // src/tools/content.ts
 var MAX_CREDITS_PER_RUN = Math.max(0, Number(process.env.SOCIALNEURON_MAX_CREDITS_PER_RUN || 0));
@@ -2543,7 +2551,7 @@ var ERROR_PATTERNS = [
   // Generic sensitive patterns (API keys, URLs with secrets)
   [/[a-z0-9]{32,}.*key|Bearer [a-zA-Z0-9._-]+/i, "An internal error occurred. Please try again."]
 ];
-function sanitizeError2(error) {
+function sanitizeError(error) {
   const msg = error instanceof Error ? error.message : typeof error === "string" ? error : "Unknown error";
   if (process.env.NODE_ENV !== "production") {
     console.error("[Error]", msg);
@@ -2556,6 +2564,171 @@ function sanitizeError2(error) {
   return "An unexpected error occurred. Please try again.";
 }
 
+// src/lib/ssrf.ts
+var BLOCKED_IP_PATTERNS = [
+  // IPv4 localhost/loopback
+  /^127\./,
+  /^0\./,
+  // IPv4 private ranges (RFC 1918)
+  /^10\./,
+  /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
+  /^192\.168\./,
+  // IPv4 link-local
+  /^169\.254\./,
+  // Cloud metadata endpoint (AWS, GCP, Azure)
+  /^169\.254\.169\.254$/,
+  // IPv4 broadcast
+  /^255\./,
+  // Shared address space (RFC 6598)
+  /^100\.(6[4-9]|[7-9][0-9]|1[0-1][0-9]|12[0-7])\./
+];
+var BLOCKED_IPV6_PATTERNS = [
+  /^::1$/i,
+  // loopback
+  /^::$/i,
+  // unspecified
+  /^fe[89ab][0-9a-f]:/i,
+  // link-local fe80::/10
+  /^fc[0-9a-f]:/i,
+  // unique local fc00::/7
+  /^fd[0-9a-f]:/i,
+  // unique local fc00::/7
+  /^::ffff:127\./i,
+  // IPv4-mapped localhost
+  /^::ffff:(0|10|127|169\.254|172\.(1[6-9]|2[0-9]|3[0-1])|192\.168)\./i
+  // IPv4-mapped private
+];
+var BLOCKED_HOSTNAMES = [
+  "localhost",
+  "localhost.localdomain",
+  "local",
+  "127.0.0.1",
+  "0.0.0.0",
+  "[::1]",
+  "[::ffff:127.0.0.1]",
+  // Cloud metadata endpoints
+  "metadata.google.internal",
+  "metadata.goog",
+  "instance-data",
+  "instance-data.ec2.internal"
+];
+var ALLOWED_PROTOCOLS = ["http:", "https:"];
+var BLOCKED_PORTS = [22, 23, 25, 110, 143, 445, 3306, 5432, 6379, 27017, 11211];
+function isBlockedIP(ip) {
+  const normalized = ip.replace(/^\[/, "").replace(/\]$/, "");
+  if (normalized.includes(":")) {
+    return BLOCKED_IPV6_PATTERNS.some((pattern) => pattern.test(normalized));
+  }
+  return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+function isBlockedHostname(hostname) {
+  return BLOCKED_HOSTNAMES.includes(hostname.toLowerCase());
+}
+function isIPAddress(hostname) {
+  const ipv4Pattern = /^(\d{1,3}\.){3}\d{1,3}$/;
+  const ipv6Pattern = /^\[?[a-fA-F0-9:]+\]?$/;
+  return ipv4Pattern.test(hostname) || ipv6Pattern.test(hostname);
+}
+async function validateUrlForSSRF(urlString) {
+  try {
+    const url = new URL(urlString);
+    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
+      return {
+        isValid: false,
+        error: `Invalid protocol: ${url.protocol}. Only HTTP and HTTPS are allowed.`
+      };
+    }
+    if (url.username || url.password) {
+      return {
+        isValid: false,
+        error: "URLs with embedded credentials are not allowed."
+      };
+    }
+    const hostname = url.hostname.toLowerCase();
+    if (isBlockedHostname(hostname)) {
+      return {
+        isValid: false,
+        error: "Access to internal/localhost addresses is not allowed."
+      };
+    }
+    if (isIPAddress(hostname) && isBlockedIP(hostname)) {
+      return {
+        isValid: false,
+        error: "Access to private/internal IP addresses is not allowed."
+      };
+    }
+    const port = url.port ? parseInt(url.port, 10) : url.protocol === "https:" ? 443 : 80;
+    if (BLOCKED_PORTS.includes(port)) {
+      return {
+        isValid: false,
+        error: `Access to port ${port} is not allowed.`
+      };
+    }
+    let resolvedIP;
+    if (!isIPAddress(hostname)) {
+      try {
+        const dns = await import("node:dns");
+        const resolver = new dns.promises.Resolver();
+        const resolvedIPs = [];
+        try {
+          const aRecords = await resolver.resolve4(hostname);
+          resolvedIPs.push(...aRecords);
+        } catch {
+        }
+        try {
+          const aaaaRecords = await resolver.resolve6(hostname);
+          resolvedIPs.push(...aaaaRecords);
+        } catch {
+        }
+        if (resolvedIPs.length === 0) {
+          return {
+            isValid: false,
+            error: "DNS resolution failed: hostname did not resolve to any address."
+          };
+        }
+        for (const ip of resolvedIPs) {
+          if (isBlockedIP(ip)) {
+            return {
+              isValid: false,
+              error: "Hostname resolves to a private/internal IP address."
+            };
+          }
+        }
+        resolvedIP = resolvedIPs[0];
+      } catch {
+        return {
+          isValid: false,
+          error: "DNS resolution failed. Cannot verify hostname safety."
+        };
+      }
+    }
+    return { isValid: true, sanitizedUrl: url.toString(), resolvedIP };
+  } catch (error) {
+    return {
+      isValid: false,
+      error: `Invalid URL format: ${error instanceof Error ? error.message : "Unknown error"}`
+    };
+  }
+}
+function quickSSRFCheck(urlString) {
+  try {
+    const url = new URL(urlString);
+    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
+      return { isValid: false, error: `Invalid protocol: ${url.protocol}` };
+    }
+    if (url.username || url.password) {
+      return { isValid: false, error: "URLs with credentials not allowed" };
+    }
+    const hostname = url.hostname.toLowerCase();
+    if (isBlockedHostname(hostname) || isIPAddress(hostname) && isBlockedIP(hostname)) {
+      return { isValid: false, error: "Access to internal addresses not allowed" };
+    }
+    return { isValid: true, sanitizedUrl: url.toString() };
+  } catch {
+    return { isValid: false, error: "Invalid URL format" };
+  }
+}
+
 // src/tools/distribution.ts
 init_supabase();
 
