@socialneuron/mcp-server 1.8.0 → 1.8.2

package/dist/http.js

@@ -56,25 +56,140 @@ __export(credentials_exports, {
   saveSupabaseUrl: () => saveSupabaseUrl
 });
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import {
+  closeSync,
+  constants,
+  existsSync,
+  fchmodSync,
+  fstatSync,
+  ftruncateSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
 import { homedir, platform } from "node:os";
 import { join } from "node:path";
+function assertSafeCredentialPaths() {
+  if (platform() === "win32") return;
+  const uid = process.getuid?.();
+  if (existsSync(CONFIG_DIR)) {
+    const directory = lstatSync(CONFIG_DIR);
+    if (directory.isSymbolicLink() || !directory.isDirectory()) {
+      throw new Error("Unsafe Social Neuron credential directory. Refusing to use it.");
+    }
+    if (uid !== void 0 && directory.uid !== uid) {
+      throw new Error("Social Neuron credential directory is not owned by the current user.");
+    }
+  }
+  if (existsSync(CREDENTIALS_FILE)) {
+    const file = lstatSync(CREDENTIALS_FILE);
+    if (file.isSymbolicLink() || !file.isFile()) {
+      throw new Error("Unsafe Social Neuron credential file. Refusing to use it.");
+    }
+    if (uid !== void 0 && file.uid !== uid) {
+      throw new Error("Social Neuron credential file is not owned by the current user.");
+    }
+  }
+}
+function openValidatedCredentialPath(target, kind, flags) {
+  let fd;
+  try {
+    fd = openSync(
+      target,
+      flags | constants.O_NOFOLLOW | (kind === "directory" ? constants.O_DIRECTORY : 0)
+    );
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(`Unsafe Social Neuron credential ${kind}. Refusing to use it.`);
+  }
+  const opened = fstatSync(fd);
+  const uid = process.getuid?.();
+  if ((kind === "directory" ? !opened.isDirectory() : !opened.isFile()) || uid !== void 0 && opened.uid !== uid || kind === "file" && opened.nlink !== 1) {
+    closeSync(fd);
+    throw new Error(`Unsafe Social Neuron credential ${kind}. Refusing to use it.`);
+  }
+  return fd;
+}
+function hardenCredentialPath(target, kind, mode) {
+  const fd = openValidatedCredentialPath(target, kind, constants.O_RDONLY);
+  if (fd === null) return;
+  try {
+    const opened = fstatSync(fd);
+    if ((opened.mode & 63) !== 0) fchmodSync(fd, mode);
+  } finally {
+    closeSync(fd);
+  }
+}
+function hardenCredentialPermissions() {
+  if (platform() === "win32") return;
+  hardenCredentialPath(CONFIG_DIR, "directory", 448);
+  hardenCredentialPath(CREDENTIALS_FILE, "file", 384);
+}
 function readCredentialsFile() {
+  if (platform() !== "win32") hardenCredentialPath(CONFIG_DIR, "directory", 448);
+  const fd = platform() === "win32" ? (() => {
+    try {
+      return openSync(CREDENTIALS_FILE, constants.O_RDONLY);
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    }
+  })() : openValidatedCredentialPath(CREDENTIALS_FILE, "file", constants.O_RDONLY);
+  if (fd === null) return {};
   try {
-    if (!existsSync(CREDENTIALS_FILE)) return {};
-    const raw = readFileSync(CREDENTIALS_FILE, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return {};
+    if (platform() !== "win32") fchmodSync(fd, 384);
+    const parsed = JSON.parse(readFileSync(fd, "utf-8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("Social Neuron credential file is invalid.");
+    }
+    return parsed;
+  } finally {
+    closeSync(fd);
   }
 }
 function writeCredentialsFile(data) {
   if (!existsSync(CONFIG_DIR)) {
     mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
   }
-  writeFileSync(CREDENTIALS_FILE, JSON.stringify(data, null, 2) + "\n", {
-    mode: 384
-  });
+  assertSafeCredentialPaths();
+  const payload = JSON.stringify(data, null, 2) + "\n";
+  if (platform() === "win32") {
+    writeFileSync(CREDENTIALS_FILE, payload, { mode: 384 });
+  } else {
+    let fd;
+    try {
+      fd = openSync(
+        CREDENTIALS_FILE,
+        constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
+        384
+      );
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        throw new Error("Unsafe Social Neuron credential file. Refusing to write it.");
+      }
+      try {
+        fd = openSync(CREDENTIALS_FILE, constants.O_WRONLY | constants.O_NOFOLLOW);
+      } catch {
+        throw new Error("Unsafe Social Neuron credential file. Refusing to write it.");
+      }
+    }
+    try {
+      const opened = fstatSync(fd);
+      const uid = process.getuid?.();
+      if (!opened.isFile() || opened.nlink !== 1 || uid !== void 0 && opened.uid !== uid) {
+        throw new Error("Unsafe Social Neuron credential file. Refusing to write it.");
+      }
+      fchmodSync(fd, 384);
+      ftruncateSync(fd, 0);
+      writeFileSync(fd, payload);
+    } finally {
+      closeSync(fd);
+    }
+  }
+  hardenCredentialPermissions();
 }
 function macKeychainRead(service) {
   try {
@@ -284,7 +399,6 @@ async function validateApiKey(apiKey, _attempt = 0) {
       }
     );
     if (!response.ok) {
-      const text = await response.text();
       const retryable = response.status === 429 || response.status >= 500;
       if (retryable && _attempt < VALIDATE_MAX_RETRIES) {
         await sleep(300 * (_attempt + 1));
@@ -293,11 +407,19 @@ async function validateApiKey(apiKey, _attempt = 0) {
       return {
         valid: false,
         retryable,
-        error: `Validation failed (HTTP ${response.status}): ${text}`
+        error: `Validation failed (HTTP ${response.status}).`
       };
     }
-    return await response.json();
-  } catch (err) {
+    const result = await response.json();
+    if (!result.valid) {
+      return {
+        valid: false,
+        retryable: false,
+        error: "API key is invalid, expired, or revoked."
+      };
+    }
+    return result;
+  } catch {
     if (_attempt < VALIDATE_MAX_RETRIES) {
       await sleep(300 * (_attempt + 1));
       return validateApiKey(apiKey, _attempt + 1);
@@ -305,7 +427,7 @@ async function validateApiKey(apiKey, _attempt = 0) {
     return {
       valid: false,
       retryable: true,
-      error: err instanceof Error ? err.message : String(err)
+      error: "Authentication service is temporarily unavailable."
     };
   }
 }
@@ -326,10 +448,12 @@ __export(posthog_exports, {
   initPostHog: () => initPostHog,
   shutdownPostHog: () => shutdownPostHog
 });
-import { createHash } from "node:crypto";
+import { createHmac, randomBytes } from "node:crypto";
 import { PostHog } from "posthog-node";
 function hashUserId(userId) {
-  return createHash("sha256").update(`${POSTHOG_SALT}:${userId}`).digest("hex").substring(0, 32);
+  const hmac = createHmac("sha256", POSTHOG_PSEUDONYMIZATION_KEY);
+  hmac.update(userId);
+  return hmac.digest("hex").substring(0, 32);
 }
 function initPostHog() {
   if (isTelemetryDisabled()) return;
@@ -365,13 +489,13 @@ async function shutdownPostHog() {
     client = null;
   }
 }
-var POSTHOG_SALT, client;
+var POSTHOG_PSEUDONYMIZATION_KEY, client;
 var init_posthog = __esm({
   "src/lib/posthog.ts"() {
     "use strict";
     init_supabase();
     init_request_context();
-    POSTHOG_SALT = "socialneuron-mcp-ph-v1";
+    POSTHOG_PSEUDONYMIZATION_KEY = process.env.POSTHOG_PSEUDONYMIZATION_KEY || randomBytes(32).toString("hex");
     client = null;
   }
 });
@@ -658,6 +782,9 @@ var TOOL_SCOPES = {
   generate_carousel: "mcp:write",
   create_carousel: "mcp:write",
   upload_media: "mcp:write",
+  cancel_async_job: "mcp:write",
+  delete_carousel: "mcp:write",
+  delete_content_plan: "mcp:write",
   // mcp:read (media)
   get_media_url: "mcp:read",
   // F4 Hyperframes — HTML composition runtime
@@ -665,6 +792,8 @@ var TOOL_SCOPES = {
   render_hyperframes: "mcp:write",
   // mcp:distribute
   schedule_post: "mcp:distribute",
+  reschedule_post: "mcp:distribute",
+  cancel_scheduled_post: "mcp:distribute",
   start_platform_connection: "mcp:distribute",
   // mcp:analytics
   refresh_platform_analytics: "mcp:analytics",
@@ -679,6 +808,7 @@ var TOOL_SCOPES = {
   list_autopilot_configs: "mcp:autopilot",
   update_autopilot_config: "mcp:autopilot",
   get_autopilot_status: "mcp:autopilot",
+  delete_autopilot_config: "mcp:autopilot",
   // Recipes
   list_recipes: "mcp:read",
   get_recipe_details: "mcp:read",
@@ -722,6 +852,7 @@ var TOOL_SCOPES = {
   detect_anomalies: "mcp:analytics",
   // mcp:read (Apps — entry tool for the Content Calendar MCP App; reads recent posts)
   open_content_calendar: "mcp:read",
+  open_analytics_pulse: "mcp:read",
   // mcp:write (Agentic harness — learning loop write-back)
   write_agent_reflection: "mcp:write",
   record_outcome: "mcp:write",
@@ -737,6 +868,7 @@ var TOOL_SCOPES = {
   get_active_campaigns: "mcp:read",
   // mcp:read / mcp:write (Skills)
   list_skills: "mcp:read",
+  get_skill: "mcp:read",
   run_skill: "mcp:write",
   // mcp:read (Loop observability — growth-loop KPIs + content learning state)
   get_loop_pulse: "mcp:read",
@@ -750,6 +882,9 @@ function hasScope(userScopes, required) {
   }
   return false;
 }
+function getAllScopes() {
+  return Object.keys(SCOPE_HIERARCHY);
+}
 
 // src/lib/tool-annotations.ts
 var ACRONYMS = {
@@ -808,6 +943,11 @@ var SCOPE_DEFAULTS = {
 var OVERRIDES = {
   // Destructive or overwrite tools
   delete_comment: { destructiveHint: true },
+  cancel_async_job: { destructiveHint: true, idempotentHint: true },
+  cancel_scheduled_post: { destructiveHint: true, idempotentHint: true, openWorldHint: true },
+  delete_carousel: { destructiveHint: true, idempotentHint: true },
+  delete_content_plan: { destructiveHint: true, idempotentHint: true },