@@ -2717,16 +2890,42 @@ function asEnvelope2(data) {
     data
   };
 }
+function isAlreadyR2Signed(url) {
+  try {
+    const u = new URL(url);
+    return u.searchParams.has("X-Amz-Signature");
+  } catch {
+    return false;
+  }
+}
+async function rehostExternalUrl(mediaUrl, projectId) {
+  if (isAlreadyR2Signed(mediaUrl)) {
+    return { signedUrl: mediaUrl, r2Key: "" };
+  }
+  const ssrf = quickSSRFCheck(mediaUrl);
+  if (!ssrf.isValid) {
+    return { error: ssrf.error ?? "URL rejected by SSRF check" };
+  }
+  const { data, error } = await callEdgeFunction(
+    "upload-to-r2",
+    { url: ssrf.sanitizedUrl ?? mediaUrl, projectId },
+    { timeoutMs: 6e4 }
+  );
+  if (error || !data?.key || !data?.url) {
+    return { error: error ?? "upload-to-r2 returned no key" };
+  }
+  return { signedUrl: data.url, r2Key: data.key };
+}
 function registerDistributionTools(server) {
   server.tool(
     "schedule_post",
     'Publish or schedule a post to connected social platforms. Check list_connected_accounts first to verify active OAuth for each target platform. For Instagram carousels: use media_type=CAROUSEL_ALBUM with 2-10 media_urls. For YouTube: title is required. schedule_at uses ISO 8601 (e.g. "2026-03-20T14:00:00Z") \u2014 omit to post immediately.',
     {
       media_url: z3.string().optional().describe(
-        "URL of the media file to post. Public URL or R2 signed URL. Not needed if media_urls, r2_key, or job_id is provided."
+        "URL of the media file to post. Any public HTTPS URL works \u2014 including ephemeral generator URLs (Replicate, OpenAI, DALL-E). The server persists non-R2 URLs into R2 before posting so scheduled posts and byte-upload platforms (X, LinkedIn, YouTube, Bluesky) do not 404 when the source URL expires. Set auto_rehost=false to skip. Not needed if media_urls, r2_key, or job_id is provided."
       ),
       media_urls: z3.array(z3.string()).optional().describe(
-        "Array of 2-10 image URLs for carousel posts. Each must be publicly accessible or R2 signed URL. Use with media_type=CAROUSEL_ALBUM."
+        "Array of 2-10 image URLs for carousel posts. Same rehosting rules as media_url \u2014 ephemeral URLs are persisted automatically. Use with media_type=CAROUSEL_ALBUM."
       ),
       r2_key: z3.string().optional().describe(
         "R2 object key from upload_media. Signed on demand at post time \u2014 survives scheduling delays. Alternative to media_url."
@@ -2815,7 +3014,10 @@ function registerDistributionTools(server) {
       ),
       project_id: z3.string().optional().describe("Social Neuron project ID to associate this post with."),
       response_format: z3.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text."),
-      attribution: z3.boolean().optional().describe('If true, appends "Created with Social Neuron" to the caption. Default: false.')
+      attribution: z3.boolean().optional().describe('If true, appends "Created with Social Neuron" to the caption. Default: false.'),
+      auto_rehost: z3.boolean().optional().describe(
+        "Whether to persist non-R2 media_url/media_urls into R2 before posting. Default: true. Set to false only if you know the source URL will outlive the scheduling window and every target platform supports URL ingest."
+      )
     },
     async ({
       media_url,
@@ -2829,6 +3031,7 @@ function registerDistributionTools(server) {
       project_id,
       response_format,
       attribution,
+      auto_rehost,
       r2_key,
       r2_keys,
       job_id,
@@ -2940,12 +3143,54 @@ function registerDistributionTools(server) {
           }
           resolvedMediaUrls = resolved;
         }
+        const shouldRehost = auto_rehost !== false;
+        if (shouldRehost && resolvedMediaUrl && !isAlreadyR2Signed(resolvedMediaUrl)) {
+          const rehost = await rehostExternalUrl(resolvedMediaUrl, project_id);
+          if ("error" in rehost) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `Failed to persist media URL into R2: ${rehost.error}. Try upload_media first and pass r2_key instead, or set auto_rehost=false if you're sure the URL is publicly durable and every target platform accepts URL ingest.`
+                }
+              ],
+              isError: true
+            };
+          }
+          resolvedMediaUrl = rehost.signedUrl;
+        }
+        if (shouldRehost && resolvedMediaUrls && resolvedMediaUrls.length > 0) {
+          const needsRehost = resolvedMediaUrls.map((u) => !isAlreadyR2Signed(u));
+          if (needsRehost.some(Boolean)) {
+            const rehosted = await Promise.all(
+              resolvedMediaUrls.map(
+                (u, i) => needsRehost[i] ? rehostExternalUrl(u, project_id) : Promise.resolve({ signedUrl: u, r2Key: "" })
+              )
+            );
+            const failIdx = rehosted.findIndex((r) => "error" in r);
+            if (failIdx !== -1) {
+              const failed = rehosted[failIdx];
+              return {
+                content: [
+                  {
+                    type: "text",
+                    text: `Failed to persist media_urls[${failIdx}] into R2: ${failed.error}. Try upload_media first and pass r2_keys instead, or set auto_rehost=false.`
+                  }
+                ],
+                isError: true
+              };
+            }
+            resolvedMediaUrls = rehosted.map(
+              (r) => r.signedUrl
+            );
+          }
+        }
       } catch (resolveErr) {
         return {
           content: [
             {
               type: "text",
-              text: `Failed to resolve media: ${sanitizeError2(resolveErr)}`
+              text: `Failed to resolve media: ${sanitizeError(resolveErr)}`
             }
           ],
           isError: true
@@ -3310,7 +3555,7 @@ Created with Social Neuron`;
         return { content: [{ type: "text", text: lines.join("\n") }], isError: false };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "find_next_slots",
           status: "error",
@@ -3830,7 +4075,7 @@ Created with Social Neuron`;
         };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "schedule_content_plan",
           status: "error",
@@ -3852,6 +4097,19 @@ import { readFile } from "node:fs/promises";
 import { basename, extname } from "node:path";
 init_supabase();
 var MAX_BASE64_SIZE = 10 * 1024 * 1024;
+var ALLOWED_UPLOAD_TYPES = /* @__PURE__ */ new Set([
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "image/svg+xml",
+  "video/mp4",
+  "video/quicktime",
+  "video/x-msvideo",
+  "video/webm"
+]);
+var BASE64_CHARS = /^[A-Za-z0-9+/]+={0,2}$/;
+var DATA_URI_PREFIX = /^data:([^;,]+);base64,/;
 function maskR2Key(key) {
   const segments = key.split("/");
   return segments.length >= 3 ? `\u2026/${segments.slice(-2).join("/")}` : key;
@@ -3872,21 +4130,35 @@ function inferContentType(filePath) {
   };
   return map[ext] || "application/octet-stream";
 }
+function approxBase64Size(raw) {
+  const len = raw.length;
+  if (len === 0) return 0;
+  let padding = 0;
+  if (raw.endsWith("==")) padding = 2;
+  else if (raw.endsWith("=")) padding = 1;
+  return Math.floor(len * 3 / 4) - padding;
+}
 function registerMediaTools(server) {
   server.tool(
     "upload_media",
-    "Upload a local file or external URL to persistent R2 storage. Returns a durable r2_key that can be passed to schedule_post. Use for images, videos, or any media that needs to be posted to social platforms. Accepts local file paths (in MCP stdio mode) or public URLs. Max 10MB for base64 upload \u2014 larger files return an error with guidance.",
+    "Upload media to persistent R2 storage. Returns a durable r2_key that can be passed to schedule_post. Three input modes: (1) local file path (stdio mode only), (2) public URL fetched by the server, (3) inline base64 via file_data \u2014 use this from Claude Desktop, Claude Web, or any remote agent that cannot hand the server a filesystem path. Base64 uploads are capped at 10MB decoded; larger files still need stdio + presigned PUT.",
     {
-      source: z4.string().describe(
-        'Local file path (e.g. "/Users/me/image.png") or public URL (e.g. "https://example.com/photo.jpg"). Local files are read and uploaded as base64. URLs are fetched by the server.'
+      source: z4.string().optional().describe(
+        'Local file path (e.g. "/Users/me/image.png") or public URL (e.g. "https://example.com/photo.jpg"). Leave empty when passing file_data instead.'
+      ),
+      file_data: z4.string().optional().describe(
+        'Base64-encoded file bytes, with or without a "data:<mime>;base64," prefix. Use this from remote agents (Claude Web/Desktop) that cannot provide a filesystem path. Max 10MB decoded.'
+      ),
+      file_name: z4.string().optional().describe(
+        'Optional filename for the upload (e.g. "hero.png"). Path components are stripped \u2014 only the basename is used.'
       ),
       content_type: z4.string().optional().describe(
-        'MIME type (e.g. "image/png", "video/mp4"). Auto-detected from file extension if omitted.'
+        'MIME type (e.g. "image/png", "video/mp4"). Auto-detected from file extension for paths/URLs, or from the data: prefix on file_data. Required when passing raw base64 with no prefix.'
       ),
       project_id: z4.string().optional().describe("Project ID for R2 path organization."),
       response_format: z4.enum(["text", "json"]).optional().describe("Response format. Default: text.")
     },
-    async ({ source, content_type, project_id, response_format }) => {
+    async ({ source, file_data, file_name, content_type, project_id, response_format }) => {
       const format = response_format ?? "text";
       const startedAt = Date.now();
       const userId = await getDefaultUserId();
@@ -3908,46 +4180,187 @@ function registerMediaTools(server) {
           isError: true
         };
       }
-      const isUrl = source.startsWith("http://") || source.startsWith("https://");
-      const isLocalFile = !isUrl;
-      let uploadBody;
-      if (isUrl) {
-        const ct = content_type || inferContentType(source);
-        uploadBody = {
-          url: source,
+      if (!source && !file_data) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "upload_media requires either `source` (path or URL) or `file_data` (base64)."
+            }
+          ],
+          isError: true
+        };
+      }
+      if (file_data) {
+        let raw = file_data;
+        let detectedType;
+        const prefixMatch = raw.match(DATA_URI_PREFIX);
+        if (prefixMatch) {
+          detectedType = prefixMatch[1].trim().toLowerCase();
+          raw = raw.slice(prefixMatch[0].length);
+        }
+        const ct = (content_type ?? detectedType ?? "").trim().toLowerCase();
+        if (!ct) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: "content_type is required when file_data has no data: prefix."
+              }
+            ],
+            isError: true
+          };
+        }
+        if (!ALLOWED_UPLOAD_TYPES.has(ct)) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `content_type "${ct}" is not supported. Allowed: ${[...ALLOWED_UPLOAD_TYPES].sort().join(", ")}.`
+              }
+            ],
+            isError: true
+          };
+        }
+        const stripped = raw.replace(/\s+/g, "");
+        if (!BASE64_CHARS.test(stripped)) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: "file_data is not valid base64 \u2014 only A-Z, a-z, 0-9, +, /, = are allowed."
+              }
+            ],
+            isError: true
+          };
+        }
+        const approxSize = approxBase64Size(stripped);
+        if (approxSize > MAX_BASE64_SIZE) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `file_data exceeds the 10MB base64 cap (got ~${(approxSize / 1024 / 1024).toFixed(1)}MB). For larger files, run the stdio MCP server locally and pass a file path so the server can use presigned PUT upload.`
+              }
+            ],
+            isError: true
+          };
+        }
+        const safeName = basename(file_name ?? "upload");
+        const uploadBody2 = {
+          fileData: `data:${ct};base64,${stripped}`,
           contentType: ct,
-          fileName: basename(new URL(source).pathname) || "upload",
+          fileName: safeName,
           projectId: project_id
         };
-      } else {
-        let fileBuffer;
-        try {
-          fileBuffer = await readFile(source);
-        } catch (err) {
+        const { data: data2, error: error2 } = await callEdgeFunction("upload-to-r2", uploadBody2, { timeoutMs: 6e4 });
+        if (error2) {
           await logMcpToolInvocation({
             toolName: "upload_media",
             status: "error",
             durationMs: Date.now() - startedAt,
-            details: { error: `File not found: ${source}` }
+            details: { error: error2, source: "base64", contentType: ct, size: approxSize }
           });
           return {
-            content: [
-              {
-                type: "text",
-                text: `File not found or not readable: ${source}`
-              }
-            ],
+            content: [{ type: "text", text: `Upload failed: ${error2}` }],
             isError: true
           };
         }
-        const ct = content_type || inferContentType(source);
-        if (fileBuffer.length > MAX_BASE64_SIZE) {
-          const { data: putData, error: putError } = await callEdgeFunction(
-            "get-signed-url",
+        if (!data2?.key) {
+          return {
+            content: [{ type: "text", text: "Upload returned no R2 key." }],
+            isError: true
+          };
+        }
+        await logMcpToolInvocation({
+          toolName: "upload_media",
+          status: "success",
+          durationMs: Date.now() - startedAt,
+          details: {
+            source: "base64",
+            r2Key: data2.key,
+            size: data2.size,
+            contentType: data2.contentType
+          }
+        });
+        if (format === "json") {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(
+                  {
+                    r2_key: data2.key,
+                    signed_url: data2.url,
+                    size: data2.size,
+                    content_type: data2.contentType
+                  },
+                  null,
+                  2
+                )
+              }
+            ],
+            isError: false
+          };
+        }
+        return {
+          content: [
+            {
+              type: "text",
+              text: [
+                "Media uploaded successfully.",
+                `Media key: ${maskR2Key(data2.key)}`,
+                `Signed URL: ${data2.url}`,
+                `Size: ${(data2.size / 1024).toFixed(0)}KB`,
+                `Type: ${data2.contentType}`,
+                "",
+                "Use job_id or response_format=json with schedule_post to post to any platform."
+              ].join("\n")
+            }
+          ],
+          isError: false
+        };
+      }
+      const src = source;
+      const isUrl = src.startsWith("http://") || src.startsWith("https://");
+      let uploadBody;
+      if (isUrl) {
+        const ct = content_type || inferContentType(src);
+        uploadBody = {
+          url: src,
+          contentType: ct,
+          fileName: basename(file_name ?? new URL(src).pathname) || "upload",
+          projectId: project_id
+        };
+      } else {
+        let fileBuffer;
+        try {
+          fileBuffer = await readFile(src);
+        } catch {
+          await logMcpToolInvocation({
+            toolName: "upload_media",
+            status: "error",
+            durationMs: Date.now() - startedAt,
+            details: { error: "File not found", source: "local" }
+          });
+          return {
+            content: [
+              {
+                type: "text",
+                text: `File not found or not readable: ${src}. Remote agents (Claude Web/Desktop) cannot see the MCP server's filesystem \u2014 pass the bytes via the \`file_data\` parameter (base64, up to 10MB) instead.`
+              }
+            ],
+            isError: true
+          };
+        }
+        const ct = content_type || inferContentType(src);
+        if (fileBuffer.length > MAX_BASE64_SIZE) {
+          const { data: putData, error: putError } = await callEdgeFunction(
+            "get-signed-url",
             {
               operation: "put",
               contentType: ct,
-              filename: basename(source),
+              filename: basename(file_name ?? src),
               projectId: project_id
             },
             { timeoutMs: 1e4 }
@@ -4049,7 +4462,7 @@ function registerMediaTools(server) {
         uploadBody = {
           fileData: base64,
           contentType: ct,
-          fileName: basename(source),
+          fileName: basename(file_name ?? src),
           projectId: project_id
         };
       }
@@ -4438,155 +4851,6 @@ function formatAnalytics(summary, days, format) {
 // src/tools/brand.ts
 import { z as z6 } from "zod";
 init_supabase();
-
-// src/lib/ssrf.ts
-var BLOCKED_IP_PATTERNS = [
-  // IPv4 localhost/loopback
-  /^127\./,
-  /^0\./,
-  // IPv4 private ranges (RFC 1918)
-  /^10\./,
-  /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
-  /^192\.168\./,
-  // IPv4 link-local
-  /^169\.254\./,
-  // Cloud metadata endpoint (AWS, GCP, Azure)
-  /^169\.254\.169\.254$/,
-  // IPv4 broadcast
-  /^255\./,
-  // Shared address space (RFC 6598)
-  /^100\.(6[4-9]|[7-9][0-9]|1[0-1][0-9]|12[0-7])\./
-];
-var BLOCKED_IPV6_PATTERNS = [
-  /^::1$/i,
-  // loopback
-  /^::$/i,
-  // unspecified
-  /^fe[89ab][0-9a-f]:/i,
-  // link-local fe80::/10
-  /^fc[0-9a-f]:/i,
-  // unique local fc00::/7
-  /^fd[0-9a-f]:/i,
-  // unique local fc00::/7
-  /^::ffff:127\./i,
-  // IPv4-mapped localhost
-  /^::ffff:(0|10|127|169\.254|172\.(1[6-9]|2[0-9]|3[0-1])|192\.168)\./i
-  // IPv4-mapped private
-];
-var BLOCKED_HOSTNAMES = [
-  "localhost",
-  "localhost.localdomain",
-  "local",
-  "127.0.0.1",
-  "0.0.0.0",
-  "[::1]",
-  "[::ffff:127.0.0.1]",
-  // Cloud metadata endpoints
-  "metadata.google.internal",
-  "metadata.goog",
-  "instance-data",
-  "instance-data.ec2.internal"
-];
-var ALLOWED_PROTOCOLS = ["http:", "https:"];
-var BLOCKED_PORTS = [22, 23, 25, 110, 143, 445, 3306, 5432, 6379, 27017, 11211];
-function isBlockedIP(ip) {
-  const normalized = ip.replace(/^\[/, "").replace(/\]$/, "");
-  if (normalized.includes(":")) {
-    return BLOCKED_IPV6_PATTERNS.some((pattern) => pattern.test(normalized));
-  }
-  return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(normalized));
-}
-function isBlockedHostname(hostname) {
-  return BLOCKED_HOSTNAMES.includes(hostname.toLowerCase());
-}
-function isIPAddress(hostname) {
-  const ipv4Pattern = /^(\d{1,3}\.){3}\d{1,3}$/;
-  const ipv6Pattern = /^\[?[a-fA-F0-9:]+\]?$/;
-  return ipv4Pattern.test(hostname) || ipv6Pattern.test(hostname);
-}
-async function validateUrlForSSRF(urlString) {
-  try {
-    const url = new URL(urlString);
-    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
-      return {
-        isValid: false,
-        error: `Invalid protocol: ${url.protocol}. Only HTTP and HTTPS are allowed.`
-      };
-    }
-    if (url.username || url.password) {
-      return {
-        isValid: false,
-        error: "URLs with embedded credentials are not allowed."
-      };
-    }
-    const hostname = url.hostname.toLowerCase();
-    if (isBlockedHostname(hostname)) {
-      return {
-        isValid: false,
-        error: "Access to internal/localhost addresses is not allowed."
-      };
-    }
-    if (isIPAddress(hostname) && isBlockedIP(hostname)) {
-      return {
-        isValid: false,
-        error: "Access to private/internal IP addresses is not allowed."
-      };
-    }
-    const port = url.port ? parseInt(url.port, 10) : url.protocol === "https:" ? 443 : 80;
-    if (BLOCKED_PORTS.includes(port)) {
-      return {
-        isValid: false,
-        error: `Access to port ${port} is not allowed.`
-      };
-    }
-    let resolvedIP;
-    if (!isIPAddress(hostname)) {
-      try {
-        const dns = await import("node:dns");
-        const resolver = new dns.promises.Resolver();
-        const resolvedIPs = [];
-        try {
-          const aRecords = await resolver.resolve4(hostname);
-          resolvedIPs.push(...aRecords);
-        } catch {
-        }
-        try {
-          const aaaaRecords = await resolver.resolve6(hostname);
-          resolvedIPs.push(...aaaaRecords);
-        } catch {
-        }
-        if (resolvedIPs.length === 0) {
-          return {
-            isValid: false,
-            error: "DNS resolution failed: hostname did not resolve to any address."
-          };
-        }
-        for (const ip of resolvedIPs) {
-          if (isBlockedIP(ip)) {
-            return {
-              isValid: false,
-              error: "Hostname resolves to a private/internal IP address."
-            };
-          }
-        }
-        resolvedIP = resolvedIPs[0];
-      } catch {
-        return {
-          isValid: false,
-          error: "DNS resolution failed. Cannot verify hostname safety."
-        };
-      }
-    }
-    return { isValid: true, sanitizedUrl: url.toString(), resolvedIP };
-  } catch (error) {
-    return {
-      isValid: false,
-      error: `Invalid URL format: ${error instanceof Error ? error.message : "Unknown error"}`
-    };
-  }
-}
-
-// src/tools/brand.ts
 function asEnvelope4(data) {
   return {
     _meta: {
@@ -5109,7 +5373,7 @@ function registerScreenshotTools(server) {
         };
       } catch (err) {
         await closeBrowser();
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         await logMcpToolInvocation({
           toolName: "capture_app_page",
           status: "error",
@@ -5265,7 +5529,7 @@ function registerScreenshotTools(server) {
         };
       } catch (err) {
         await closeBrowser();
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         await logMcpToolInvocation({
           toolName: "capture_screenshot",
           status: "error",
@@ -5558,7 +5822,7 @@ function registerRemotionTools(server) {
           ]
         };
       } catch (err) {
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         await logMcpToolInvocation({
           toolName: "render_demo_video",
           status: "error",
@@ -5686,7 +5950,7 @@ function registerRemotionTools(server) {
           ]
         };
       } catch (err) {
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         await logMcpToolInvocation({
           toolName: "render_template_video",
           status: "error",
@@ -7130,44 +7394,310 @@ Active: ${is_active}`
   );
 }
 
-// src/tools/extraction.ts
+// src/tools/recipes.ts
 import { z as z17 } from "zod";
-init_supabase();
 function asEnvelope13(data) {
-  return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
-}
-function isYouTubeUrl(url) {
-  if (/youtube\.com\/watch|youtu\.be\//.test(url)) return "video";
-  if (/youtube\.com\/@/.test(url)) return "channel";
-  return false;
+  return {
+    _meta: {
+      version: MCP_VERSION,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    data
+  };
 }
-function formatExtractedContentAsText(content) {
-  const lines = [];
-  lines.push(`Source: ${content.source_type} (${content.url})`);
-  lines.push(`Title: ${content.title}`);
-  if (content.description) lines.push(`
-Description:
-${content.description}`);
-  if (content.transcript)
-    lines.push(
-      `
-Transcript:
-${content.transcript.slice(0, 3e3)}${content.transcript.length > 3e3 ? "\n... (truncated)" : ""}`
-    );
-  if (content.video_metadata) {
-    const m = content.video_metadata;
-    lines.push(`
-Metadata:`);
-    lines.push(`  Channel: ${m.channel_name}`);
-    lines.push(`  Views: ${m.views?.toLocaleString() ?? "N/A"}`);
-    lines.push(`  Likes: ${m.likes?.toLocaleString() ?? "N/A"}`);
-    lines.push(`  Duration: ${m.duration ?? "N/A"}s`);
-    if (m.tags?.length) lines.push(`  Tags: ${m.tags.join(", ")}`);
-  }
-  if (content.features?.length)
-    lines.push(`
-Features:
-${content.features.map((f) => `  - ${f}`).join("\n")}`);
+function registerRecipeTools(server) {
+  server.tool(
+    "list_recipes",
+    'List available recipe templates. Recipes are pre-built multi-step workflows like "Weekly Instagram Calendar" or "Product Launch Sequence" that automate common content operations. Use this to discover what recipes are available before running one.',
+    {
+      category: z17.enum([
+        "content_creation",
+        "distribution",
+        "repurposing",
+        "analytics",
+        "engagement",
+        "general"
+      ]).optional().describe("Filter by category. Omit to list all."),
+      featured_only: z17.boolean().optional().describe("If true, only return featured recipes. Defaults to false."),
+      response_format: z17.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
+    },
+    async ({ category, featured_only, response_format }) => {
+      const format = response_format ?? "text";
+      const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
+        action: "list-recipes",
+        category: category ?? null,
+        featured_only: featured_only ?? false
+      });
+      if (efError) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Error fetching recipes: ${efError}`
+            }
+          ],
+          isError: true
+        };
+      }
+      const recipes = result?.recipes ?? [];
+      if (format === "json") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope13(recipes))
+            }
+          ]
+        };
+      }
+      if (recipes.length === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No recipes found. Recipes are pre-built automation templates \u2014 check back after setup."
+            }
+          ]
+        };
+      }
+      const lines = recipes.map(
+        (r) => `**${r.name}** (${r.slug})
+  ${r.description}
+  Category: ${r.category} | Credits: ~${r.estimated_credits} | Steps: ${r.steps.length}${r.is_featured ? " | \u2B50 Featured" : ""}
+  Inputs: ${r.inputs_schema.map((i) => `${i.label}${i.required ? "*" : ""}`).join(", ")}`
+      );
+      return {
+        content: [
+          {
+            type: "text",
+            text: `## Available Recipes (${recipes.length})
+
+${lines.join("\n\n")}`
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "get_recipe_details",
+    "Get full details of a recipe template including all steps, input schema, and estimated costs. Use this before execute_recipe to understand what inputs are required.",
+    {
+      slug: z17.string().describe('Recipe slug (e.g., "weekly-instagram-calendar")'),
+      response_format: z17.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
+    },
+    async ({ slug, response_format }) => {
+      const format = response_format ?? "text";
+      const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
+        action: "get-recipe-details",
+        slug
+      });
+      if (efError) {
+        return {
+          content: [{ type: "text", text: `Error: ${efError}` }],
+          isError: true
+        };
+      }
+      const recipe = result?.recipe;
+      if (!recipe) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Recipe "${slug}" not found. Use list_recipes to see available recipes.`
+            }
+          ],
+          isError: true
+        };
+      }
+      if (format === "json") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope13(recipe))
+            }
+          ]
+        };
+      }
+      const stepsText = recipe.steps.map((s, i) => `  ${i + 1}. **${s.name}** (${s.type})`).join("\n");
+      const inputsText = recipe.inputs_schema.map(
+        (i) => `  - **${i.label}**${i.required ? " (required)" : ""}: ${i.type}${i.placeholder ? ` \u2014 e.g., "${i.placeholder}"` : ""}`
+      ).join("\n");
+      return {
+        content: [
+          {
+            type: "text",
+            text: [
+              `## ${recipe.name}`,
+              recipe.description,
+              "",
+              `**Category:** ${recipe.category}`,
+              `**Estimated credits:** ~${recipe.estimated_credits}`,
+              `**Estimated time:** ~${Math.round(recipe.estimated_duration_seconds / 60)} minutes`,
+              "",
+              "### Steps",
+              stepsText,
+              "",
+              "### Required Inputs",
+              inputsText
+            ].join("\n")
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "execute_recipe",
+    "Execute a recipe template with the provided inputs. This creates a recipe run that processes each step sequentially. Long-running recipes will return a run_id you can check with get_recipe_run_status.",
+    {
+      slug: z17.string().describe('Recipe slug (e.g., "weekly-instagram-calendar")'),
+      inputs: z17.record(z17.unknown()).describe(
+        "Input values matching the recipe input schema. Use get_recipe_details to see required inputs."
+      ),
+      response_format: z17.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
+    },
+    async ({ slug, inputs, response_format }) => {
+      const format = response_format ?? "text";
+      const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
+        action: "execute-recipe",
+        slug,
+        inputs
+      });
+      if (efError) {
+        return {
+          content: [{ type: "text", text: `Error: ${efError}` }],
+          isError: true
+        };
+      }
+      if (format === "json") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope13(result))
+            }
+          ]
+        };
+      }
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Recipe "${slug}" started.
+
+**Run ID:** ${result?.run_id}
+**Status:** ${result?.status}
+
+${result?.message || "Use get_recipe_run_status to check progress."}`
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "get_recipe_run_status",
+    "Check the status of a running recipe execution. Shows progress, current step, credits used, and outputs when complete.",
+    {
+      run_id: z17.string().describe("The recipe run ID returned by execute_recipe"),
+      response_format: z17.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
+    },
+    async ({ run_id, response_format }) => {
+      const format = response_format ?? "text";
+      const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
+        action: "get-recipe-run-status",
+        run_id
+      });
+      if (efError) {
+        return {
+          content: [{ type: "text", text: `Error: ${efError}` }],
+          isError: true
+        };
+      }
+      const run = result?.run;
+      if (!run) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Run "${run_id}" not found.`
+            }
+          ],
+          isError: true
+        };
+      }
+      if (format === "json") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope13(run))
+            }
+          ]
+        };
+      }
+      const statusEmoji = run.status === "completed" ? "Done" : run.status === "failed" ? "Failed" : run.status === "running" ? "Running" : run.status;
+      return {
+        content: [
+          {
+            type: "text",
+            text: [
+              `**Recipe Run:** ${run.id}`,
+              `**Status:** ${statusEmoji}`,
+              `**Progress:** ${run.progress}%`,
+              run.current_step ? `**Current step:** ${run.current_step}` : "",
+              `**Credits used:** ${run.credits_used}`,
+              run.completed_at ? `**Completed:** ${run.completed_at}` : "",
+              run.outputs ? `
+**Outputs:**
+\`\`\`json
+${JSON.stringify(run.outputs, null, 2)}
+\`\`\`` : ""
+            ].filter(Boolean).join("\n")
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/extraction.ts
+import { z as z18 } from "zod";
+init_supabase();
+function asEnvelope14(data) {
+  return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
+}
+function isYouTubeUrl(url) {
+  if (/youtube\.com\/watch|youtu\.be\//.test(url)) return "video";
+  if (/youtube\.com\/@/.test(url)) return "channel";
+  return false;
+}
+function formatExtractedContentAsText(content) {
+  const lines = [];
+  lines.push(`Source: ${content.source_type} (${content.url})`);
+  lines.push(`Title: ${content.title}`);
+  if (content.description) lines.push(`
+Description:
+${content.description}`);
+  if (content.transcript)
+    lines.push(
+      `
+Transcript:
+${content.transcript.slice(0, 3e3)}${content.transcript.length > 3e3 ? "\n... (truncated)" : ""}`
+    );
+  if (content.video_metadata) {
+    const m = content.video_metadata;
+    lines.push(`
+Metadata:`);
+    lines.push(`  Channel: ${m.channel_name}`);
+    lines.push(`  Views: ${m.views?.toLocaleString() ?? "N/A"}`);
+    lines.push(`  Likes: ${m.likes?.toLocaleString() ?? "N/A"}`);
+    lines.push(`  Duration: ${m.duration ?? "N/A"}s`);
+    if (m.tags?.length) lines.push(`  Tags: ${m.tags.join(", ")}`);
+  }
+  if (content.features?.length)
+    lines.push(`
+Features:
+${content.features.map((f) => `  - ${f}`).join("\n")}`);
   if (content.benefits?.length)
     lines.push(`
 Benefits:
@@ -7187,11 +7717,11 @@ function registerExtractionTools(server) {
     "extract_url_content",
     "Extract text content from any URL \u2014 YouTube video transcripts, article text, or product page features/benefits/USP. YouTube URLs auto-route to transcript extraction with optional comments. Use before generate_content to repurpose existing content, or before plan_content_week to base a content plan on a source URL.",
     {
-      url: z17.string().url().describe("URL to extract content from"),
-      extract_type: z17.enum(["auto", "transcript", "article", "product"]).default("auto").describe("Type of extraction"),
-      include_comments: z17.boolean().default(false).describe("Include top comments (YouTube only)"),
-      max_results: z17.number().min(1).max(100).default(10).describe("Max comments to include"),
-      response_format: z17.enum(["text", "json"]).default("text")
+      url: z18.string().url().describe("URL to extract content from"),
+      extract_type: z18.enum(["auto", "transcript", "article", "product"]).default("auto").describe("Type of extraction"),
+      include_comments: z18.boolean().default(false).describe("Include top comments (YouTube only)"),
+      max_results: z18.number().min(1).max(100).default(10).describe("Max comments to include"),
+      response_format: z18.enum(["text", "json"]).default("text")
     },
     async ({ url, extract_type, include_comments, max_results, response_format }) => {
       const startedAt = Date.now();
@@ -7326,7 +7856,7 @@ function registerExtractionTools(server) {
         if (response_format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope13(extracted), null, 2) }
+              { type: "text", text: JSON.stringify(asEnvelope14(extracted), null, 2) }
             ],
             isError: false
           };
@@ -7337,7 +7867,7 @@ function registerExtractionTools(server) {
         };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "extract_url_content",
           status: "error",
@@ -7354,9 +7884,9 @@ function registerExtractionTools(server) {
 }
 