+  delete_autopilot_config: { destructiveHint: true, idempotentHint: true },
   moderate_comment: { destructiveHint: true },
   save_brand_profile: { destructiveHint: true, idempotentHint: true },
   update_platform_voice: { destructiveHint: true, idempotentHint: true },
@@ -1041,6 +1181,26 @@ var TOOL_CATALOG = [
     module: "carousel",
     scope: "mcp:write"
   },
+  {
+    name: "cancel_async_job",
+    description: "Cancel an owned pending async job and refund an eligible debit",
+    module: "lifecycle",
+    scope: "mcp:write",
+    task_intent: "Stop a queued generation or render before worker execution",
+    use_when: "The user explicitly wants to cancel a pending job and has confirmed the action.",
+    avoid_when: "The job is already processing or terminal; check_status instead.",
+    next_tools: ["check_status", "get_credit_balance"]
+  },
+  {
+    name: "delete_carousel",
+    description: "Delete an owned carousel content record from one project",
+    module: "lifecycle",
+    scope: "mcp:write",
+    task_intent: "Remove an unwanted carousel record from Social Neuron",
+    use_when: "The user explicitly confirms deletion and understands stored media follows normal retention.",
+    avoid_when: "The user expects an already-published social post or retained media object to be removed.",
+    next_tools: ["list_recent_posts"]
+  },
   // media
   {
     name: "upload_media",
@@ -1061,6 +1221,26 @@ var TOOL_CATALOG = [
     module: "distribution",
     scope: "mcp:distribute"
   },
+  {
+    name: "reschedule_post",
+    description: "Atomically move an unclaimed scheduled post to a new time within its brand project",
+    module: "distribution",
+    scope: "mcp:distribute",
+    task_intent: "Move an already scheduled post without creating a duplicate publication",
+    use_when: "A pending or scheduled post needs a different future publication time.",
+    avoid_when: "The post is already publishing or published; create a new post instead.",
+    next_tools: ["list_recent_posts", "open_content_calendar"]
+  },
+  {
+    name: "cancel_scheduled_post",
+    description: "Cancel an owned scheduled post before publishing begins",
+    module: "lifecycle",
+    scope: "mcp:distribute",
+    task_intent: "Unschedule a post without publishing it",
+    use_when: "The user explicitly confirms cancellation of a draft, pending, or scheduled post.",
+    avoid_when: "The post is already publishing or published.",
+    next_tools: ["list_recent_posts", "open_content_calendar"]
+  },
   {
     name: "list_recent_posts",
     description: "List recently published or scheduled posts",
@@ -1251,6 +1431,16 @@ var TOOL_CATALOG = [
     module: "planning",
     scope: "mcp:write"
   },
+  {
+    name: "delete_content_plan",
+    description: "Permanently delete an owned content plan from one project",
+    module: "lifecycle",
+    scope: "mcp:write",
+    task_intent: "Remove an obsolete saved content plan",
+    use_when: "The user explicitly confirms permanent deletion of a specific plan.",
+    avoid_when: "The plan has scheduled posts the user also expects to cancel; cancel those posts separately.",
+    next_tools: ["plan_content_week", "list_recent_posts"]
+  },
   {
     name: "submit_content_plan_for_approval",
     description: "Submit a content plan for team approval",
@@ -1345,6 +1535,16 @@ var TOOL_CATALOG = [
     module: "autopilot",
     scope: "mcp:autopilot"
   },
+  {
+    name: "delete_autopilot_config",
+    description: "Permanently delete an owned autopilot configuration from one project",
+    module: "lifecycle",
+    scope: "mcp:autopilot",
+    task_intent: "Remove an autopilot configuration while retaining historical run records",
+    use_when: "The user explicitly confirms deletion of the configuration.",
+    avoid_when: "The user only wants to pause or edit automation, or expects historical posts to be deleted.",
+    next_tools: ["list_autopilot_configs"]
+  },
   // extraction
   {
     name: "extract_url_content",
@@ -1461,7 +1661,13 @@ var TOOL_CATALOG = [
   // apps (MCP Apps — interactive UI inside the host)
   {
     name: "open_content_calendar",
-    description: "Open an interactive drag-drop calendar of the user's scheduled posts inside the host (Claude Desktop / claude.ai). Renders an MCP App; backed by list_recent_posts, schedule_post, find_next_slots \u2014 no new tools needed.",
+    description: "Open a project-scoped interactive calendar inside MCP App-capable hosts. Uses reschedule_post for conflict-safe drag/drop and schedule_post for new posts.",
+    module: "apps",
+    scope: "mcp:read"
+  },
+  {
+    name: "open_analytics_pulse",
+    description: "Open a project-scoped interactive performance dashboard with views, engagement, platform mix, and top posts.",
     module: "apps",
     scope: "mcp:read"
   },
@@ -1576,6 +1782,12 @@ var TOOL_CATALOG = [
     module: "skills",
     scope: "mcp:read"
   },
+  {
+    name: "get_skill",
+    description: "Fetch the full body and current compiled guidance for one Social Neuron skill by slug.",
+    module: "skills",
+    scope: "mcp:read"
+  },
   {
     name: "run_skill",
     description: "Run a Social Neuron workflow skill end-to-end (brand-locked content production). Returns a structured run preview with the step plan, credit cost, and a deep-link to launch in the SN dashboard.",
@@ -1635,6 +1847,7 @@ var ANTHROPIC_DIRECTORY_EXCLUDED_TOOLS = /* @__PURE__ */ new Set([
   "list_hyperframes_blocks",
   "render_hyperframes",
   "list_skills",
+  "get_skill",
   "run_skill"
 ]);
 function resolveToolProfile(value) {
@@ -1649,7 +1862,7 @@ function isToolAllowedByProfile(toolName, profile) {
 }
 function publicToolsForProfile(profile) {
   return TOOL_CATALOG.filter(
-    (tool) => !tool.localOnly && !tool.internal && isToolAllowedByProfile(tool.name, profile)
+    (tool) => !tool.localOnly && !tool.internal && !tool.hiddenFromPublicCount && isToolAllowedByProfile(tool.name, profile)
   );
 }
 function applyToolProfile(server, profile) {
@@ -1695,7 +1908,8 @@ var constants_default = {
     ssn: "\\d{3}-\\d{2}-\\d{4}",
     ip: "(?<![\\d.])(?:\\d{1,3}\\.){3}\\d{1,3}(?![\\d.])"
   },
-  MAX_LENGTH: 1e4
+  MAX_LENGTH: 1e4,
+  MAX_OUTPUT_LENGTH: 1e6
 };
 
 // src/lib/agent-harness/constants.ts
@@ -1756,7 +1970,8 @@ function scrubPii(text, _role) {
 function scan(text, options) {
   const flagged = /* @__PURE__ */ new Set();
   let risk = 0;
-  if (text.length > CONSTANTS.MAX_LENGTH) {
+  const maxLength = options.source === "mcp_tool_output" ? CONSTANTS.MAX_OUTPUT_LENGTH : CONSTANTS.MAX_LENGTH;
+  if (text.length > maxLength) {
     return {
       passed: false,
       risk_score: 1,
@@ -1803,6 +2018,85 @@ import { z } from "zod";
 // src/lib/edge-function.ts
 init_supabase();
 init_request_context();
+var SAFE_GATEWAY_ERROR_CODES = /* @__PURE__ */ new Set([
+  "daily_limit_reached",
+  "insufficient_credits",
+  "project_scope_mismatch",
+  "schedule_conflict",
+  "post_not_found",
+  "post_not_reschedulable",
+  "post_in_progress",
+  "not_cancellable",
+  "publishing_in_progress",
+  "plan_upgrade_required",
+  "rate_limited",
+  "validation_error",
+  "permission_denied",
+  "not_found"
+]);
+function safeGatewayError(responseText, status) {
+  try {
+    const parsed = JSON.parse(responseText);
+    const nested = parsed.error && typeof parsed.error === "object" ? parsed.error : null;
+    const candidates = [
+      nested?.error_type,
+      nested?.code,
+      parsed.error_type,
+      parsed.error_code,
+      parsed.code,
+      typeof parsed.error === "string" ? parsed.error : null
+    ];
+    for (const value of candidates) {
+      if (typeof value !== "string") continue;
+      const normalized = value.trim().toLowerCase();
+      if (SAFE_GATEWAY_ERROR_CODES.has(normalized)) return normalized;
+      const embedded = [...SAFE_GATEWAY_ERROR_CODES].find((code) => normalized.includes(code));
+      if (embedded) return embedded;
+    }
+  } catch {
+  }
+  return `Backend request failed (HTTP ${status}).`;
+}
+var SAFE_BILLING_STATUSES = /* @__PURE__ */ new Set([
+  "reserved",
+  "charged",
+  "refunded",
+  "failed_no_charge",
+  "refund_pending",
+  "not_charged"
+]);
+var SAFE_JOB_STATUSES = /* @__PURE__ */ new Set([
+  "queued",
+  "pending",
+  "processing",
+  "completed",
+  "failed",
+  "cancelled",
+  "canceled"
+]);
+function safeFailureData(responseText) {
+  try {
+    const parsed = JSON.parse(responseText);
+    const metric = (name) => {
+      const value = parsed[name];
+      return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+    };
+    const billingStatus = typeof parsed.billing_status === "string" && SAFE_BILLING_STATUSES.has(parsed.billing_status) ? parsed.billing_status : void 0;
+    const failureReason = parsed.failure_reason === "generation_failed" || parsed.failure_reason === "authentication_failed" || parsed.failure_reason === "cancelled_by_user" ? parsed.failure_reason : void 0;
+    const jobStatus = typeof parsed.status === "string" && SAFE_JOB_STATUSES.has(parsed.status) ? parsed.status : void 0;
+    const safe = {
+      ...jobStatus ? { status: jobStatus } : {},
+      ...metric("credits_reserved") !== void 0 ? { credits_reserved: metric("credits_reserved") } : {},
+      ...metric("credits_charged") !== void 0 ? { credits_charged: metric("credits_charged") } : {},
+      ...metric("credits_refunded") !== void 0 ? { credits_refunded: metric("credits_refunded") } : {},
+      ...billingStatus ? { billing_status: billingStatus } : {},