 // src/tools/quality.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 init_supabase();
-function asEnvelope14(data) {
+function asEnvelope15(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
 function registerQualityTools(server) {
@@ -7364,12 +7894,12 @@ function registerQualityTools(server) {
     "quality_check",
     "Score post quality across 7 categories: Hook Strength, Message Clarity, Platform Fit, Brand Alignment, Novelty, CTA Strength, and Safety/Claims. Each scored 0-5, total 35. Default pass threshold is 26 (~75%). Run after generate_content and before schedule_post. Include hashtags in caption if they will be published \u2014 they affect Platform Fit and Safety scores.",
     {
-      caption: z18.string().describe(
+      caption: z19.string().describe(
         "The post text to score. Include hashtags if they will be published \u2014 they affect Platform Fit and Safety/Claims scores."
       ),
-      title: z18.string().optional().describe("Post title (important for YouTube)"),
-      platforms: z18.array(
-        z18.enum([
+      title: z19.string().optional().describe("Post title (important for YouTube)"),
+      platforms: z19.array(
+        z19.enum([
           "youtube",
           "tiktok",
           "instagram",
@@ -7380,13 +7910,13 @@ function registerQualityTools(server) {
           "bluesky"
         ])
       ).min(1).describe("Target platforms"),
-      threshold: z18.number().min(0).max(35).default(26).describe(
+      threshold: z19.number().min(0).max(35).default(26).describe(
         "Minimum total score to pass (max 35, scored across 7 categories at 0-5 each). Default 26 (~75%). Use 20 for rough drafts, 28+ for final posts going to large audiences."
       ),
-      brand_keyword: z18.string().optional().describe("Brand keyword for alignment check"),
-      brand_avoid_patterns: z18.array(z18.string()).optional(),
-      custom_banned_terms: z18.array(z18.string()).optional(),
-      response_format: z18.enum(["text", "json"]).default("text")
+      brand_keyword: z19.string().optional().describe("Brand keyword for alignment check"),
+      brand_avoid_patterns: z19.array(z19.string()).optional(),
+      custom_banned_terms: z19.array(z19.string()).optional(),
+      response_format: z19.enum(["text", "json"]).default("text")
     },
     async ({
       caption,
@@ -7417,7 +7947,7 @@ function registerQualityTools(server) {
       });
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope14(result), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope15(result), null, 2) }],
           isError: false
         };
       }
@@ -7445,20 +7975,20 @@ function registerQualityTools(server) {
     "quality_check_plan",
     "Batch quality check all posts in a content plan. Returns per-post scores and aggregate pass/fail summary. Use after plan_content_week and before schedule_content_plan to catch low-quality posts before publishing.",
     {
-      plan: z18.object({
-        posts: z18.array(
-          z18.object({
-            id: z18.string(),
-            caption: z18.string(),
-            title: z18.string().optional(),
-            platform: z18.string()
+      plan: z19.object({
+        posts: z19.array(
+          z19.object({
+            id: z19.string(),
+            caption: z19.string(),
+            title: z19.string().optional(),
+            platform: z19.string()
           })
         )
       }).passthrough().describe("Content plan with posts array"),
-      threshold: z18.number().min(0).max(35).default(26).describe(
+      threshold: z19.number().min(0).max(35).default(26).describe(
         "Minimum total score to pass (max 35, scored across 7 categories at 0-5 each). Default 26 (~75%). Use 20 for rough drafts, 28+ for final posts going to large audiences."
       ),
-      response_format: z18.enum(["text", "json"]).default("text")
+      response_format: z19.enum(["text", "json"]).default("text")
     },
     async ({ plan, threshold, response_format }) => {
       const startedAt = Date.now();
@@ -7500,7 +8030,7 @@ function registerQualityTools(server) {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope14({ posts: postsWithQuality, summary }), null, 2)
+              text: JSON.stringify(asEnvelope15({ posts: postsWithQuality, summary }), null, 2)
             }
           ],
           isError: false
@@ -7524,7 +8054,7 @@ function registerQualityTools(server) {
 }
 
 // src/tools/planning.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 import { randomUUID as randomUUID2 } from "node:crypto";
 init_supabase();
 
@@ -7552,7 +8082,7 @@ function extractJsonArray(text) {
 function toRecord(value) {
   return value && typeof value === "object" ? value : void 0;
 }
-function asEnvelope15(data) {
+function asEnvelope16(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
 function tomorrowIsoDate() {
@@ -7622,10 +8152,10 @@ function registerPlanningTools(server) {
     "plan_content_week",
     "Generate a full content plan with platform-specific drafts, hooks, angles, and optimal schedule times. Pass a topic or source_url \u2014 brand context and performance insights auto-load via project_id. Output feeds directly into quality_check_plan then schedule_content_plan. Costs ~5-15 credits depending on post count.",
     {
-      topic: z19.string().describe("Main topic or content theme"),
-      source_url: z19.string().optional().describe("URL to extract content from (YouTube, article)"),
-      platforms: z19.array(
-        z19.enum([
+      topic: z20.string().describe("Main topic or content theme"),
+      source_url: z20.string().optional().describe("URL to extract content from (YouTube, article)"),
+      platforms: z20.array(
+        z20.enum([
           "youtube",
           "tiktok",
           "instagram",
@@ -7636,12 +8166,12 @@ function registerPlanningTools(server) {
           "bluesky"
         ])
       ).min(1).describe("Target platforms"),
-      posts_per_day: z19.number().min(1).max(5).default(1).describe("Posts per platform per day"),
-      days: z19.number().min(1).max(7).default(5).describe("Number of days to plan"),
-      start_date: z19.string().optional().describe("ISO date, defaults to tomorrow"),
-      brand_voice: z19.string().optional().describe("Override brand voice description"),
-      project_id: z19.string().optional().describe("Project ID for brand/insights context"),
-      response_format: z19.enum(["text", "json"]).default("json")
+      posts_per_day: z20.number().min(1).max(5).default(1).describe("Posts per platform per day"),
+      days: z20.number().min(1).max(7).default(5).describe("Number of days to plan"),
+      start_date: z20.string().optional().describe("ISO date, defaults to tomorrow"),
+      brand_voice: z20.string().optional().describe("Override brand voice description"),
+      project_id: z20.string().optional().describe("Project ID for brand/insights context"),
+      response_format: z20.enum(["text", "json"]).default("json")
     },
     async ({
       topic,
@@ -7893,7 +8423,7 @@ ${rawText.slice(0, 1e3)}`
             }
           } catch (persistErr) {
             const durationMs2 = Date.now() - startedAt;
-            const message = sanitizeError2(persistErr);
+            const message = sanitizeError(persistErr);
             logMcpToolInvocation({
               toolName: "plan_content_week",
               status: "error",
@@ -7915,7 +8445,7 @@ ${rawText.slice(0, 1e3)}`
         });
         if (response_format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope15(plan), null, 2) }],
+            content: [{ type: "text", text: JSON.stringify(asEnvelope16(plan), null, 2) }],
             isError: false
           };
         }
@@ -7925,7 +8455,7 @@ ${rawText.slice(0, 1e3)}`
         };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "plan_content_week",
           status: "error",
@@ -7943,13 +8473,13 @@ ${rawText.slice(0, 1e3)}`
     "save_content_plan",
     "Save a content plan to the database for team review, approval workflows, and scheduled publishing. Creates a plan_id you can reference in get_content_plan, update_content_plan, and schedule_content_plan.",
     {
-      plan: z19.object({
-        topic: z19.string(),
-        posts: z19.array(z19.record(z19.string(), z19.unknown()))
+      plan: z20.object({
+        topic: z20.string(),
+        posts: z20.array(z20.record(z20.string(), z20.unknown()))
       }).passthrough(),
-      project_id: z19.string().uuid().optional(),
-      status: z19.enum(["draft", "in_review", "approved", "scheduled", "completed"]).default("draft"),
-      response_format: z19.enum(["text", "json"]).default("json")
+      project_id: z20.string().uuid().optional(),
+      status: z20.enum(["draft", "in_review", "approved", "scheduled", "completed"]).default("draft"),
+      response_format: z20.enum(["text", "json"]).default("json")
     },
     async ({ plan, project_id, status, response_format }) => {
       const startedAt = Date.now();
@@ -8005,7 +8535,7 @@ ${rawText.slice(0, 1e3)}`
         };
         if (response_format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope15(result), null, 2) }],
+            content: [{ type: "text", text: JSON.stringify(asEnvelope16(result), null, 2) }],
             isError: false
           };
         }
@@ -8017,7 +8547,7 @@ ${rawText.slice(0, 1e3)}`
         };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "save_content_plan",
           status: "error",
@@ -8035,8 +8565,8 @@ ${rawText.slice(0, 1e3)}`
     "get_content_plan",
     "Retrieve a persisted content plan by ID.",
     {
-      plan_id: z19.string().uuid().describe("Persisted content plan ID"),
-      response_format: z19.enum(["text", "json"]).default("json")
+      plan_id: z20.string().uuid().describe("Persisted content plan ID"),
+      response_format: z20.enum(["text", "json"]).default("json")
     },
     async ({ plan_id, response_format }) => {
       const { data: result, error } = await callEdgeFunction("mcp-data", { action: "get-content-plan", plan_id }, { timeoutMs: 1e4 });
@@ -8071,7 +8601,7 @@ ${rawText.slice(0, 1e3)}`
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope15(payload), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope16(payload), null, 2) }],
           isError: false
         };
       }
@@ -8089,23 +8619,23 @@ ${rawText.slice(0, 1e3)}`
     "update_content_plan",
     "Update individual posts in a persisted content plan.",
     {
-      plan_id: z19.string().uuid(),
-      post_updates: z19.array(
-        z19.object({
-          post_id: z19.string(),
-          caption: z19.string().optional(),
-          title: z19.string().optional(),
-          hashtags: z19.array(z19.string()).optional(),
-          hook: z19.string().optional(),
-          angle: z19.string().optional(),
-          visual_direction: z19.string().optional(),
-          media_url: z19.string().optional(),
-          schedule_at: z19.string().optional(),
-          platform: z19.string().optional(),
-          status: z19.enum(["approved", "rejected", "needs_edit"]).optional()
+      plan_id: z20.string().uuid(),
+      post_updates: z20.array(
+        z20.object({
+          post_id: z20.string(),
+          caption: z20.string().optional(),
+          title: z20.string().optional(),
+          hashtags: z20.array(z20.string()).optional(),
+          hook: z20.string().optional(),
+          angle: z20.string().optional(),
+          visual_direction: z20.string().optional(),
+          media_url: z20.string().optional(),
+          schedule_at: z20.string().optional(),
+          platform: z20.string().optional(),
+          status: z20.enum(["approved", "rejected", "needs_edit"]).optional()
         })
       ).min(1),
-      response_format: z19.enum(["text", "json"]).default("json")
+      response_format: z20.enum(["text", "json"]).default("json")
     },
     async ({ plan_id, post_updates, response_format }) => {
       const { data: result, error } = await callEdgeFunction(
@@ -8143,7 +8673,7 @@ ${rawText.slice(0, 1e3)}`
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope15(payload), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope16(payload), null, 2) }],
           isError: false
         };
       }
@@ -8162,8 +8692,8 @@ ${rawText.slice(0, 1e3)}`
     "submit_content_plan_for_approval",
     "Create pending approval items for each post in a plan and mark plan status as in_review.",
     {
-      plan_id: z19.string().uuid(),
-      response_format: z19.enum(["text", "json"]).default("json")
+      plan_id: z20.string().uuid(),
+      response_format: z20.enum(["text", "json"]).default("json")
     },
     async ({ plan_id, response_format }) => {
       const { data: result, error } = await callEdgeFunction("mcp-data", { action: "submit-plan-approval", plan_id }, { timeoutMs: 15e3 });
@@ -8196,7 +8726,7 @@ ${rawText.slice(0, 1e3)}`
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope15(payload), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope16(payload), null, 2) }],
           isError: false
         };
       }
@@ -8214,9 +8744,9 @@ ${rawText.slice(0, 1e3)}`
 }
 