+      ...failureReason ? { failure_reason: failureReason } : {}
+    };
+    return Object.keys(safe).length > 0 ? safe : null;
+  } catch {
+    return null;
+  }
+}
 function getApiKeyOrNull() {
   const envKey = process.env.SOCIALNEURON_API_KEY;
   if (envKey && envKey.trim().length) return envKey.trim();
@@ -1873,33 +2167,28 @@ async function callEdgeFunction(functionName, body, options) {
     clearTimeout(timer);
     const responseText = await response.text();
     if (!response.ok) {
-      let errorMessage;
-      try {
-        const errorJson = JSON.parse(responseText);
-        errorMessage = errorJson.error || errorJson.message || responseText;
-      } catch {
-        errorMessage = responseText || `HTTP ${response.status}`;
-      }
+      const errorCode = safeGatewayError(responseText, response.status);
+      const failureData = safeFailureData(responseText);
       if (response.status === 401) {
         return {
-          data: null,
+          data: failureData,
           error: `Authentication failed (HTTP 401). Run 'npx @socialneuron/mcp-server login' to re-authenticate.`
         };
       }
       if (response.status === 403) {
         return {
-          data: null,
-          error: `Forbidden (HTTP 403): ${errorMessage}. This action isn't permitted for your account, plan, or scope \u2014 your connection is still valid.`
+          data: failureData,
+          error: `Forbidden (HTTP 403): ${errorCode}. This action isn't permitted for your account, plan, or scope \u2014 your connection is still valid.`
         };
       }
       if (response.status === 429) {
         const retryAfter = response.headers.get("retry-after") || "60";
         return {
-          data: null,
+          data: failureData,
           error: `Rate limit exceeded (HTTP 429). Wait ${retryAfter}s before retrying. Reduce request frequency or upgrade your plan.`
         };
       }
-      return { data: null, error: errorMessage };
+      return { data: failureData, error: errorCode };
     }
     try {
       const data = JSON.parse(responseText);
@@ -1915,8 +2204,7 @@ async function callEdgeFunction(functionName, body, options) {
         error: `Edge Function '${functionName}' timed out after ${timeoutMs}ms`
       };
     }
-    const message = err instanceof Error ? err.message : String(err);
-    return { data: null, error: message };
+    return { data: null, error: "Network request failed. Please retry." };
   }
 }
 
@@ -1933,6 +2221,45 @@ var CATEGORY_CONFIGS = {
   read: { maxTokens: 60, refillRate: 60 / 60 }
   // 60 req/min — default
 };
+var GENERATION_TOOLS = /* @__PURE__ */ new Set([
+  "generate_content",
+  "adapt_content",
+  "generate_video",
+  "generate_image",
+  "create_storyboard",
+  "generate_voiceover",
+  "generate_carousel",
+  "create_carousel",
+  "render_demo_video",
+  "render_template_video",
+  "render_hyperframes",
+  "execute_recipe",
+  "run_content_pipeline",
+  "plan_content_week",
+  "extract_brand",
+  "generate_performance_digest"
+]);
+var POSTING_TOOLS = /* @__PURE__ */ new Set([
+  "schedule_post",
+  "reschedule_post",
+  "schedule_content_plan",
+  "reply_to_comment",
+  "post_comment",
+  "moderate_comment",
+  "delete_comment",
+  "start_platform_connection",
+  "refresh_platform_analytics"
+]);
+function rateLimitCategoryForTool(toolName) {
+  if (!toolName) return "read";
+  if (GENERATION_TOOLS.has(toolName)) return "generation";
+  if (POSTING_TOOLS.has(toolName)) return "posting";
+  if (toolName === "upload_media") return "upload";
+  if (toolName === "capture_screenshot" || toolName === "capture_app_page") return "screenshot";
+  const scope = TOOL_SCOPES[toolName];
+  if (scope === "mcp:write" || scope === "mcp:distribute" || scope === "mcp:analytics" || scope === "mcp:comments" || scope === "mcp:autopilot") return "posting";
+  return "read";
+}
 var RateLimiter = class {
   tokens;
   lastRefill;
@@ -1997,7 +2324,7 @@ function checkRateLimit(category, key) {
 init_supabase();
 
 // src/lib/version.ts
-var MCP_VERSION = "1.8.0";
+var MCP_VERSION = "1.8.2";
 
 // src/tools/ideation.ts
 function asEnvelope(data) {
@@ -2033,8 +2360,8 @@ function registerIdeationTools(server) {
       brand_voice: z.string().max(500).optional().describe(
         'Tone directive (e.g. "direct, no jargon, second person" or "witty Gen-Z energy with emoji"). Leave blank to auto-load from project brand profile if project_id is set.'
       ),
-      model: z.enum(["gemini-2.0-flash", "gemini-2.5-flash", "gemini-2.5-pro"]).optional().describe(
-        "AI model to use. Defaults to gemini-2.5-flash. Use gemini-2.5-pro for highest quality."
+      model: z.enum(["gemini-2.5-flash", "gemini-2.5-pro"]).optional().describe(
+        "AI model to use. Defaults to gemini-2.5-flash. Use gemini-2.5-pro for highest quality. Retired provider models are intentionally not accepted."
       ),
       project_id: z.string().uuid().optional().describe(
         "Project ID to auto-load brand profile and performance context for prompt enrichment."
@@ -2043,7 +2370,7 @@ function registerIdeationTools(server) {
     async ({ prompt, content_type, platform: platform2, brand_voice, model, project_id }) => {
       try {
         const userId = await getDefaultUserId();
-        const rl = checkRateLimit("posting", userId);
+        const rl = checkRateLimit("generation", `generate_content:${userId}`);
         if (!rl.allowed) {
           return {
             content: [
@@ -2300,7 +2627,7 @@ Content Type: ${content_type}`;
     async ({ content, source_platform, target_platform, brand_voice, project_id }) => {
       try {
         const userId = await getDefaultUserId();
-        const rl = checkRateLimit("posting", userId);
+        const rl = checkRateLimit("generation", `adapt_content:${userId}`);
         if (!rl.allowed) {
           return {
             content: [
@@ -2407,11 +2734,12 @@ function buildCheckStatusPayload(job, liveStatus) {
   const progress = liveStatus?.progress ?? null;
   const resultUrl = liveStatus?.resultUrl ?? job.result_url ?? null;
   const r2Key = resultUrl && !resultUrl.startsWith("http") ? resultUrl : null;
-  const errorMessage = liveStatus?.error ?? job.error_message ?? null;
+  const rawError = liveStatus?.error ?? job.error_message ?? null;
+  const errorMessage = rawError && status === "failed" ? "Generation failed. Retry or choose another model." : rawError && (status === "cancelled" || status === "canceled") ? "Cancelled by user." : null;
   const allUrls = job.result_metadata?.all_urls ?? null;
   const modelRequested = job.result_metadata?.model_requested ?? null;
   const modelDelivered = job.result_metadata?.model_delivered ?? null;
-  const fallbackReason = job.result_metadata?.fallback_reason ?? null;
+  const fallbackReason = job.result_metadata?.fallback_reason ? "Requested model was unavailable; a fallback model was used." : null;
   return {
     job_id: job.id,
     job_type: job.job_type,
@@ -2423,6 +2751,11 @@ function buildCheckStatusPayload(job, liveStatus) {
     all_urls: allUrls,
     error: errorMessage,
     credits_cost: job.credits_cost,
+    credits_reserved: job.credits_reserved ?? null,
+    credits_charged: job.credits_charged ?? null,
+    credits_refunded: job.credits_refunded ?? null,
+    billing_status: job.billing_status ?? "unknown",
+    failure_reason: job.failure_reason ?? null,
     created_at: job.created_at,
     completed_at: job.completed_at,
     model_requested: modelRequested,
@@ -2512,6 +2845,13 @@ function checkAssetBudget(requestedCount = 1) {
 }
 
 // src/tools/content.ts
+function buildFallbackDisclosureLine(meta) {
+  const requested = meta?.model_requested;
+  const delivered = meta?.model_delivered;
+  if (!requested || !delivered || requested === delivered) return null;
+  const reason = meta?.fallback_reason ? " because the requested model was unavailable" : "";
+  return `Note: requested "${requested}" but delivered "${delivered}"${reason} \u2014 cost never exceeds the requested model's price.`;
+}
 function asEnvelope2(data) {
   return {
     _meta: {
@@ -2619,7 +2959,7 @@ function registerContentTools(server) {
           isError: true
         };
       }
-      const rateLimit = checkRateLimit("posting", `generate_video:${userId}`);
+      const rateLimit = checkRateLimit("generation", `generate_video:${userId}`);
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -2717,7 +3057,7 @@ function registerContentTools(server) {
   );
   server.tool(
     "generate_image",
-    "Start an async AI image generation job \u2014 returns a job_id immediately. Poll with check_status every 5-15s until complete. Costs 2-10 credits depending on model. Use for social media posts, carousel slides, or as input to generate_video (image-to-video).",
+    "Start an async AI image generation job \u2014 returns a job_id immediately. Poll with check_status every 5-15s until complete. Costs 15-50 credits depending on model. Use for social media posts, carousel slides, or as input to generate_video (image-to-video). Pass project_id so the asset is stored with the correct brand/project.",
     {
       prompt: z2.string().max(2e3).describe(
         "Text prompt describing the image to generate. Be specific about style, composition, colors, lighting, and subject matter."
@@ -2739,9 +3079,10 @@ function registerContentTools(server) {
       image_url: z2.string().optional().describe(
         "Reference image URL for image-to-image generation. Required for ideogram model. Optional for others."
       ),
+      project_id: z2.string().optional().describe("Project ID to associate the generated image with."),
       response_format: z2.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ prompt, model, aspect_ratio, image_url, response_format }) => {
+    async ({ prompt, model, aspect_ratio, image_url, project_id, response_format }) => {
       const format = response_format ?? "text";
       const userId = await getDefaultUserId();
       const assetBudget = checkAssetBudget();
@@ -2759,7 +3100,7 @@ function registerContentTools(server) {
           isError: true
         };
       }
-      const rateLimit = checkRateLimit("posting", `generate_image:${userId}`);
+      const rateLimit = checkRateLimit("generation", `generate_image:${userId}`);
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -2777,7 +3118,8 @@ function registerContentTools(server) {
           prompt,
           model,
           aspectRatio: aspect_ratio ?? "1:1",
-          imageUrl: image_url
+          imageUrl: image_url,
+          ...project_id && { projectId: project_id }
         },
         { timeoutMs: 3e4 }
       );
@@ -2816,7 +3158,8 @@ function registerContentTools(server) {
                   jobId,
                   taskId: data.taskId,
                   asyncJobId: data.asyncJobId,
-                  model: data.model
+                  model: data.model,
+                  projectId: project_id ?? null
                 }),
                 null,
                 2
@@ -2897,20 +3240,28 @@ function registerContentTools(server) {
           }
         );
         if (liveStatus) {
+          const livePayload = buildCheckStatusPayload(job, liveStatus);
           const lines2 = [
             `Job: ${job.id}`,
             `Type: ${job.job_type}`,
             `Model: ${job.model}`,
-            `Status: ${liveStatus.status}`,
-            `Progress: ${liveStatus.progress}%`
+            `Status: ${livePayload.status}`,
+            `Progress: ${livePayload.progress}%`
           ];
-          if (liveStatus.resultUrl) {
-            lines2.push(`Result URL: ${liveStatus.resultUrl}`);
+          if (livePayload.result_url) {
+            lines2.push(`Result URL: ${livePayload.result_url}`);
           }
-          if (liveStatus.error) {
-            lines2.push(`Error: ${liveStatus.error}`);
+          if (livePayload.error) {
+            lines2.push(`Error: ${livePayload.error}`);
           }
+          const fallbackDisclosure2 = buildFallbackDisclosureLine(job.result_metadata);
+          if (fallbackDisclosure2) lines2.push(fallbackDisclosure2);
           lines2.push(`Credits: ${job.credits_cost}`);
+          if (job.billing_status) {
+            lines2.push(
+              `Billing: ${job.billing_status} (charged ${job.credits_charged ?? 0}, refunded ${job.credits_refunded ?? 0})`
+            );
+          }
           lines2.push(`Created: ${job.created_at}`);
           if (format === "json") {
             return {
@@ -2928,7 +3279,7 @@ function registerContentTools(server) {
                     // `job` + `liveStatus`; do not duplicate them here.
                     asEnvelope2({
                       ...liveStatus,
-                      ...buildCheckStatusPayload(job, liveStatus)
+                      ...livePayload
                     }),
                     null,
                     2
@@ -2971,7 +3322,14 @@ function registerContentTools(server) {
       if (job.error_message) {
         lines.push(`Error: ${job.error_message}`);
       }
+      const fallbackDisclosure = buildFallbackDisclosureLine(job.result_metadata);
+      if (fallbackDisclosure) lines.push(fallbackDisclosure);
       lines.push(`Credits: ${job.credits_cost}`);
+      if (job.billing_status) {
+        lines.push(
+          `Billing: ${job.billing_status} (charged ${job.credits_charged ?? 0}, refunded ${job.credits_refunded ?? 0})`
+        );
+      }
       lines.push(`Created: ${job.created_at}`);
       if (job.completed_at) {
         lines.push(`Completed: ${job.completed_at}`);
@@ -2997,7 +3355,7 @@ function registerContentTools(server) {
   );
   server.tool(
     "create_storyboard",
-    "Plan a multi-scene video storyboard with AI-generated prompts, durations, captions, and voiceover text per frame. Use before generate_video or generate_image to create cohesive multi-shot content. Include brand_context from get_brand_profile for consistent visual branding across frames.",
+    "Plan a multi-scene video storyboard with AI-generated prompts, durations, captions, and voiceover text per frame. Use before generate_video or generate_image to create cohesive multi-shot content. Include brand_context from get_brand_profile and project_id for consistent, project-scoped production. Costs 10 credits.",
     {
       concept: z2.string().max(2e3).describe(
         'The video concept/idea. Include: hook, key messages, target audience, and desired outcome (e.g., "TikTok ad for VPN app targeting privacy-conscious millennials, hook with shocking stat about data leaks").'
@@ -3021,6 +3379,7 @@ function registerContentTools(server) {
       style: z2.string().optional().describe(
         'Visual style direction (e.g., "cinematic", "anime", "documentary", "motion graphics").'
       ),
+      project_id: z2.string().optional().describe("Project ID for brand-scoped generation and attribution."),
       response_format: z2.enum(["text", "json"]).optional().describe(
         "Response format. Defaults to json for structured storyboard data."
       )
@@ -3032,6 +3391,7 @@ function registerContentTools(server) {
       target_duration,
       num_scenes,
       style,
+      project_id,
       response_format
     }) => {
       const format = response_format ?? "json";
@@ -3114,7 +3474,8 @@ Return ONLY valid JSON in this exact format:
           prompt: storyboardPrompt,
           type: "storyboard",
           model: "gemini-2.5-flash",
-          responseFormat: "json"
+          responseFormat: "json",
+          ...project_id && { projectId: project_id }
         },
         { timeoutMs: 6e4 }
       );
@@ -3129,7 +3490,18 @@ Return ONLY valid JSON in this exact format:
           isError: true
         };
       }
-      const rawContent = data?.content ?? "";
+      const rawContent = data?.content?.trim() || data?.text?.trim() || "";
+      if (!rawContent) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "Storyboard generation failed: the AI service returned an empty response."
+            }
+          ],
+          isError: true
+        };
+      }
       addCreditsUsed(estimatedCost);
       if (format === "json") {
         try {
@@ -3165,16 +3537,17 @@ Return ONLY valid JSON in this exact format:
   );
   server.tool(
     "generate_voiceover",
-    "Generate a voiceover audio file for video narration. Returns an R2-hosted audio URL. Use after create_storyboard to add narration to each scene, or standalone for podcast intros and ad reads. Costs ~2 credits per generation.",
+    "Generate a voiceover audio file for video narration. Returns an R2-hosted audio URL. Use after create_storyboard to add narration to each scene, or standalone for podcast intros and ad reads. Pass project_id to keep the asset with the correct brand/project. Costs 15 credits per generation.",
     {
       text: z2.string().max(5e3).describe("The script/text to convert to speech."),
       voice: z2.enum(["rachel", "domi"]).optional().describe(
         "Voice selection. rachel=warm female, domi=confident female. Defaults to rachel."
       ),
       speed: z2.number().min(0.5).max(2).optional().describe("Speech speed multiplier. 1.0 is normal. Defaults to 1.0."),
+      project_id: z2.string().optional().describe("Project ID to associate the generated voiceover with."),
       response_format: z2.enum(["text", "json"]).optional().describe("Response format. Defaults to text.")
     },
-    async ({ text, voice, speed, response_format }) => {
+    async ({ text, voice, speed, project_id, response_format }) => {
       const format = response_format ?? "text";
       const userId = await getDefaultUserId();
       const estimatedCost = 15;
@@ -3186,7 +3559,7 @@ Return ONLY valid JSON in this exact format:
         };
       }
       const rateLimit = checkRateLimit(
-        "posting",
+        "generation",
         `generate_voiceover:${userId}`
       );
       if (!rateLimit.allowed) {
@@ -3209,7 +3582,8 @@ Return ONLY valid JSON in this exact format:
         {
           text,
           voiceId: ELEVENLABS_VOICE_IDS[voice ?? "rachel"],
-          speed: speed ?? 1
+          speed: speed ?? 1,
+          ...project_id && { projectId: project_id }
         },
         { timeoutMs: 6e4 }
       );
@@ -3245,7 +3619,8 @@ Return ONLY valid JSON in this exact format:
                 asEnvelope2({
                   audioUrl: data.audioUrl,
                   durationSeconds: data.durationSeconds,
-                  voice: voice ?? "rachel"
+                  voice: voice ?? "rachel",
+                  projectId: project_id ?? null
                 }),
                 null,
                 2
@@ -3351,7 +3726,7 @@ Return ONLY valid JSON in this exact format:
       }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit(
-        "posting",
+        "generation",
         `generate_carousel:${userId}`
       );
       if (!rateLimit.allowed) {
@@ -3453,7 +3828,7 @@ Return ONLY valid JSON in this exact format:
 
 // src/tools/distribution.ts
 import { z as z3 } from "zod";
-import { createHash as createHash2 } from "node:crypto";
+import { createHash } from "node:crypto";
 
 // src/lib/sanitize-error.ts
 var ERROR_PATTERNS = [
@@ -3492,9 +3867,6 @@ var ERROR_PATTERNS = [
 ];
 function sanitizeError(error) {
   const msg = error instanceof Error ? error.message : typeof error === "string" ? error : "Unknown error";
-  if (process.env.NODE_ENV !== "production") {
-    console.error("[Error]", msg);
-  }
   for (const [pattern, userMessage] of ERROR_PATTERNS) {
     if (pattern.test(msg)) {
       return userMessage;
@@ -3665,6 +4037,7 @@ function evaluateQuality(input) {
   const firstLine = caption.split("\n")[0]?.trim() ?? "";
   const hashtags = countHashtags(caption);
   const threshold = Math.min(35, Math.max(0, input.threshold ?? 26));
+  const isShortFormX = platforms.length > 0 && platforms.every((p) => p === "twitter") && caption.length <= 280;
   const blockedTerms = [
     ...(input.brandAvoidPatterns ?? []).map((t) => t.trim()).filter(Boolean),
     ...(input.customBannedTerms ?? []).map((t) => t.trim()).filter(Boolean)
@@ -3674,11 +4047,12 @@ function evaluateQuality(input) {
   if (firstLine.length >= 20 && firstLine.length <= 120) hookScore += 1;
   if (/[!?]/.test(firstLine) || /\b\d+(\.\d+)?\b/.test(firstLine)) hookScore += 1;
   if (/\b(how|why|stop|avoid|build|launch|scale|grow|mistake)\b/i.test(firstLine)) hookScore += 1;
+  if (isShortFormX) hookScore = Math.max(hookScore, 3);
   categories.push({
     name: "Hook Strength",
     score: Math.min(5, hookScore),
     maxScore: 5,
-    detail: "First line should create curiosity/value within 120 chars."
+    detail: isShortFormX ? "Short-form X: keyword-hook heuristics neutralized; substance judge arbitrates." : "First line should create curiosity/value within 120 chars."
   });
   let clarityScore = 2;
   if (caption.length >= 80 && caption.length <= 1200) clarityScore += 2;
@@ -3704,7 +4078,8 @@ function evaluateQuality(input) {
     detail: "Length, title, and hashtag usage should match target platforms."