 // src/tools/plan-approvals.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 init_supabase();
-function asEnvelope16(data) {
+function asEnvelope17(data) {
   return {
     _meta: {
       version: MCP_VERSION,
@@ -8230,19 +8760,19 @@ function registerPlanApprovalTools(server) {
     "create_plan_approvals",
     "Create pending approval rows for each post in a content plan.",
     {
-      plan_id: z20.string().uuid().describe("Content plan ID"),
-      posts: z20.array(
-        z20.object({
-          id: z20.string(),
-          platform: z20.string().optional(),
-          caption: z20.string().optional(),
-          title: z20.string().optional(),
-          media_url: z20.string().optional(),
-          schedule_at: z20.string().optional()
+      plan_id: z21.string().uuid().describe("Content plan ID"),
+      posts: z21.array(
+        z21.object({
+          id: z21.string(),
+          platform: z21.string().optional(),
+          caption: z21.string().optional(),
+          title: z21.string().optional(),
+          media_url: z21.string().optional(),
+          schedule_at: z21.string().optional()
         }).passthrough()
       ).min(1).describe("Posts to create approval entries for."),
-      project_id: z20.string().uuid().optional().describe("Project ID. Defaults to active project context."),
-      response_format: z20.enum(["text", "json"]).optional()
+      project_id: z21.string().uuid().optional().describe("Project ID. Defaults to active project context."),
+      response_format: z21.enum(["text", "json"]).optional()
     },
     async ({ plan_id, posts, project_id, response_format }) => {
       const projectId = project_id || await getDefaultProjectId();
@@ -8291,7 +8821,7 @@ function registerPlanApprovalTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope16(payload), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope17(payload), null, 2) }],
           isError: false
         };
       }
@@ -8310,9 +8840,9 @@ function registerPlanApprovalTools(server) {
     "list_plan_approvals",
     "List MCP-native approval items for a specific content plan.",
     {
-      plan_id: z20.string().uuid().describe("Content plan ID"),
-      status: z20.enum(["pending", "approved", "rejected", "edited"]).optional(),
-      response_format: z20.enum(["text", "json"]).optional()
+      plan_id: z21.string().uuid().describe("Content plan ID"),
+      status: z21.enum(["pending", "approved", "rejected", "edited"]).optional(),
+      response_format: z21.enum(["text", "json"]).optional()
     },
     async ({ plan_id, status, response_format }) => {
       const { data: result, error } = await callEdgeFunction(
@@ -8343,7 +8873,7 @@ function registerPlanApprovalTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope16(payload), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope17(payload), null, 2) }],
           isError: false
         };
       }
@@ -8370,11 +8900,11 @@ function registerPlanApprovalTools(server) {
     "respond_plan_approval",
     "Approve, reject, or edit a pending plan approval item.",
     {
-      approval_id: z20.string().uuid().describe("Approval item ID"),
-      decision: z20.enum(["approved", "rejected", "edited"]),
-      edited_post: z20.record(z20.string(), z20.unknown()).optional(),
-      reason: z20.string().max(1e3).optional(),
-      response_format: z20.enum(["text", "json"]).optional()
+      approval_id: z21.string().uuid().describe("Approval item ID"),
+      decision: z21.enum(["approved", "rejected", "edited"]),
+      edited_post: z21.record(z21.string(), z21.unknown()).optional(),
+      reason: z21.string().max(1e3).optional(),
+      response_format: z21.enum(["text", "json"]).optional()
     },
     async ({ approval_id, decision, edited_post, reason, response_format }) => {
       if (decision === "edited" && !edited_post) {
@@ -8421,7 +8951,7 @@ function registerPlanApprovalTools(server) {
       }
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope16(data), null, 2) }],
+          content: [{ type: "text", text: JSON.stringify(asEnvelope17(data), null, 2) }],
           isError: false
         };
       }
@@ -8439,7 +8969,7 @@ function registerPlanApprovalTools(server) {
 }
 
 // src/tools/discovery.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 
 // src/lib/tool-catalog.ts
 var TOOL_CATALOG = [
@@ -8506,6 +9036,12 @@ var TOOL_CATALOG = [
     module: "content",
     scope: "mcp:write"
   },
+  {
+    name: "create_carousel",
+    description: "End-to-end carousel: generate text + kick off image jobs for each slide",
+    module: "carousel",
+    scope: "mcp:write"
+  },
   // media
   {
     name: "upload_media",
@@ -8863,20 +9399,59 @@ var TOOL_CATALOG = [
     description: "Create a new autopilot configuration",
     module: "autopilot",
     scope: "mcp:autopilot"
-  }
-];
-function getToolsByModule(module) {
-  return TOOL_CATALOG.filter((t) => t.module === module);
-}
-function getToolsByScope(scope) {
-  return TOOL_CATALOG.filter((t) => t.scope === scope);
-}
-function searchTools(query) {
-  const q = query.toLowerCase();
-  return TOOL_CATALOG.filter(
-    (t) => t.name.toLowerCase().includes(q) || t.description.toLowerCase().includes(q)
-  );
-}
+  },
+  // brand runtime (additions)
+  {
+    name: "audit_brand_colors",
+    description: "Audit brand color palette for accessibility, contrast, and harmony",
+    module: "brandRuntime",
+    scope: "mcp:read"
+  },
+  {
+    name: "export_design_tokens",
+    description: "Export brand design tokens in CSS/Tailwind/JSON formats",
+    module: "brandRuntime",
+    scope: "mcp:read"
+  },
+  // carousel (already listed in content section above)
+  // recipes
+  {
+    name: "list_recipes",
+    description: "List available recipe templates for automated content workflows",
+    module: "recipes",
+    scope: "mcp:read"
+  },
+  {
+    name: "get_recipe_details",
+    description: "Get full details of a recipe template including steps and required inputs",
+    module: "recipes",
+    scope: "mcp:read"
+  },
+  {
+    name: "execute_recipe",
+    description: "Execute a recipe template with provided inputs to run a multi-step workflow",
+    module: "recipes",
+    scope: "mcp:write"
+  },
+  {
+    name: "get_recipe_run_status",
+    description: "Check the status and progress of a running recipe execution",
+    module: "recipes",
+    scope: "mcp:read"
+  }
+];
+function getToolsByModule(module) {
+  return TOOL_CATALOG.filter((t) => t.module === module);
+}
+function getToolsByScope(scope) {
+  return TOOL_CATALOG.filter((t) => t.scope === scope);
+}
+function searchTools(query) {
+  const q = query.toLowerCase();
+  return TOOL_CATALOG.filter(
+    (t) => t.name.toLowerCase().includes(q) || t.description.toLowerCase().includes(q)
+  );
+}
 
 // src/tools/discovery.ts
 function registerDiscoveryTools(server) {
@@ -8884,10 +9459,10 @@ function registerDiscoveryTools(server) {
     "search_tools",
     'Search available tools by name, description, module, or scope. Use "name" detail (~50 tokens) for quick lookup, "summary" (~500 tokens) for descriptions, "full" for complete input schemas. Start here if unsure which tool to call \u2014 filter by module (e.g. "planning", "content", "analytics") to narrow results.',
     {
-      query: z21.string().optional().describe("Search query to filter tools by name or description"),
-      module: z21.string().optional().describe('Filter by module name (e.g. "planning", "content", "analytics")'),
-      scope: z21.string().optional().describe('Filter by required scope (e.g. "mcp:read", "mcp:write")'),
-      detail: z21.enum(["name", "summary", "full"]).default("summary").describe(
+      query: z22.string().optional().describe("Search query to filter tools by name or description"),
+      module: z22.string().optional().describe('Filter by module name (e.g. "planning", "content", "analytics")'),
+      scope: z22.string().optional().describe('Filter by required scope (e.g. "mcp:read", "mcp:write")'),
+      detail: z22.enum(["name", "summary", "full"]).default("summary").describe(
         'Detail level: "name" for just tool names, "summary" for names + descriptions, "full" for complete info including scope and module'
       )
     },
@@ -8930,13 +9505,13 @@ function registerDiscoveryTools(server) {
 }
 
 // src/tools/pipeline.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 import { randomUUID as randomUUID3 } from "node:crypto";
 init_supabase();
-function asEnvelope17(data) {
+function asEnvelope18(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
-var PLATFORM_ENUM2 = z22.enum([
+var PLATFORM_ENUM2 = z23.enum([
   "youtube",
   "tiktok",
   "instagram",
@@ -8953,10 +9528,10 @@ function registerPipelineTools(server) {
     "check_pipeline_readiness",
     "Pre-flight check before run_content_pipeline. Verifies: sufficient credits for estimated_posts, active OAuth on target platforms, brand profile exists, no stale insights. Returns pass/fail with specific issues to fix before running the pipeline.",
     {
-      project_id: z22.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
-      platforms: z22.array(PLATFORM_ENUM2).min(1).describe("Target platforms to check"),
-      estimated_posts: z22.number().min(1).max(50).default(5).describe("Estimated posts to generate"),
-      response_format: z22.enum(["text", "json"]).optional().describe("Response format")
+      project_id: z23.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
+      platforms: z23.array(PLATFORM_ENUM2).min(1).describe("Target platforms to check"),
+      estimated_posts: z23.number().min(1).max(50).default(5).describe("Estimated posts to generate"),
+      response_format: z23.enum(["text", "json"]).optional().describe("Response format")
     },
     async ({ project_id, platforms, estimated_posts, response_format }) => {
       const format = response_format ?? "text";
@@ -9032,7 +9607,7 @@ function registerPipelineTools(server) {
         });
         if (format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope17(result), null, 2) }]
+            content: [{ type: "text", text: JSON.stringify(asEnvelope18(result), null, 2) }]
           };
         }
         const lines = [];
@@ -9062,7 +9637,7 @@ function registerPipelineTools(server) {
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "check_pipeline_readiness",
           status: "error",
@@ -9080,22 +9655,22 @@ function registerPipelineTools(server) {
     "run_content_pipeline",
     "Run the full content pipeline: research trends \u2192 generate plan \u2192 quality check \u2192 auto-approve \u2192 schedule posts. Chains all stages in one call for maximum efficiency. Set dry_run=true to preview the plan without publishing. Check check_pipeline_readiness first to verify credits, OAuth, and brand profile are ready.",
     {
-      project_id: z22.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
-      topic: z22.string().optional().describe("Content topic (required if no source_url)"),
-      source_url: z22.string().optional().describe("URL to extract content from"),
-      platforms: z22.array(PLATFORM_ENUM2).min(1).describe("Target platforms"),
-      days: z22.number().min(1).max(7).default(5).describe("Days to plan"),
-      posts_per_day: z22.number().min(1).max(3).default(1).describe("Posts per platform per day"),
-      approval_mode: z22.enum(["auto", "review_all", "review_low_confidence"]).default("review_low_confidence").describe(
+      project_id: z23.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
+      topic: z23.string().optional().describe("Content topic (required if no source_url)"),
+      source_url: z23.string().optional().describe("URL to extract content from"),
+      platforms: z23.array(PLATFORM_ENUM2).min(1).describe("Target platforms"),
+      days: z23.number().min(1).max(7).default(5).describe("Days to plan"),
+      posts_per_day: z23.number().min(1).max(3).default(1).describe("Posts per platform per day"),
+      approval_mode: z23.enum(["auto", "review_all", "review_low_confidence"]).default("review_low_confidence").describe(
         "auto: approve all passing quality. review_all: flag everything. review_low_confidence: auto-approve high scorers."
       ),
-      auto_approve_threshold: z22.number().min(0).max(35).default(28).describe(
+      auto_approve_threshold: z23.number().min(0).max(35).default(28).describe(
         "Quality score threshold for auto-approval (used in auto/review_low_confidence modes)"
       ),
-      max_credits: z22.number().optional().describe("Credit budget cap"),
-      dry_run: z22.boolean().default(false).describe("If true, skip scheduling and return plan only"),
-      skip_stages: z22.array(z22.enum(["research", "quality", "schedule"])).optional().describe("Stages to skip"),
-      response_format: z22.enum(["text", "json"]).default("json")
+      max_credits: z23.number().optional().describe("Credit budget cap"),
+      dry_run: z23.boolean().default(false).describe("If true, skip scheduling and return plan only"),
+      skip_stages: z23.array(z23.enum(["research", "quality", "schedule"])).optional().describe("Stages to skip"),
+      response_format: z23.enum(["text", "json"]).default("json")
     },
     async ({
       project_id,
@@ -9223,7 +9798,7 @@ function registerPipelineTools(server) {
           } catch (deductErr) {
             errors.push({
               stage: "planning",
-              message: `Credit deduction failed: ${sanitizeError2(deductErr)}`
+              message: `Credit deduction failed: ${sanitizeError(deductErr)}`
             });
           }
         }
@@ -9394,7 +9969,7 @@ function registerPipelineTools(server) {
             } catch (schedErr) {
               errors.push({
                 stage: "schedule",
-                message: `Failed to schedule ${post.id}: ${sanitizeError2(schedErr)}`
+                message: `Failed to schedule ${post.id}: ${sanitizeError(schedErr)}`
               });
             }
           }
@@ -9457,7 +10032,7 @@ function registerPipelineTools(server) {
         if (response_format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope17(resultPayload), null, 2) }
+              { type: "text", text: JSON.stringify(asEnvelope18(resultPayload), null, 2) }
             ]
           };
         }
@@ -9483,7 +10058,7 @@ function registerPipelineTools(server) {
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "run_content_pipeline",
           status: "error",
@@ -9518,8 +10093,8 @@ function registerPipelineTools(server) {
     "get_pipeline_status",
     "Check status of a pipeline run, including stages completed, pending approvals, and scheduled posts.",
     {
-      pipeline_id: z22.string().uuid().optional().describe("Pipeline run ID (omit for latest)"),
-      response_format: z22.enum(["text", "json"]).optional()
+      pipeline_id: z23.string().uuid().optional().describe("Pipeline run ID (omit for latest)"),
+      response_format: z23.enum(["text", "json"]).optional()
     },
     async ({ pipeline_id, response_format }) => {
       const format = response_format ?? "text";
@@ -9545,7 +10120,7 @@ function registerPipelineTools(server) {
       }
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope17(data), null, 2) }]
+          content: [{ type: "text", text: JSON.stringify(asEnvelope18(data), null, 2) }]
         };
       }
       const lines = [];
@@ -9579,9 +10154,9 @@ function registerPipelineTools(server) {
     "auto_approve_plan",
     "Batch auto-approve posts in a content plan that meet quality thresholds. Posts below the threshold are flagged for manual review.",
     {
-      plan_id: z22.string().uuid().describe("Content plan ID"),
-      quality_threshold: z22.number().min(0).max(35).default(26).describe("Minimum quality score to auto-approve"),
-      response_format: z22.enum(["text", "json"]).default("json")
+      plan_id: z23.string().uuid().describe("Content plan ID"),
+      quality_threshold: z23.number().min(0).max(35).default(26).describe("Minimum quality score to auto-approve"),
+      response_format: z23.enum(["text", "json"]).default("json")
     },
     async ({ plan_id, quality_threshold, response_format }) => {
       const startedAt = Date.now();
@@ -9687,7 +10262,7 @@ function registerPipelineTools(server) {
         if (response_format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope17(resultPayload), null, 2) }
+              { type: "text", text: JSON.stringify(asEnvelope18(resultPayload), null, 2) }
             ]
           };
         }
@@ -9707,7 +10282,7 @@ function registerPipelineTools(server) {
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "auto_approve_plan",
           status: "error",
@@ -9741,9 +10316,9 @@ function buildPlanPrompt(topic, platforms, days, postsPerDay, sourceUrl) {
 }
 