   });
   let brandScore = 3;
-  const brandKeyword = input.brandKeyword ?? process.env.SOCIALNEURON_BRAND_KEYWORD?.trim();
+  const rawBrandKeyword = input.brandKeyword ?? process.env.SOCIALNEURON_BRAND_KEYWORD?.trim();
+  const brandKeyword = rawBrandKeyword ? rawBrandKeyword.slice(0, 80).replace(/[.*+?^${}()|[\]\\]/g, "\\$&") : null;
   if (brandKeyword && new RegExp("\\b" + brandKeyword + "\\b", "i").test(title + " " + caption))
     brandScore += 1;
   if (!/\b(you|your|customer|audience)\b/i.test(caption)) brandScore -= 1;
@@ -3715,11 +4090,12 @@ function evaluateQuality(input) {
       brandScore -= Math.min(2, matched.length);
     }
   }
+  if (isShortFormX) brandScore = Math.max(brandScore, 3);
   categories.push({
     name: "Brand Alignment",
     score: Math.max(0, Math.min(5, brandScore)),
     maxScore: 5,
-    detail: "Voice should match brand context and audience focus."
+    detail: isShortFormX ? "Short-form X: second-person-address heuristic neutralized; blocked terms still enforced." : "Voice should match brand context and audience focus."
   });
   let noveltyScore = 2;
   if (/\b(case study|framework|workflow|playbook|breakdown|behind the scenes)\b/i.test(caption))
@@ -3730,21 +4106,23 @@ function evaluateQuality(input) {
     const matched = blockedTerms.filter((term) => lowerCombined.includes(term.toLowerCase()));
     if (matched.length > 0) noveltyScore -= Math.min(2, matched.length);
   }
+  if (isShortFormX) noveltyScore = Math.max(noveltyScore, 3);
   categories.push({
     name: "Novelty",
     score: Math.max(0, Math.min(5, noveltyScore)),
     maxScore: 5,
-    detail: "Avoid generic phrasing; include distinct angle."
+    detail: isShortFormX ? "Short-form X: keyword-novelty neutralized; substance judge arbitrates." : "Avoid generic phrasing; include distinct angle."
   });
   let ctaScore = 2;
   if (/\b(comment|reply|share|save|follow|subscribe|click|try|book|download)\b/i.test(caption))
     ctaScore += 2;
   if (/\?$/.test(firstLine)) ctaScore += 1;
+  if (isShortFormX) ctaScore = Math.max(ctaScore, 3);
   categories.push({
     name: "CTA Strength",
     score: Math.min(5, ctaScore),
     maxScore: 5,
-    detail: "Should include a clear next action."
+    detail: isShortFormX ? "Short-form X: explicit CTA optional; native posts may close without one." : "Should include a clear next action."
   });
   let safetyScore = 5;
   if (/\b(guarantee|guaranteed|no risk|risk-free|always works|100%)\b/i.test(caption))
@@ -3802,7 +4180,9 @@ var PLATFORM_CASE_MAP = {
   threads: "Threads",
   bluesky: "Bluesky"
 };
-var TIKTOK_AUDIT_APPROVED = false;
+var TIKTOK_AUDIT_APPROVED = !["false", "0", "no"].includes(
+  (process.env.TIKTOK_AUDIT_APPROVED ?? "").toLowerCase()
+);
 var MCP_NOT_LIVE_FOR_POSTING = /* @__PURE__ */ new Set(["LinkedIn", "Pinterest", "Reddit"]);
 function asEnvelope3(data) {
   return {
@@ -3813,6 +4193,106 @@ function asEnvelope3(data) {
     data
   };
 }
+function publicConnectedAccount(value) {
+  if (!value || typeof value !== "object") return null;
+  const row = value;
+  if (typeof row.id !== "string" || typeof row.platform !== "string" || typeof row.status !== "string" || typeof row.created_at !== "string") {
+    return null;
+  }
+  return {
+    id: row.id,
+    platform: row.platform,
+    status: row.status,
+    ...typeof row.effective_status === "string" ? { effective_status: row.effective_status } : {},
+    username: typeof row.username === "string" ? row.username : null,
+    created_at: row.created_at,
+    ...typeof row.updated_at === "string" || row.updated_at === null ? { updated_at: row.updated_at } : {},
+    ...typeof row.expires_at === "string" || row.expires_at === null ? { expires_at: row.expires_at } : {},
+    ...typeof row.has_refresh_token === "boolean" ? { has_refresh_token: row.has_refresh_token } : {},
+    ...typeof row.project_id === "string" || row.project_id === null ? { project_id: row.project_id } : {}
+  };
+}
+function publicPostRecord(value) {
+  if (!value || typeof value !== "object") return null;
+  const row = value;
+  if (typeof row.id !== "string" || typeof row.platform !== "string" || typeof row.status !== "string" || typeof row.created_at !== "string") {
+    return null;
+  }
+  const nullableString = (field) => typeof row[field] === "string" ? row[field] : null;
+  return {
+    id: row.id,
+    platform: row.platform,
+    status: row.status,
+    title: nullableString("title"),
+    external_post_id: nullableString("external_post_id"),
+    published_at: nullableString("published_at"),
+    scheduled_at: nullableString("scheduled_at"),
+    created_at: row.created_at
+  };
+}
+var VIDEO_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
+  "mp4",
+  "mov",
+  "m4v",
+  "webm",
+  "avi",
+  "mkv",
+  "mpeg",
+  "mpg"
+]);
+var IMAGE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
+  "jpg",
+  "jpeg",
+  "png",
+  "webp",
+  "gif",
+  "avif",
+  "heic"
+]);
+function mediaTypeFromPath(value) {
+  try {
+    const pathname = value.startsWith("http") ? new URL(value).pathname : value;
+    const extension = pathname.split(".").pop()?.toLowerCase();
+    if (!extension) return null;
+    if (VIDEO_FILE_EXTENSIONS.has(extension)) return "VIDEO";
+    if (IMAGE_FILE_EXTENSIONS.has(extension)) return "IMAGE";
+  } catch {
+    return null;
+  }
+  return null;
+}
+function inferScheduleMediaType(explicit, singleCandidates, collectionCandidates) {
+  if (explicit) return explicit;
+  const populatedCollection = collectionCandidates.find(
+    (values) => Array.isArray(values) && values.length > 0
+  );
+  if (populatedCollection) {
+    if (populatedCollection.length > 1) return "CAROUSEL_ALBUM";
+    for (const values of collectionCandidates) {
+      if (!values || values.length !== 1) continue;
+      const inferred = mediaTypeFromPath(values[0]);
+      if (inferred) return inferred;
+    }
+    return null;
+  }
+  for (const value of singleCandidates) {
+    if (typeof value !== "string" || value.length === 0) continue;
+    const inferred = mediaTypeFromPath(value);
+    if (inferred) return inferred;
+  }
+  return null;
+}
+async function validatePublishMediaUrl(url) {
+  try {
+    if (new URL(url).protocol !== "https:") {
+      return "Media URLs must use HTTPS.";
+    }
+  } catch {
+    return "Media URL is invalid.";
+  }
+  const check = await validateUrlForSSRF(url);
+  return check.isValid ? null : check.error || "Media URL failed safety validation.";
+}
 function accountEffectiveStatus(account) {
   return account.effective_status || account.status;
 }
@@ -3831,22 +4311,11 @@ function requestedAccountIdForPlatform(accountId, accountIds, platform2) {
   if (!accountIds) return void 0;
   return accountIds[platform2] || accountIds[platform2.toLowerCase()];
 }
-function isAlreadyR2Signed(url) {
-  try {
-    const u = new URL(url);
-    return u.searchParams.has("X-Amz-Signature");
-  } catch {
-    return false;
-  }
-}
 async function rehostExternalUrl(mediaUrl, projectId) {
   const ssrf = await validateUrlForSSRF(mediaUrl);
   if (!ssrf.isValid) {
     return { error: ssrf.error ?? "URL rejected by SSRF check" };
   }
-  if (isAlreadyR2Signed(mediaUrl)) {
-    return { signedUrl: mediaUrl, r2Key: "" };
-  }
   const { data, error } = await callEdgeFunction(
     "upload-to-r2",
     { url: ssrf.sanitizedUrl ?? mediaUrl, projectId },
@@ -3865,19 +4334,19 @@ function registerDistributionTools(server) {
       media_url: z3.string().optional().describe(
         "URL of the media file to post. Any public HTTPS URL works \u2014 including ephemeral generator URLs (Replicate, OpenAI, DALL-E). The server persists non-R2 URLs into R2 before posting so scheduled posts and byte-upload platforms (X, LinkedIn, YouTube, Bluesky) do not 404 when the source URL expires. Set auto_rehost=false to skip. Not needed if media_urls, r2_key, or job_id is provided."
       ),
-      media_urls: z3.array(z3.string()).optional().describe(
+      media_urls: z3.array(z3.string().url()).min(2).max(10).optional().describe(
         "Array of 2-10 image URLs for carousel posts. Same rehosting rules as media_url \u2014 ephemeral URLs are persisted automatically. Use with media_type=CAROUSEL_ALBUM."
       ),
       r2_key: z3.string().optional().describe(
         "R2 object key from upload_media. Signed on demand at post time \u2014 survives scheduling delays. Alternative to media_url."
       ),
-      r2_keys: z3.array(z3.string()).optional().describe(
+      r2_keys: z3.array(z3.string()).min(2).max(10).optional().describe(
         "Array of R2 object keys for carousel posts. Each is signed on demand. Alternative to media_urls."
       ),
       job_id: z3.string().optional().describe(
         "Async job ID from generate_image/generate_video. Resolves the completed job's R2 key and signs it. Alternative to media_url/r2_key."
       ),
-      job_ids: z3.array(z3.string()).optional().describe(
+      job_ids: z3.array(z3.string()).min(2).max(10).optional().describe(
         "Array of async job IDs for carousel posts. Each resolved to its R2 key. Alternative to media_urls/r2_keys."
       ),
       platform_metadata: z3.object({
@@ -3907,7 +4376,10 @@ function registerDistributionTools(server) {
           category_id: z3.string().optional(),
           tags: z3.array(z3.string()).optional(),
           made_for_kids: z3.boolean().optional(),
-          notify_subscribers: z3.boolean().optional()
+          notify_subscribers: z3.boolean().optional(),
+          contains_synthetic_media: z3.boolean().optional().describe(
+            "YouTube altered-or-synthetic-content disclosure. Defaults to true for MCP posts; set false explicitly for verified non-AI media."
+          )
         }).optional(),
         facebook: z3.object({
           page_id: z3.string().optional().describe("Facebook Page ID to post to."),
@@ -3990,14 +4462,8 @@ function registerDistributionTools(server) {
       auto_rehost: z3.boolean().optional().describe(
         "Whether to persist non-R2 media_url/media_urls into R2 before posting. Default: true. Set to false only if you know the source URL will outlive the scheduling window and every target platform supports URL ingest."
       ),
-      visual_gate_result: z3.object({ passed: z3.boolean() }).passthrough().optional().describe(
-        "Visual QA gate verdict from the carousel/image generation pipeline. Required when mediaType is CAROUSEL_ALBUM, IMAGE, or VIDEO and VISUAL_GATE_ENFORCE is enabled on the EF. Produce with visual_quality_check tool. Must have passed=true for the gate to allow the publish."
-      ),
-      origin: z3.enum(["human", "hermes", "user"]).optional().describe(
-        "Originator lineage for the post. Marks who scheduled it; use the agent value when calling from an autonomous workflow, otherwise default 'human'."
-      ),
-      hermes_run_id: z3.string().optional().describe(
-        "Optional agent run identifier for traceability between a draft and the run that produced it."
+      idempotency_key: z3.string().regex(/^[a-zA-Z0-9_-]{8,128}$/).optional().describe(
+        "Stable 8-128 character retry key (letters, numbers, underscore, hyphen). Reuse the same key when retrying the same publish request to prevent duplicate posts."
       )
     },
     async ({
@@ -4020,9 +4486,7 @@ function registerDistributionTools(server) {
       platform_metadata,
       account_id,
       account_ids,
-      visual_gate_result,
-      origin,
-      hermes_run_id
+      idempotency_key
     }) => {
       const format = response_format ?? "text";
       if ((!caption || caption.trim().length === 0) && (!title || title.trim().length === 0)) {
@@ -4051,6 +4515,8 @@ function registerDistributionTools(server) {
       }
       let resolvedMediaUrl = media_url;
       let resolvedMediaUrls = media_urls;
+      let resolvedMediaUrlIsTrustedR2 = false;
+      let resolvedMediaUrlsAreTrustedR2 = (media_urls ?? []).map(() => false);
       const signR2Key = async (key) => {
         const cleanKey = key.startsWith("r2://") ? key.slice(5) : key;
         const { data: signData } = await callEdgeFunction(
@@ -4068,8 +4534,11 @@ function registerDistributionTools(server) {
         );
         const resultUrl = jobData?.job?.result_url;
         if (!resultUrl) return null;
-        if (!resultUrl.startsWith("http")) return signR2Key(resultUrl);
-        return resultUrl;
+        if (!resultUrl.startsWith("http")) {
+          const signed = await signR2Key(resultUrl);
+          return signed ? { url: signed, trustedR2: true } : null;
+        }
+        return { url: resultUrl, trustedR2: false };
       };
       try {
         if (r2_key && !resolvedMediaUrl) {
@@ -4086,6 +4555,7 @@ function registerDistributionTools(server) {
             };
           }
           resolvedMediaUrl = signed;
+          resolvedMediaUrlIsTrustedR2 = true;
         } else if (job_id && !resolvedMediaUrl && !r2_key) {
           const resolved = await resolveJobId(job_id);
           if (!resolved) {
@@ -4099,7 +4569,8 @@ function registerDistributionTools(server) {
               isError: true
             };
           }
-          resolvedMediaUrl = resolved;
+          resolvedMediaUrl = resolved.url;
+          resolvedMediaUrlIsTrustedR2 = resolved.trustedR2;
         }
         if (r2_keys && r2_keys.length > 0 && !resolvedMediaUrls) {
           const signed = await Promise.all(r2_keys.map(signR2Key));
@@ -4116,6 +4587,7 @@ function registerDistributionTools(server) {
             };
           }
           resolvedMediaUrls = signed;
+          resolvedMediaUrlsAreTrustedR2 = signed.map(() => true);
         } else if (job_ids && job_ids.length > 0 && !resolvedMediaUrls && !r2_keys) {
           const resolved = await Promise.all(job_ids.map(resolveJobId));
           const failIdx = resolved.findIndex((r) => !r);
@@ -4130,10 +4602,12 @@ function registerDistributionTools(server) {
               isError: true
             };
           }
-          resolvedMediaUrls = resolved;
+          const resolvedJobs = resolved;
+          resolvedMediaUrls = resolvedJobs.map((item) => item.url);
+          resolvedMediaUrlsAreTrustedR2 = resolvedJobs.map((item) => item.trustedR2);
         }
         const shouldRehost = auto_rehost !== false;
-        if (shouldRehost && resolvedMediaUrl) {
+        if (shouldRehost && resolvedMediaUrl && !resolvedMediaUrlIsTrustedR2) {
           const rehost = await rehostExternalUrl(resolvedMediaUrl, project_id);
           if ("error" in rehost) {
             return {
@@ -4147,10 +4621,13 @@ function registerDistributionTools(server) {
             };
           }
           resolvedMediaUrl = rehost.signedUrl;
+          resolvedMediaUrlIsTrustedR2 = true;
         }
         if (shouldRehost && resolvedMediaUrls && resolvedMediaUrls.length > 0) {
           const rehosted = await Promise.all(
-            resolvedMediaUrls.map((u) => rehostExternalUrl(u, project_id))
+            resolvedMediaUrls.map(
+              (u, index) => resolvedMediaUrlsAreTrustedR2[index] ? Promise.resolve({ signedUrl: u, r2Key: "" }) : rehostExternalUrl(u, project_id)
+            )
           );
           const failIdx = rehosted.findIndex((r) => "error" in r);
           if (failIdx !== -1) {
@@ -4166,6 +4643,7 @@ function registerDistributionTools(server) {
             };
           }
           resolvedMediaUrls = rehosted.map((r) => r.signedUrl);
+          resolvedMediaUrlsAreTrustedR2 = resolvedMediaUrls.map(() => true);
         }
       } catch (resolveErr) {
         return {
@@ -4178,6 +4656,42 @@ function registerDistributionTools(server) {
           isError: true
         };
       }
+      const hasResolvedMedia = Boolean(
+        resolvedMediaUrl || resolvedMediaUrls && resolvedMediaUrls.length > 0
+      );
+      const resolvedMediaType = inferScheduleMediaType(
+        media_type,
+        [resolvedMediaUrl, r2_key],
+        [resolvedMediaUrls, r2_keys]
+      );
+      if (hasResolvedMedia && !resolvedMediaType) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "media_type is required when the media format cannot be inferred from a file extension. Set IMAGE, VIDEO, or CAROUSEL_ALBUM explicitly."
+            }
+          ],
+          isError: true
+        };
+      }
+      const finalUrls = [resolvedMediaUrl, ...resolvedMediaUrls ?? []].filter(
+        (value) => typeof value === "string" && value.length > 0
+      );
+      for (const url of finalUrls) {
+        const validationError = await validatePublishMediaUrl(url);
+        if (validationError) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Media URL blocked: ${validationError}`
+              }
+            ],
+            isError: true
+          };
+        }
+      }
       const normalizedPlatforms = platforms.map(
         (p) => PLATFORM_CASE_MAP[p.toLowerCase()] || p
       );
@@ -4303,12 +4817,32 @@ Created with Social Neuron`;
         };
         return true;
       })();
+      const defaultAiDisclosure = (platformKey, field) => {
+        const existing = normalizedPlatformMetadata?.[platformKey];
+        if (existing && existing[field] !== void 0) return;
+        normalizedPlatformMetadata = {
+          ...normalizedPlatformMetadata ?? {},
+          [platformKey]: {
+            ...existing ?? {},
+            [field]: true
+          }
+        };
+      };
+      if (normalizedPlatforms.includes("TikTok")) {
+        defaultAiDisclosure("tiktok", "is_ai_generated");
+      }
+      if (normalizedPlatforms.includes("Instagram")) {
+        defaultAiDisclosure("instagram", "is_ai_generated");
+      }
+      if (normalizedPlatforms.includes("YouTube")) {
+        defaultAiDisclosure("youtube", "contains_synthetic_media");
+      }
       const { data, error } = await callEdgeFunction(
         "schedule-post",
         {
           mediaUrl: resolvedMediaUrl,
           mediaUrls: resolvedMediaUrls,
-          mediaType: media_type,
+          mediaType: resolvedMediaType ?? void 0,
           caption: finalCaption,
           platforms: normalizedPlatforms,
           title,
@@ -4321,14 +4855,10 @@ Created with Social Neuron`;
               normalizedPlatformMetadata
             )
           } : {},
-          // Forward visual gate verdict + source so the EF can enforce on media posts.
-          ...visual_gate_result ? { visualGateResult: visual_gate_result } : {},
-          visualGateSource: "mcp",
-          // Originator lineage (Hermes integration, 2026-05-22). EF validates origin
-          // against the posts.origin CHECK constraint and persists hermesRunId when
-          // origin === 'hermes'.
-          ...origin ? { origin } : {},
-          ...hermes_run_id ? { hermesRunId: hermes_run_id } : {}
+          ...idempotency_key ? { idempotencyKey: idempotency_key } : {}
+          // Attribution is assigned by the authenticated gateway. Visual QA
+          // attestations are server-produced evidence and are deliberately not
+          // accepted from an MCP caller.
         },
         { timeoutMs: 3e4 }
       );
@@ -4395,76 +4925,173 @@ Created with Social Neuron`;
     }
   );
   server.tool(
-    "list_connected_accounts",
-    "Check which social platforms have active OAuth connections for posting. Call this before schedule_post to verify credentials. Pass project_id to list the accounts for a specific brand/project, then pass the returned account id as account_id/account_ids when posting. If a platform is missing or expired, the user needs to reconnect at socialneuron.com/settings/connections.",
+    "reschedule_post",
+    "Move an existing pending or scheduled post to a new future time without creating a duplicate. Pass project_id for the post's brand. expected_scheduled_at is recommended: it prevents overwriting a change made in another client after the calendar was loaded.",
     {
-      project_id: z3.string().optional().describe(
-        "Brand/project ID to scope connected accounts. Use the same project_id when calling schedule_post."
+      post_id: z3.string().uuid().describe("Post ID returned by list_recent_posts."),
+      project_id: z3.string().uuid().optional().describe(
+        "Brand/project ID that owns the post. Defaults to the authenticated key's project or the account default."
       ),
-      include_all: z3.boolean().optional().describe("If true, include expired or inactive accounts as well as usable accounts."),
-      response_format: z3.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
+      scheduled_at: z3.string().datetime({ offset: true }).describe("New future publish time as an ISO 8601 datetime with timezone."),
+      expected_scheduled_at: z3.string().datetime({ offset: true }).optional().describe(
+        "Optional current schedule timestamp. If it changed since you read it, the update is rejected instead of silently overwriting it."