 // src/tools/suggest.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 init_supabase();
-function asEnvelope18(data) {
+function asEnvelope19(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
 function registerSuggestTools(server) {
@@ -9751,9 +10326,9 @@ function registerSuggestTools(server) {
     "suggest_next_content",
     "Suggest next content topics based on performance insights, past content, and competitor patterns. No AI call, no credit cost \u2014 purely data-driven recommendations.",
     {
-      project_id: z23.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
-      count: z23.number().min(1).max(10).default(3).describe("Number of suggestions to return"),
-      response_format: z23.enum(["text", "json"]).optional()
+      project_id: z24.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
+      count: z24.number().min(1).max(10).default(3).describe("Number of suggestions to return"),
+      response_format: z24.enum(["text", "json"]).optional()
     },
     async ({ project_id, count, response_format }) => {
       const format = response_format ?? "text";
@@ -9863,7 +10438,7 @@ function registerSuggestTools(server) {
         if (format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope18(resultPayload), null, 2) }
+              { type: "text", text: JSON.stringify(asEnvelope19(resultPayload), null, 2) }
             ]
           };
         }
@@ -9885,7 +10460,7 @@ ${i + 1}. ${s.topic}`);
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "suggest_next_content",
           status: "error",
@@ -9902,7 +10477,7 @@ ${i + 1}. ${s.topic}`);
 }
 
 // src/tools/digest.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 init_supabase();
 
 // src/lib/anomaly-detector.ts
@@ -10006,10 +10581,10 @@ function detectAnomalies(currentData, previousData, sensitivity = "medium", aver
 }
 
 // src/tools/digest.ts
-function asEnvelope19(data) {
+function asEnvelope20(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
 }
-var PLATFORM_ENUM3 = z24.enum([
+var PLATFORM_ENUM3 = z25.enum([
   "youtube",
   "tiktok",
   "instagram",
@@ -10024,10 +10599,10 @@ function registerDigestTools(server) {
     "generate_performance_digest",
     "Generate a performance summary for a time period. Includes metrics, trends vs previous period, top/bottom performers, platform breakdown, and actionable recommendations. No AI call, no credit cost.",
     {
-      project_id: z24.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
-      period: z24.enum(["7d", "14d", "30d"]).default("7d").describe("Time period to analyze"),
-      include_recommendations: z24.boolean().default(true),
-      response_format: z24.enum(["text", "json"]).optional()
+      project_id: z25.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
+      period: z25.enum(["7d", "14d", "30d"]).default("7d").describe("Time period to analyze"),
+      include_recommendations: z25.boolean().default(true),
+      response_format: z25.enum(["text", "json"]).optional()
     },
     async ({ project_id, period, include_recommendations, response_format }) => {
       const format = response_format ?? "text";
@@ -10183,7 +10758,7 @@ function registerDigestTools(server) {
         });
         if (format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope19(digest), null, 2) }]
+            content: [{ type: "text", text: JSON.stringify(asEnvelope20(digest), null, 2) }]
           };
         }
         const lines = [];
@@ -10224,7 +10799,7 @@ Best: ${best.id.slice(0, 8)}... (${best.platform}) \u2014 ${best.views.toLocaleS
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "generate_performance_digest",
           status: "error",
@@ -10242,11 +10817,11 @@ Best: ${best.id.slice(0, 8)}... (${best.platform}) \u2014 ${best.views.toLocaleS
     "detect_anomalies",
     "Detect significant performance changes: spikes, drops, viral content, trend shifts. Compares current period against previous equal-length period. No AI call, no credit cost.",
     {
-      project_id: z24.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
-      days: z24.number().min(7).max(90).default(14).describe("Days to analyze"),
-      sensitivity: z24.enum(["low", "medium", "high"]).default("medium").describe("Detection sensitivity: low=50%+, medium=30%+, high=15%+ changes"),
-      platforms: z24.array(PLATFORM_ENUM3).optional().describe("Filter to specific platforms"),
-      response_format: z24.enum(["text", "json"]).optional()
+      project_id: z25.string().uuid().optional().describe("Project ID (auto-detected if omitted)"),
+      days: z25.number().min(7).max(90).default(14).describe("Days to analyze"),
+      sensitivity: z25.enum(["low", "medium", "high"]).default("medium").describe("Detection sensitivity: low=50%+, medium=30%+, high=15%+ changes"),
+      platforms: z25.array(PLATFORM_ENUM3).optional().describe("Filter to specific platforms"),
+      response_format: z25.enum(["text", "json"]).optional()
     },
     async ({ project_id, days, sensitivity, platforms, response_format }) => {
       const format = response_format ?? "text";
@@ -10297,7 +10872,7 @@ Best: ${best.id.slice(0, 8)}... (${best.platform}) \u2014 ${best.views.toLocaleS
         if (format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope19(resultPayload), null, 2) }
+              { type: "text", text: JSON.stringify(asEnvelope20(resultPayload), null, 2) }
             ]
           };
         }
@@ -10321,7 +10896,7 @@ Best: ${best.id.slice(0, 8)}... (${best.platform}) \u2014 ${best.views.toLocaleS
         return { content: [{ type: "text", text: lines.join("\n") }] };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
-        const message = sanitizeError2(err);
+        const message = sanitizeError(err);
         logMcpToolInvocation({
           toolName: "detect_anomalies",
           status: "error",
@@ -10338,7 +10913,7 @@ Best: ${best.id.slice(0, 8)}... (${best.platform}) \u2014 ${best.views.toLocaleS
 }
 
 // src/tools/brandRuntime.ts
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 init_supabase();
 
 // src/lib/brandScoring.ts
@@ -10608,8 +11183,181 @@ function computeBrandConsistency(content, profile, threshold = 60) {
   };
 }
 