+      ),
+      response_format: z3.enum(["text", "json"]).default("text")
     },
-    async ({ project_id, include_all, response_format }) => {
-      const format = response_format ?? "text";
-      const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
-        action: "connected-accounts",
-        ...project_id ? { projectId: project_id, project_id } : {},
-        ...include_all ? { includeAll: true } : {}
-      });
-      if (efError || !result?.success) {
+    async ({
+      post_id,
+      project_id,
+      scheduled_at,
+      expected_scheduled_at,
+      response_format
+    }) => {
+      const next = new Date(scheduled_at);
+      if (!Number.isFinite(next.getTime()) || next.getTime() <= Date.now()) {
         return {
           content: [
             {
               type: "text",
-              text: `Failed to list connected accounts: ${efError || result?.error || "Unknown error"}`
+              text: "scheduled_at must be a valid future ISO datetime with timezone."
             }
           ],
           isError: true
         };
       }
-      const accounts = result.accounts ?? [];
-      if (accounts.length === 0) {
-        if (format === "json") {
-          return {
-            content: [
-              {
-                type: "text",
-                text: JSON.stringify(asEnvelope3({ accounts: [] }), null, 2)
-              }
-            ]
-          };
-        }
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      if (!resolvedProjectId) {
         return {
           content: [
             {
               type: "text",
-              text: "No connected social media accounts found. Connect platforms in Social Neuron Settings > Connections."
+              text: "No project_id was provided and no default project is configured."
             }
-          ]
+          ],
+          isError: true
         };
       }
-      const lines = [
-        `${accounts.length} connected account(s)${project_id ? ` for project ${project_id}` : ""}:`,
-        ""
-      ];
-      for (const account of accounts) {
-        const name = account.username || "(unnamed)";
-        const platformLower = account.platform.toLowerCase();
-        const project = account.project_id ? `project_id=${account.project_id}` : "project_id=unassigned";
-        const status = accountEffectiveStatus(account);
-        lines.push(
-          `  ${platformLower}: ${name} | id=${account.id} | ${project} | status=${status} (connected ${account.created_at.split("T")[0]})`
-        );
-      }
-      if (format === "json") {
+      const userId = await getDefaultUserId();
+      const rateLimit = checkRateLimit("posting", `reschedule_post:${userId}`);
+      if (!rateLimit.allowed) {
         return {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope3({ accounts }), null, 2)
+              text: `Rate limit exceeded. Retry in ~${rateLimit.retryAfter}s.`
             }
-          ]
-        };
+          ],
+          isError: true
+        };
+      }
+      const { data: result, error } = await callEdgeFunction("mcp-data", {
+        action: "reschedule-scheduled-post",
+        post_id,
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId,
+        scheduled_at: next.toISOString(),
+        ...expected_scheduled_at ? { expected_scheduled_at: new Date(expected_scheduled_at).toISOString() } : {}
+      });
+      if (error || !result?.success) {
+        const code = result?.error ?? error ?? "reschedule_failed";
+        const recovery = code === "publishing_in_progress" ? "The worker has already started publishing this post." : code === "schedule_conflict" ? `The schedule changed in another client${result?.current_scheduled_at ? ` to ${result.current_scheduled_at}` : ""}; refresh the calendar before retrying.` : code === "not_found" ? "The post was not found in this project." : code === "not_reschedulable" ? `This post can no longer be rescheduled${result?.status ? ` (status: ${result.status})` : ""}.` : "The post could not be rescheduled.";
+        return {
+          content: [{ type: "text", text: recovery }],
+          isError: true
+        };
+      }
+      const publicResult = {
+        success: true,
+        post_id: result.post_id ?? post_id,
+        project_id: result.project_id ?? resolvedProjectId,
+        previous_scheduled_at: result.previous_scheduled_at ?? null,
+        scheduled_at: result.scheduled_at ?? next.toISOString()
+      };
+      const structuredContent = asEnvelope3(publicResult);
+      return {
+        structuredContent,
+        content: [
+          {
+            type: "text",
+            text: response_format === "json" ? JSON.stringify(structuredContent, null, 2) : `Post ${publicResult.post_id} rescheduled to ${publicResult.scheduled_at}.`
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "list_connected_accounts",
+    "Check which social platforms have active OAuth connections for posting. Call this before schedule_post to verify credentials. Pass project_id to list the accounts for a specific brand/project, then pass the returned account id as account_id/account_ids when posting. If a platform is missing or expired, the user needs to reconnect at socialneuron.com/settings/connections.",
+    {
+      project_id: z3.string().optional().describe(
+        "Brand/project ID to scope connected accounts. Use the same project_id when calling schedule_post."
+      ),
+      include_all: z3.boolean().optional().describe("If true, include expired or inactive accounts as well as usable accounts."),
+      response_format: z3.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
+    },
+    async ({ project_id, include_all, response_format }) => {
+      const format = response_format ?? "text";
+      const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
+        action: "connected-accounts",
+        ...project_id ? { projectId: project_id, project_id } : {},
+        ...include_all ? { includeAll: true } : {}
+      });
+      if (efError || !result?.success) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Failed to list connected accounts: ${efError || result?.error || "Unknown error"}`
+            }
+          ],
+          isError: true
+        };
+      }
+      const accounts = (result.accounts ?? []).map(publicConnectedAccount).filter((account) => account !== null);
+      if (accounts.length === 0) {
+        if (format === "json") {
+          const structuredContent = asEnvelope3({ accounts: [] });
+          return {
+            structuredContent,
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(structuredContent, null, 2)
+              }
+            ]
+          };
+        }
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No connected social media accounts found. Connect platforms in Social Neuron Settings > Connections."
+            }
+          ]
+        };
+      }
+      const lines = [
+        `${accounts.length} connected account(s)${project_id ? ` for project ${project_id}` : ""}:`,
+        ""
+      ];
+      for (const account of accounts) {
+        const name = account.username || "(unnamed)";
+        const platformLower = account.platform.toLowerCase();
+        const project = account.project_id ? `project_id=${account.project_id}` : "project_id=unassigned";
+        const status = accountEffectiveStatus(account);
+        lines.push(
+          `  ${platformLower}: ${name} | id=${account.id} | ${project} | status=${status} (connected ${account.created_at.split("T")[0]})`
+        );
+      }
+      if (format === "json") {
+        const structuredContent = asEnvelope3({ accounts });
+        return {
+          structuredContent,
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(structuredContent, null, 2)
+            }
+          ]
+        };
       }
       return {
         content: [{ type: "text", text: lines.join("\n") }]
@@ -4475,6 +5102,9 @@ Created with Social Neuron`;
     "list_recent_posts",
     "List recent published and scheduled posts with status, platform, title, and timestamps. Use to check what has been posted before planning new content, or to find post IDs for fetch_analytics. Filter by platform or status to narrow results.",
     {
+      project_id: z3.string().uuid().optional().describe(
+        "Brand/project ID to scope posts. Defaults to the authenticated key's project or the account default."
+      ),
       platform: z3.enum([
         "youtube",
         "tiktok",
@@ -4490,13 +5120,27 @@ Created with Social Neuron`;
       limit: z3.number().min(1).max(50).optional().describe("Maximum number of posts to return. Defaults to 20."),
       response_format: z3.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ platform: platform2, status, days, limit, response_format }) => {
+    async ({ project_id, platform: platform2, status, days, limit, response_format }) => {
       const format = response_format ?? "text";
       const lookbackDays = days ?? 7;
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      if (!resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No project_id was provided and no default project is configured."
+            }
+          ],
+          isError: true
+        };
+      }
       const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
         action: "recent-posts",
         days: lookbackDays,
         limit: limit ?? 20,
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId,
         ...platform2 ? { platform: platform2 } : {},
         ...status ? { status } : {}
       });
@@ -4511,7 +5155,7 @@ Created with Social Neuron`;
           isError: true
         };
       }
-      const rows = result.posts ?? [];
+      const rows = (result.posts ?? []).map(publicPostRecord).filter((post) => post !== null);
       if (rows.length === 0) {
         if (format === "json") {
           const structuredContent2 = asEnvelope3({ posts: [] });
@@ -4586,8 +5230,11 @@ Created with Social Neuron`;
   };
   server.tool(
     "find_next_slots",
-    "Find optimal posting time slots based on best posting times and existing schedule. Returns non-conflicting slots sorted by engagement score.",
+    "Find optimal posting time slots for one brand/project based on preferred posting times and that project's existing schedule. Returns non-conflicting slots sorted by engagement score.",
     {
+      project_id: z3.string().uuid().optional().describe(
+        "Brand/project ID used for conflict detection. Defaults to the authenticated key's project or the account default."
+      ),
       platforms: z3.array(
         z3.enum([
           "youtube",
@@ -4606,6 +5253,7 @@ Created with Social Neuron`;
       response_format: z3.enum(["text", "json"]).default("text")
     },
     async ({
+      project_id,
       platforms,
       count,
       start_after,
@@ -4613,13 +5261,35 @@ Created with Social Neuron`;
       response_format
     }) => {
       try {
+        const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+        if (!resolvedProjectId) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: "No project_id was provided and no default project is configured."
+              }
+            ],
+            isError: true
+          };
+        }
         const startDate = start_after ? new Date(start_after) : /* @__PURE__ */ new Date();
+        if (!Number.isFinite(startDate.getTime())) {
+          return {
+            content: [
+              { type: "text", text: "start_after must be a valid ISO datetime." }
+            ],
+            isError: true
+          };
+        }
         const endDate = new Date(startDate.getTime() + 7 * 24 * 60 * 60 * 1e3);
         const { data: postsResult, error: postsError } = await callEdgeFunction("mcp-data", {
           action: "scheduled-posts",
           start_date: startDate.toISOString(),
           end_date: endDate.toISOString(),
-          statuses: ["scheduled", "draft"]
+          statuses: ["pending", "scheduled", "draft"],
+          projectId: resolvedProjectId,
+          project_id: resolvedProjectId
         });
         const existingPosts = postsError ? [] : postsResult?.posts ?? [];
         const gapMs = min_gap_hours * 60 * 60 * 1e3;
@@ -4659,19 +5329,17 @@ Created with Social Neuron`;
         const slots = candidates.filter((s) => !s.conflict).sort((a, b) => b.engagement_score - a.engagement_score).slice(0, count);
         const conflictsAvoided = candidates.filter((s) => s.conflict).length;
         if (response_format === "json") {
+          const structuredContent = asEnvelope3({
+            slots,
+            total_candidates: candidates.length,
+            conflicts_avoided: conflictsAvoided
+          });
           return {
+            structuredContent,
             content: [
               {
                 type: "text",
-                text: JSON.stringify(
-                  asEnvelope3({
-                    slots,
-                    total_candidates: candidates.length,
-                    conflicts_avoided: conflictsAvoided
-                  }),
-                  null,
-                  2
-                )
+                text: JSON.stringify(structuredContent, null, 2)
               }
             ],
             isError: false
@@ -5036,7 +5704,7 @@ Created with Social Neuron`;
         const results = [];
         const buildIdempotencyKey = (post) => {
           const planId = effectivePlanId ?? (typeof workingPlan.plan_id === "string" ? String(workingPlan.plan_id) : "inline");
-          const captionHash = createHash2("sha256").update(post.caption).digest("hex").slice(0, 16);
+          const captionHash = createHash("sha256").update(post.caption).digest("hex").slice(0, 16);
           const raw = [
             "schedule_content_plan",
             planId,
@@ -5046,7 +5714,7 @@ Created with Social Neuron`;
             captionHash,
             idempotency_seed ?? ""
           ].join(":");
-          return `plan-${createHash2("sha256").update(raw).digest("hex").slice(0, 48)}`;
+          return `plan-${createHash("sha256").update(raw).digest("hex").slice(0, 48)}`;
         };
         const scheduleOne = async (post) => {
           if (!post.schedule_at) {
@@ -5525,7 +6193,10 @@ function registerMediaTools(server) {
                 content: [
                   {
                     type: "text",
-                    text: `R2 upload failed (HTTP ${putResp.status}): ${await putResp.text().catch(() => "Unknown error")}`
+                    // Presigned-store bodies may include provider request IDs,
+                    // bucket names, or signed URL fragments. Status is enough
+                    // for user recovery and safe diagnostics.