+// src/lib/colorAudit.ts
+function hexToRgb(hex) {
+  const h = hex.replace("#", "");
+  const full = h.length === 3 ? h[0] + h[0] + h[1] + h[1] + h[2] + h[2] : h;
+  const n = parseInt(full, 16);
+  return [n >> 16 & 255, n >> 8 & 255, n & 255];
+}
+function srgbToLinear(c) {
+  const s = c / 255;
+  return s <= 0.04045 ? s / 12.92 : Math.pow((s + 0.055) / 1.055, 2.4);
+}
+function hexToLab(hex) {
+  const [r, g, b] = hexToRgb(hex);
+  const lr = srgbToLinear(r);
+  const lg = srgbToLinear(g);
+  const lb = srgbToLinear(b);
+  const x = lr * 0.4124564 + lg * 0.3575761 + lb * 0.1804375;
+  const y = lr * 0.2126729 + lg * 0.7151522 + lb * 0.072175;
+  const z29 = lr * 0.0193339 + lg * 0.119192 + lb * 0.9503041;
+  const f = (t) => t > 8856e-6 ? Math.cbrt(t) : 7.787 * t + 16 / 116;
+  const fx = f(x / 0.95047);
+  const fy = f(y / 1);
+  const fz = f(z29 / 1.08883);
+  return { L: 116 * fy - 16, a: 500 * (fx - fy), b: 200 * (fy - fz) };
+}
+function deltaE2000(lab1, lab2) {
+  const { L: L1, a: a1, b: b1 } = lab1;
+  const { L: L2, a: a2, b: b2 } = lab2;
+  const C1 = Math.sqrt(a1 * a1 + b1 * b1);
+  const C2 = Math.sqrt(a2 * a2 + b2 * b2);
+  const Cab = (C1 + C2) / 2;
+  const Cab7 = Math.pow(Cab, 7);
+  const G = 0.5 * (1 - Math.sqrt(Cab7 / (Cab7 + Math.pow(25, 7))));
+  const a1p = a1 * (1 + G);
+  const a2p = a2 * (1 + G);
+  const C1p = Math.sqrt(a1p * a1p + b1 * b1);
+  const C2p = Math.sqrt(a2p * a2p + b2 * b2);
+  let h1p = Math.atan2(b1, a1p) * (180 / Math.PI);
+  if (h1p < 0) h1p += 360;
+  let h2p = Math.atan2(b2, a2p) * (180 / Math.PI);
+  if (h2p < 0) h2p += 360;
+  const dLp = L2 - L1;
+  const dCp = C2p - C1p;
+  let dhp;
+  if (C1p * C2p === 0) dhp = 0;
+  else if (Math.abs(h2p - h1p) <= 180) dhp = h2p - h1p;
+  else if (h2p - h1p > 180) dhp = h2p - h1p - 360;
+  else dhp = h2p - h1p + 360;
+  const dHp = 2 * Math.sqrt(C1p * C2p) * Math.sin(dhp * Math.PI / 360);
+  const Lp = (L1 + L2) / 2;
+  const Cp = (C1p + C2p) / 2;
+  let hp;
+  if (C1p * C2p === 0) hp = h1p + h2p;
+  else if (Math.abs(h1p - h2p) <= 180) hp = (h1p + h2p) / 2;
+  else if (h1p + h2p < 360) hp = (h1p + h2p + 360) / 2;
+  else hp = (h1p + h2p - 360) / 2;
+  const T = 1 - 0.17 * Math.cos((hp - 30) * Math.PI / 180) + 0.24 * Math.cos(2 * hp * Math.PI / 180) + 0.32 * Math.cos((3 * hp + 6) * Math.PI / 180) - 0.2 * Math.cos((4 * hp - 63) * Math.PI / 180);
+  const SL = 1 + 0.015 * (Lp - 50) * (Lp - 50) / Math.sqrt(20 + (Lp - 50) * (Lp - 50));
+  const SC = 1 + 0.045 * Cp;
+  const SH = 1 + 0.015 * Cp * T;
+  const Cp7 = Math.pow(Cp, 7);
+  const RT = -2 * Math.sqrt(Cp7 / (Cp7 + Math.pow(25, 7))) * Math.sin(60 * Math.exp(-Math.pow((hp - 275) / 25, 2)) * Math.PI / 180);
+  return Math.sqrt(
+    Math.pow(dLp / SL, 2) + Math.pow(dCp / SC, 2) + Math.pow(dHp / SH, 2) + RT * (dCp / SC) * (dHp / SH)
+  );
+}
+var COLOR_SLOTS = [
+  "primary",
+  "secondary",
+  "accent",
+  "background",
+  "success",
+  "warning",
+  "error",
+  "text",
+  "textSecondary"
+];
+function auditBrandColors(palette, contentColors, threshold = 10) {
+  if (!contentColors.length) return { entries: [], overallScore: 100, passed: true };
+  const brandColors = [];
+  for (const slot of COLOR_SLOTS) {
+    const hex = palette[slot];
+    if (typeof hex === "string" && hex.startsWith("#")) {
+      brandColors.push({ slot, hex, lab: hexToLab(hex) });
+    }
+  }
+  if (!brandColors.length) return { entries: [], overallScore: 50, passed: false };
+  const entries = contentColors.map((color) => {
+    const colorLab = hexToLab(color);
+    let minDE = Infinity;
+    let closest = brandColors[0];
+    for (const bc of brandColors) {
+      const de = deltaE2000(colorLab, bc.lab);
+      if (de < minDE) {
+        minDE = de;
+        closest = bc;
+      }
+    }
+    return {
+      color,
+      closestBrandColor: closest.hex,
+      closestBrandSlot: closest.slot,
+      deltaE: Math.round(minDE * 100) / 100,
+      passed: minDE <= threshold
+    };
+  });
+  const passedCount = entries.filter((e) => e.passed).length;
+  const overallScore = Math.round(passedCount / entries.length * 100);
+  return { entries, overallScore, passed: overallScore >= 80 };
+}
+function exportDesignTokens(palette, typography, format) {
+  if (format === "css") return exportCSS(palette, typography);
+  if (format === "tailwind") return JSON.stringify(exportTailwind(palette), null, 2);
+  return JSON.stringify(exportFigma(palette, typography), null, 2);
+}
+function exportCSS(palette, typography) {
+  const lines = [":root {"];
+  const slots = [
+    ["--brand-primary", "primary"],
+    ["--brand-secondary", "secondary"],
+    ["--brand-accent", "accent"],
+    ["--brand-background", "background"],
+    ["--brand-success", "success"],
+    ["--brand-warning", "warning"],
+    ["--brand-error", "error"],
+    ["--brand-text", "text"],
+    ["--brand-text-secondary", "textSecondary"]
+  ];
+  for (const [varName, key] of slots) {
+    const v = palette[key];
+    if (typeof v === "string" && v) lines.push(`  ${varName}: ${v};`);
+  }
+  if (typography) {
+    const hf = typography.headingFont;
+    const bf = typography.bodyFont;
+    if (hf) lines.push(`  --brand-font-heading: ${hf};`);
+    if (bf) lines.push(`  --brand-font-body: ${bf};`);
+  }
+  lines.push("}");
+  return lines.join("\n");
+}
+function exportTailwind(palette) {
+  const colors = {};
+  const map = [
+    ["brand-primary", "primary"],
+    ["brand-secondary", "secondary"],
+    ["brand-accent", "accent"],
+    ["brand-bg", "background"]
+  ];
+  for (const [tw, key] of map) {
+    const v = palette[key];
+    if (typeof v === "string" && v) colors[tw] = v;
+  }
+  return colors;
+}
+function exportFigma(palette, typography) {
+  const tokens = { color: {} };
+  for (const slot of ["primary", "secondary", "accent", "background"]) {
+    const v = palette[slot];
+    if (typeof v === "string") tokens.color[slot] = { value: v, type: "color" };
+  }
+  if (typography) {
+    const hf = typography.headingFont;
+    const bf = typography.bodyFont;
+    if (hf || bf) {
+      tokens.fontFamily = {};
+      if (hf) tokens.fontFamily.heading = { value: String(hf), type: "fontFamilies" };
+      if (bf) tokens.fontFamily.body = { value: String(bf), type: "fontFamilies" };
+    }
+  }
+  return tokens;
+}
+
 // src/tools/brandRuntime.ts
-function asEnvelope20(data) {
+function asEnvelope21(data) {
   return {
     _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
     data
@@ -10620,7 +11368,7 @@ function registerBrandRuntimeTools(server) {
     "get_brand_runtime",
     "Get the full brand runtime for a project. Returns the 4-layer brand system: messaging (value props, pillars, proof points), voice (tone, vocabulary, avoid patterns), visual (palette, typography, composition), and operating constraints (audience, archetype). Also returns extraction confidence metadata.",
     {
-      project_id: z25.string().optional().describe("Project ID. Defaults to current project.")
+      project_id: z26.string().optional().describe("Project ID. Defaults to current project.")
     },
     async ({ project_id }) => {
       const projectId = project_id || await getDefaultProjectId();
@@ -10680,7 +11428,7 @@ function registerBrandRuntimeTools(server) {
           pagesScraped: meta.pagesScraped || 0
         }
       };
-      const envelope = asEnvelope20(runtime);
+      const envelope = asEnvelope21(runtime);
       return {
         content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
       };
@@ -10690,7 +11438,7 @@ function registerBrandRuntimeTools(server) {
     "explain_brand_system",
     "Explains what brand data is available vs missing for a project. Returns a human-readable summary of completeness, confidence levels, and recommendations for improving the brand profile.",
     {
-      project_id: z25.string().optional().describe("Project ID. Defaults to current project.")
+      project_id: z26.string().optional().describe("Project ID. Defaults to current project.")
     },
     async ({ project_id }) => {
       const projectId = project_id || await getDefaultProjectId();
@@ -10802,8 +11550,8 @@ function registerBrandRuntimeTools(server) {
     "check_brand_consistency",
     "Check if content text is consistent with the brand voice, vocabulary, messaging, and factual claims. Returns per-dimension scores (0-100) and specific issues found. Use this to validate scripts, captions, or post copy before publishing.",
     {
-      content: z25.string().describe("The content text to check for brand consistency."),
-      project_id: z25.string().optional().describe("Project ID. Defaults to current project.")
+      content: z26.string().describe("The content text to check for brand consistency."),
+      project_id: z26.string().optional().describe("Project ID. Defaults to current project.")
     },
     async ({ content, project_id }) => {
       const projectId = project_id || await getDefaultProjectId();
@@ -10822,7 +11570,76 @@ function registerBrandRuntimeTools(server) {
       }
       const profile = row.profile_data;
       const checkResult = computeBrandConsistency(content, profile);
-      const envelope = asEnvelope20(checkResult);
+      const envelope = asEnvelope21(checkResult);
+      return {
+        content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
+      };
+    }
+  );
+  server.tool(
+    "audit_brand_colors",
+    "Audit content colors against the brand palette using perceptual color distance (Delta E 2000). Returns per-color compliance scores and identifies the closest brand color for each input.",
+    {
+      content_colors: z26.array(z26.string()).describe('Hex color strings used in the content (e.g., ["#FF0000", "#00FF00"])'),
+      project_id: z26.string().optional().describe("Project ID. Defaults to current project."),
+      threshold: z26.number().optional().describe("Max Delta E for on-brand (default 10). Lower = stricter.")
+    },
+    async ({ content_colors, project_id, threshold }) => {
+      const projectId = project_id || await getDefaultProjectId();
+      const { data: result, error: efError } = await callEdgeFunction("mcp-data", { action: "brand-profile", projectId });
+      const row = !efError && result?.success ? result.profile : null;
+      if (!row?.profile_data?.colorPalette) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No brand color palette found. Extract a brand profile first."
+            }
+          ],
+          isError: true
+        };
+      }
+      const auditResult = auditBrandColors(
+        row.profile_data.colorPalette,
+        content_colors,
+        threshold ?? 10
+      );
+      const envelope = asEnvelope21(auditResult);
+      return {
+        content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
+      };
+    }
+  );
+  server.tool(
+    "export_design_tokens",
+    "Export brand palette and typography as design tokens. Supports CSS custom properties, Tailwind config, and Figma Tokens JSON formats.",
+    {
+      format: z26.enum(["css", "tailwind", "figma"]).describe(
+        "Output format: css (CSS variables), tailwind (theme.extend.colors), figma (Figma Tokens JSON)"
+      ),
+      project_id: z26.string().optional().describe("Project ID. Defaults to current project.")
+    },
+    async ({ format, project_id }) => {
+      const projectId = project_id || await getDefaultProjectId();
+      const { data: result, error: efError } = await callEdgeFunction("mcp-data", { action: "brand-profile", projectId });
+      const row = !efError && result?.success ? result.profile : null;
+      if (!row?.profile_data?.colorPalette) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No brand color palette found. Extract a brand profile first."
+            }
+          ],
+          isError: true
+        };
+      }
+      const output = exportDesignTokens(
+        row.profile_data.colorPalette,
+        row.profile_data.typography,
+        format
+      );
+      const envelope = asEnvelope21({ format, tokens: output });
       return {
         content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
       };
@@ -10830,6 +11647,389 @@ function registerBrandRuntimeTools(server) {
   );
 }
 
+// src/tools/carousel.ts
+import { z as z27 } from "zod";
+init_supabase();
+init_request_context();
+var MAX_CREDITS_PER_RUN2 = Math.max(0, Number(process.env.SOCIALNEURON_MAX_CREDITS_PER_RUN || 0));
+var MAX_ASSETS_PER_RUN2 = Math.max(0, Number(process.env.SOCIALNEURON_MAX_ASSETS_PER_RUN || 0));
+var _globalCreditsUsed2 = 0;
+var _globalAssetsGenerated2 = 0;
+function getCreditsUsed2() {
+  const ctx = requestContext.getStore();
+  return ctx ? ctx.creditsUsed : _globalCreditsUsed2;
+}
+function addCreditsUsed2(amount) {
+  const ctx = requestContext.getStore();
+  if (ctx) {
+    ctx.creditsUsed += amount;
+  } else {
+    _globalCreditsUsed2 += amount;
+  }
+}
+function getAssetsGenerated2() {
+  const ctx = requestContext.getStore();
+  return ctx ? ctx.assetsGenerated : _globalAssetsGenerated2;
+}
+function addAssetsGenerated2(count) {
+  const ctx = requestContext.getStore();
+  if (ctx) {
+    ctx.assetsGenerated += count;
+  } else {
+    _globalAssetsGenerated2 += count;
+  }
+}
+function checkCreditBudget2(estimatedCost) {
+  if (MAX_CREDITS_PER_RUN2 <= 0) return { ok: true };
+  const used = getCreditsUsed2();
+  if (used + estimatedCost > MAX_CREDITS_PER_RUN2) {
+    return {
+      ok: false,
+      message: `Credit budget exceeded: ${used} used + ${estimatedCost} estimated > ${MAX_CREDITS_PER_RUN2} limit. Use a smaller slide count or cheaper image model.`
+    };
+  }
+  return { ok: true };
+}
+function checkAssetBudget2() {
+  if (MAX_ASSETS_PER_RUN2 <= 0) return { ok: true };
+  const gen = getAssetsGenerated2();
+  if (gen >= MAX_ASSETS_PER_RUN2) {
+    return {
+      ok: false,
+      message: `Asset limit reached: ${gen}/${MAX_ASSETS_PER_RUN2} assets generated this run.`
+    };
+  }
+  return { ok: true };
+}
+var IMAGE_CREDIT_ESTIMATES2 = {
+  midjourney: 20,
+  "nano-banana": 15,
+  "nano-banana-pro": 25,
+  "flux-pro": 30,
+  "flux-max": 50,
+  "gpt4o-image": 40,
+  imagen4: 35,
+  "imagen4-fast": 25,
+  seedream: 20
+};
+async function fetchBrandVisualContext(projectId) {
+  const { data, error } = await callEdgeFunction("mcp-data", { action: "brand-profile", projectId });
+  if (error || !data?.success || !data.profile?.profile_data) return null;
+  const profile = data.profile.profile_data;
+  const parts = [];
+  const palette = profile.colorPalette;
+  if (palette) {
+    const colors = Object.entries(palette).filter(([, v]) => typeof v === "string" && v.startsWith("#")).map(([k, v]) => `${k}: ${v}`).slice(0, 5);
+    if (colors.length > 0) {
+      parts.push(`Brand color palette: ${colors.join(", ")}`);
+    }
+  }
+  const logoUrl = profile.logoUrl;
+  let logoDesc = null;
+  if (logoUrl) {
+    const brandName = profile.name || "brand";
+    logoDesc = `Include a small "${brandName}" logo watermark in the bottom-right corner`;
+    parts.push(logoDesc);
+  }
+  const voice = profile.voiceProfile;
+  if (voice?.tone && Array.isArray(voice.tone) && voice.tone.length > 0) {
+    parts.push(`Visual mood: ${voice.tone.slice(0, 3).join(", ")}`);
+  }
+  if (parts.length === 0) return null;
+  return {
+    stylePrefix: parts.join(". "),
+    brandName: profile.name || null,
+    logoDescription: logoDesc
+  };
+}
+function registerCarouselTools(server) {
+  server.tool(
+    "create_carousel",
+    "End-to-end carousel creation: generates slide text + kicks off image generation for each slide in parallel. When brand_id is provided, auto-injects brand colors, logo watermark, and visual mood into every image prompt. Returns carousel data + image job_ids. Poll each job_id with check_status until complete, then call schedule_post with job_ids to publish as Instagram carousel (media_type=CAROUSEL_ALBUM).",
+    {
+      topic: z27.string().max(200).describe(
+        'Carousel topic/hook \u2014 be specific. Example: "5 pricing mistakes that kill SaaS startups" beats "SaaS tips".'
+      ),
+      image_model: z27.enum([
+        "midjourney",
+        "nano-banana",
+        "nano-banana-pro",
+        "flux-pro",
+        "flux-max",
+        "gpt4o-image",
+        "imagen4",
+        "imagen4-fast",
+        "seedream"
+      ]).describe(
+        "Image model for slide visuals. flux-pro for general purpose, imagen4 for photorealistic, midjourney for artistic."
+      ),
+      template_id: z27.enum([
+        "educational-series",
+        "product-showcase",
+        "story-arc",
+        "before-after",
+        "step-by-step",
+        "quote-collection",
+        "data-stats",
+        "myth-vs-reality",
+        "hormozi-authority"
+      ]).optional().describe("Carousel template. Default: hormozi-authority."),
+      slide_count: z27.number().min(3).max(10).optional().describe("Number of slides (3-10). Default: 7."),
+      aspect_ratio: z27.enum(["1:1", "4:5", "9:16"]).optional().describe("Aspect ratio for both carousel and images. Default: 1:1."),
+      style: z27.enum(["minimal", "bold", "professional", "playful", "hormozi"]).optional().describe("Visual style. Default: hormozi for hormozi-authority template."),
+      image_style_suffix: z27.string().max(500).optional().describe(
+        'Style suffix appended to every image prompt for visual consistency across slides. Example: "dark moody lighting, cinematic, 35mm film grain".'
+      ),
+      project_id: z27.string().optional().describe("Project ID to associate the carousel with."),
+      response_format: z27.enum(["text", "json"]).optional().describe("Response format. Default: text.")
+    },
+    async ({
+      topic,
+      image_model,
+      template_id,
+      slide_count,
+      aspect_ratio,
+      style,
+      image_style_suffix,
+      brand_id,
+      project_id,
+      response_format
+    }) => {
+      const format = response_format ?? "text";
+      const startedAt = Date.now();
+      const templateId = template_id ?? "hormozi-authority";
+      const resolvedStyle = style ?? (templateId === "hormozi-authority" ? "hormozi" : "professional");
+      const slideCount = slide_count ?? 7;
+      const ratio = aspect_ratio ?? "1:1";
+      let brandContext = null;
+      const brandProjectId = brand_id || project_id || await getDefaultProjectId();
+      if (brandProjectId) {
+        brandContext = await fetchBrandVisualContext(brandProjectId);
+      }
+      const carouselTextCost = 10 + slideCount * 2;
+      const perImageCost = IMAGE_CREDIT_ESTIMATES2[image_model] ?? 30;
+      const totalEstimatedCost = carouselTextCost + slideCount * perImageCost;
+      const budgetCheck = checkCreditBudget2(totalEstimatedCost);
+      if (!budgetCheck.ok) {
+        await logMcpToolInvocation({
+          toolName: "create_carousel",
+          status: "error",
+          durationMs: Date.now() - startedAt,
+          details: { error: budgetCheck.message, totalEstimatedCost }
+        });
+        return {
+          content: [{ type: "text", text: budgetCheck.message }],
+          isError: true
+        };
+      }
+      const assetBudget = checkAssetBudget2();
+      if (!assetBudget.ok) {
+        await logMcpToolInvocation({
+          toolName: "create_carousel",
+          status: "error",
+          durationMs: Date.now() - startedAt,
+          details: { error: assetBudget.message }
+        });
+        return {
+          content: [{ type: "text", text: assetBudget.message }],
+          isError: true
+        };
+      }
+      const userId = await getDefaultUserId();
+      const rateLimit = checkRateLimit("posting", `create_carousel:${userId}`);
+      if (!rateLimit.allowed) {
+        await logMcpToolInvocation({
+          toolName: "create_carousel",
+          status: "rate_limited",
+          durationMs: Date.now() - startedAt,
+          details: { retryAfter: rateLimit.retryAfter }
+        });
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Rate limit exceeded. Retry in ~${rateLimit.retryAfter}s.`
+            }
+          ],
+          isError: true
+        };
+      }
+      const { data: carouselData, error: carouselError } = await callEdgeFunction(
+        "generate-carousel",
+        {
+          topic,
+          templateId,
+          slideCount,
+          aspectRatio: ratio,
+          style: resolvedStyle,
+          projectId: project_id
+        },
+        { timeoutMs: 6e4 }
+      );
+      if (carouselError || !carouselData?.carousel) {
+        const errMsg = carouselError ?? "No carousel data returned";
+        await logMcpToolInvocation({
+          toolName: "create_carousel",
+          status: "error",
+          durationMs: Date.now() - startedAt,
+          details: { phase: "text_generation", error: errMsg }
+        });
+        return {
+          content: [{ type: "text", text: `Carousel text generation failed: ${errMsg}` }],
+          isError: true
+        };
+      }
+      const carousel = carouselData.carousel;
+      const textCredits = carousel.credits?.used ?? carouselTextCost;
+      addCreditsUsed2(textCredits);
+      const imageJobs = await Promise.all(
+        carousel.slides.map(async (slide) => {
+          const promptParts = [];
+          if (brandContext) promptParts.push(brandContext.stylePrefix);
+          if (slide.headline) promptParts.push(slide.headline);
+          if (slide.body) promptParts.push(slide.body);
+          if (promptParts.length === 0) promptParts.push(topic);
+          if (image_style_suffix) promptParts.push(image_style_suffix);
+          const imagePrompt = promptParts.join(". ");
+          try {
+            const { data, error } = await callEdgeFunction(
+              "kie-image-generate",
+              {
+                prompt: imagePrompt,
+                model: image_model,
+                aspectRatio: ratio
+              },
+              { timeoutMs: 3e4 }
+            );
+            if (error || !data?.taskId && !data?.asyncJobId) {
+              return {
+                slideNumber: slide.slideNumber,
+                jobId: null,
+                model: image_model,
+                error: error ?? "No job ID returned"
+              };
+            }
+            const jobId = data.asyncJobId ?? data.taskId ?? null;
+            if (jobId) {
+              addCreditsUsed2(perImageCost);
+              addAssetsGenerated2(1);
+            }
+            return {
+              slideNumber: slide.slideNumber,
+              jobId,
+              model: image_model,
+              error: null
+            };
+          } catch (err) {
+            return {
+              slideNumber: slide.slideNumber,
+              jobId: null,
+              model: image_model,
+              error: sanitizeError(err)
+            };
+          }
+        })
+      );
+      const successfulJobs = imageJobs.filter((j) => j.jobId !== null);
+      const failedJobs = imageJobs.filter((j) => j.jobId === null);
+      await logMcpToolInvocation({
+        toolName: "create_carousel",
+        status: failedJobs.length === imageJobs.length ? "error" : "success",
+        durationMs: Date.now() - startedAt,
+        details: {
+          carouselId: carousel.id,
+          templateId,
+          slideCount: carousel.slides.length,
+          imagesStarted: successfulJobs.length,
+          imagesFailed: failedJobs.length,
+          imageModel: image_model,
+          creditsUsed: getCreditsUsed2()
+        }
+      });
+      if (format === "json") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                {
+                  _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+                  data: {
+                    carouselId: carousel.id,
+                    templateId,
+                    style: resolvedStyle,
+                    slideCount: carousel.slides.length,
+                    slides: carousel.slides.map((s) => {
+                      const job = imageJobs.find((j) => j.slideNumber === s.slideNumber);
+                      return {
+                        ...s,
+                        imageJobId: job?.jobId ?? null,
+                        imageError: job?.error ?? null
+                      };
+                    }),
+                    imageModel: image_model,
+                    brandApplied: brandContext ? {
+                      brandName: brandContext.brandName,
+                      hasLogo: !!brandContext.logoDescription,
+                      stylePrefix: brandContext.stylePrefix
+                    } : null,
+                    jobIds: successfulJobs.map((j) => j.jobId),
+                    failedSlides: failedJobs.map((j) => ({
+                      slideNumber: j.slideNumber,
+                      error: j.error
+                    })),
+                    credits: {
+                      textGeneration: textCredits,
+                      imagesEstimated: successfulJobs.length * perImageCost,
+                      totalEstimated: textCredits + successfulJobs.length * perImageCost
+                    }
+                  }
+                },
+                null,
+                2
+              )
+            }
+          ]
+        };
+      }
+      const lines = [
+        `Carousel created: ${carousel.slides.length} slides + ${successfulJobs.length} image jobs started.`,
+        `  Carousel ID: ${carousel.id}`,
+        `  Template: ${templateId} | Style: ${resolvedStyle}`,
+        `  Image model: ${image_model}`,
+        `  Credits: ~${textCredits + successfulJobs.length * perImageCost} (${textCredits} text + ${successfulJobs.length * perImageCost} images)`
+      ];
+      if (brandContext) {
+        lines.push(
+          `  Brand: ${brandContext.brandName || "unnamed"}${brandContext.logoDescription ? " (logo overlay via prompt)" : ""}`
+        );
+      }
+      lines.push("", "Slides:");
+      for (const slide of carousel.slides) {
+        const job = imageJobs.find((j) => j.slideNumber === slide.slideNumber);
+        const status = job?.jobId ? `image: ${job.jobId}` : `image FAILED: ${job?.error}`;
+        lines.push(`  ${slide.slideNumber}. ${slide.headline || "(no headline)"} [${status}]`);
+      }
+      if (failedJobs.length > 0) {
+        lines.push("");
+        lines.push(
+          `WARNING: ${failedJobs.length}/${imageJobs.length} image generations failed. Use generate_image manually for failed slides.`
+        );
+      }
+      const jobIdList = successfulJobs.map((j) => j.jobId).join(", ");
+      lines.push("");
+      lines.push("Next steps:");
+      lines.push(`  1. Poll each job: check_status with job_id for each of: ${jobIdList}`);
+      lines.push(
+        "  2. When all complete: schedule_post with job_ids=[...] and media_type=CAROUSEL_ALBUM"
+      );
+      return {
+        content: [{ type: "text", text: lines.join("\n") }]
+      };
+    }
+  );
+}
+
 // src/lib/register-tools.ts
 function applyScopeEnforcement(server, scopeResolver) {
   const originalTool = server.tool.bind(server);
@@ -10924,6 +12124,7 @@ function registerAllTools(server, options) {
   registerLoopSummaryTools(server);
   registerUsageTools(server);
   registerAutopilotTools(server);
+  registerRecipeTools(server);
   registerExtractionTools(server);
   registerQualityTools(server);
   registerPlanningTools(server);
@@ -10933,21 +12134,22 @@ function registerAllTools(server, options) {
   registerSuggestTools(server);
   registerDigestTools(server);
   registerBrandRuntimeTools(server);
+  registerCarouselTools(server);
   applyAnnotations(server);
 }
 
 // src/prompts.ts
-import { z as z26 } from "zod";
+import { z as z28 } from "zod";
 function registerPrompts(server) {
   server.prompt(
     "create_weekly_content_plan",
     "Generate a full week of social media content (7 days, multiple platforms). Returns a structured plan with topics, formats, and posting times.",
     {
-      niche: z26.string().describe('Your content niche or industry (e.g., "fitness coaching", "SaaS marketing")'),
-      platforms: z26.string().optional().describe(
+      niche: z28.string().describe('Your content niche or industry (e.g., "fitness coaching", "SaaS marketing")'),
+      platforms: z28.string().optional().describe(
         'Comma-separated platforms to target (default: "YouTube, Instagram, TikTok, LinkedIn")'
       ),
-      tone: z26.string().optional().describe('Brand tone of voice (e.g., "professional", "casual", "bold and edgy")')
+      tone: z28.string().optional().describe('Brand tone of voice (e.g., "professional", "casual", "bold and edgy")')
     },
     ({ niche, platforms, tone }) => {
       const targetPlatforms = platforms || "YouTube, Instagram, TikTok, LinkedIn";
@@ -10989,8 +12191,8 @@ After building the plan, use \`save_content_plan\` to save it.`
     "analyze_top_content",
     "Analyze your best-performing posts to identify patterns and replicate success. Returns insights on hooks, formats, timing, and topics that resonate.",
     {
-      timeframe: z26.string().optional().describe('Analysis period (default: "30 days"). E.g., "7 days", "90 days"'),
-      platform: z26.string().optional().describe('Filter to a specific platform (e.g., "youtube", "instagram")')
+      timeframe: z28.string().optional().describe('Analysis period (default: "30 days"). E.g., "7 days", "90 days"'),
+      platform: z28.string().optional().describe('Filter to a specific platform (e.g., "youtube", "instagram")')
     },
     ({ timeframe, platform: platform2 }) => {
       const period = timeframe || "30 days";
@@ -11027,10 +12229,10 @@ Format as a clear, actionable performance report.`
     "repurpose_content",
     "Take one piece of content and transform it into 8-10 pieces across multiple platforms and formats.",
     {
-      source: z26.string().describe(
+      source: z28.string().describe(
         "The source content to repurpose \u2014 a URL, transcript, or the content text itself"
       ),
-      target_platforms: z26.string().optional().describe(
+      target_platforms: z28.string().optional().describe(
         'Comma-separated target platforms (default: "Twitter, LinkedIn, Instagram, TikTok, YouTube")'
       )
     },
@@ -11072,9 +12274,9 @@ For each piece, include the platform, format, character count, and suggested pos
     "setup_brand_voice",
     "Define or refine your brand voice profile so all generated content stays on-brand. Walks through tone, audience, values, and style.",
     {
-      brand_name: z26.string().describe("Your brand or business name"),
-      industry: z26.string().optional().describe('Your industry or niche (e.g., "B2B SaaS", "fitness coaching")'),
-      website: z26.string().optional().describe("Your website URL for context")
+      brand_name: z28.string().describe("Your brand or business name"),
+      industry: z28.string().optional().describe('Your industry or niche (e.g., "B2B SaaS", "fitness coaching")'),
+      website: z28.string().optional().describe("Your website URL for context")
     },
     ({ brand_name, industry, website }) => {
       const industryContext = industry ? ` in the ${industry} space` : "";
@@ -12140,7 +13342,7 @@ app.post("/mcp", authenticateRequest, async (req, res) => {
     const rawMessage = err instanceof Error ? err.message : "Internal server error";
     console.error(`[MCP HTTP] POST /mcp error: ${rawMessage}`);
     if (!res.headersSent) {
-      res.status(500).json({ jsonrpc: "2.0", error: { code: -32603, message: sanitizeError2(err) } });
+      res.status(500).json({ jsonrpc: "2.0", error: { code: -32603, message: sanitizeError(err) } });
     }
   }
 });
@@ -12182,7 +13384,7 @@ app.delete("/mcp", authenticateRequest, async (req, res) => {
 app.use((err, _req, res, _next) => {
   console.error("[MCP HTTP] Unhandled Express error:", err.stack || err.message || err);
   if (!res.headersSent) {
-    res.status(500).json({ error: "internal_error", error_description: sanitizeError2(err) });
+    res.status(500).json({ error: "internal_error", error_description: sanitizeError(err) });
   }
 });
 var httpServer = app.listen(PORT, "0.0.0.0", () => {