+                    text: `R2 upload failed (HTTP ${putResp.status}). Please retry.`
                   }
                 ],
                 isError: true
@@ -5713,7 +6384,7 @@ function asEnvelope4(data) {
 function registerAnalyticsTools(server) {
   server.tool(
     "fetch_analytics",
-    "Get post performance metrics \u2014 views, likes, comments, shares, and engagement rate. Filter by platform, time range (default 30 days), or specific content_id. Call refresh_platform_analytics first if data seems stale. Results sorted by most recent capture.",
+    "Get project-scoped post performance metrics \u2014 views, likes, comments, shares, and engagement rate. Filter by platform, time range (default 30 days), or specific content_id. Call refresh_platform_analytics first if data seems stale. Results sorted by most recent capture.",
     {
       platform: z5.enum([
         "youtube",
@@ -5731,19 +6402,26 @@ function registerAnalyticsTools(server) {
       content_id: z5.string().uuid().optional().describe(
         "Filter to a specific content_history ID to see performance of one piece of content."
       ),
+      project_id: z5.string().optional().describe("Project ID. Defaults to the active project context."),
       limit: z5.number().min(1).max(100).optional().describe("Maximum number of posts to return. Defaults to 20."),
       response_format: z5.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ platform: platform2, days, content_id, limit, response_format }) => {
+    async ({ platform: platform2, days, content_id, project_id, limit, response_format }) => {
       const format = response_format ?? "text";
       const lookbackDays = days ?? 30;
       const maxPosts = limit ?? 20;
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
       const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
         action: "analytics",
         platform: platform2,
         days: lookbackDays,
-        limit: maxPosts,
-        contentId: content_id
+        // Fetch extra snapshots, then deduplicate to the requested post count.
+        // The backend understands latestOnly after the paired application
+        // deployment; older deployments safely ignore the hint.
+        limit: Math.min(maxPosts * 5, 100),
+        latestOnly: true,
+        contentId: content_id,
+        ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
       });
       if (efError) {
         return {
@@ -5751,7 +6429,14 @@ function registerAnalyticsTools(server) {
           isError: true
         };
       }
-      const rows = result?.rows ?? [];
+      const snapshotRows = result?.rows ?? [];
+      const seenSnapshots = /* @__PURE__ */ new Set();
+      const rows = [...snapshotRows].sort((a, b) => b.captured_at.localeCompare(a.captured_at)).filter((row) => {
+        const key = `${row.post_id}:${row.platform.toLowerCase()}`;
+        if (seenSnapshots.has(key)) return false;
+        seenSnapshots.add(key);
+        return true;
+      }).slice(0, maxPosts);
       if (rows.length === 0) {
         if (format === "json") {
           const structuredContent = asEnvelope4({
@@ -5813,14 +6498,19 @@ function registerAnalyticsTools(server) {
   );
   server.tool(
     "refresh_platform_analytics",
-    "Queue analytics refresh jobs for all posts from the last 7 days across connected platforms. Call this before fetch_analytics if you need fresh data. Returns immediately \u2014 data updates asynchronously over the next 1-5 minutes.",
+    "Queue analytics refresh jobs for posts from the last 7 days in one project across its connected platforms. Call this before fetch_analytics if you need fresh data. Returns immediately \u2014 data updates asynchronously over the next 1-5 minutes.",
     {
+      project_id: z5.string().optional().describe("Project ID. Defaults to the active project context."),
       response_format: z5.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ response_format }) => {
+    async ({ project_id, response_format }) => {
       const format = response_format ?? "text";
       const userId = await getDefaultUserId();
-      const rateLimit = checkRateLimit("posting", `refresh_platform_analytics:${userId}`);
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      const rateLimit = checkRateLimit(
+        "posting",
+        `refresh_platform_analytics:${userId}:${resolvedProjectId ?? "default"}`
+      );
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -5832,7 +6522,10 @@ function registerAnalyticsTools(server) {
           isError: true
         };
       }
-      const { data, error } = await callEdgeFunction("fetch-analytics", { userId });
+      const { data, error } = await callEdgeFunction("fetch-analytics", {
+        userId,
+        ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+      });
       if (error) {
         return {
           content: [{ type: "text", text: `Error refreshing analytics: ${error}` }],
@@ -5861,7 +6554,8 @@ function registerAnalyticsTools(server) {
           success: true,
           postsProcessed: result.postsProcessed,
           queued,
-          errored
+          errored,
+          projectId: resolvedProjectId ?? null
         });
         return {
           structuredContent,
@@ -5915,6 +6609,80 @@ function formatAnalytics(summary, days, format) {
 // src/tools/brand.ts
 import { z as z6 } from "zod";
 init_supabase();
+
+// src/lib/brandUrlInput.ts
+var PLATFORM_ALIASES = {
+  instagram: "instagram",
+  ig: "instagram",
+  insta: "instagram",
+  tiktok: "tiktok",
+  tt: "tiktok",
+  twitter: "twitter",
+  x: "twitter",
+  linkedin: "linkedin",
+  li: "linkedin",
+  youtube: "youtube",
+  yt: "youtube"
+};
+var PROFILE_URL_BUILDERS = {
+  instagram: (handle) => `https://instagram.com/${encodeURIComponent(handle)}`,
+  tiktok: (handle) => `https://tiktok.com/@${encodeURIComponent(handle)}`,
+  twitter: (handle) => `https://x.com/${encodeURIComponent(handle)}`,
+  linkedin: (handle) => `https://linkedin.com/company/${encodeURIComponent(handle)}`,
+  youtube: (handle) => `https://youtube.com/@${encodeURIComponent(handle)}`
+};
+var UNICODE_DOT_VARIANTS = /[。．｡]/g;
+function canonicalizeHost(hostname) {
+  return hostname.replace(UNICODE_DOT_VARIANTS, ".").replace(/\.+$/, "");
+}
+function hostLooksLikeDomain(hostname) {
+  return /\S+\.\S+/.test(canonicalizeHost(hostname));
+}
+function resolveHandle(handle, platform2) {
+  const normalized = handle.replace(/^@/, "").trim();
+  if (!normalized) return { url: null, handle: null, platform: null, ambiguous: false };
+  if (!platform2) return { url: null, handle: normalized, platform: null, ambiguous: true };
+  return {
+    url: PROFILE_URL_BUILDERS[platform2](normalized),
+    handle: normalized,
+    platform: platform2,
+    ambiguous: false
+  };
+}
+function normalizeBrandUrlInput(raw, explicitPlatform) {
+  const input = (raw ?? "").trim();
+  if (!input) return { url: null, handle: null, platform: null, ambiguous: false };
+  if (/^https?:\/\//i.test(input)) {
+    let parsed;
+    try {
+      parsed = new URL(input);
+    } catch {
+      return { url: null, handle: null, platform: null, ambiguous: false, invalidUrl: true };
+    }
+    if (hostLooksLikeDomain(parsed.hostname)) {
+      return { url: parsed.toString(), handle: null, platform: null, ambiguous: false };
+    }
+    return resolveHandle(canonicalizeHost(parsed.hostname), explicitPlatform);
+  }
+  const qualified = input.match(/^([a-z]{1,10}):\s*@?(.+)$/i);
+  if (qualified) {
+    const platform2 = PLATFORM_ALIASES[qualified[1].toLowerCase()];
+    if (platform2) return resolveHandle(qualified[2], platform2);
+  }
+  if (input.startsWith("@")) return resolveHandle(input, explicitPlatform);
+  if (!/\s/.test(input)) {
+    try {
+      const parsed = new URL(`https://${input}`);
+      if (hostLooksLikeDomain(parsed.hostname)) {
+        return { url: parsed.toString(), handle: null, platform: null, ambiguous: false };
+      }
+    } catch {
+    }
+  }
+  return resolveHandle(input.replace(UNICODE_DOT_VARIANTS, ".").replace(/\.+$/, ""), explicitPlatform);
+}
+
+// src/tools/brand.ts
 function asEnvelope5(data) {
   return {
     _meta: {
@@ -5929,12 +6697,31 @@ function registerBrandTools(server) {
     "extract_brand",
     "Analyze a website URL and extract brand identity data including brand name, colors, voice/tone, target audience, and logo. Uses AI-powered analysis of the page HTML. Useful for understanding a brand before generating content for it.",
     {
-      url: z6.string().url().describe(
-        'The website URL to analyze for brand identity (e.g. "https://example.com").'
+      url: z6.string().min(1).max(2048).describe(
+        'The website URL to analyze for brand identity (e.g. "https://example.com"). Bare handles are rejected; supply a full profile URL or use "platform:handle" shorthand (e.g. "instagram:acmefoods").'
       ),
       response_format: z6.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ url, response_format }) => {
+    async ({ url: rawUrl, response_format }) => {
+      const normalized = normalizeBrandUrlInput(rawUrl);
+      if (normalized.invalidUrl) {
+        return {
+          content: [{ type: "text", text: `URL blocked: "${rawUrl}" is not a valid URL.` }],
+          isError: true
+        };
+      }
+      if (!normalized.url) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `"${rawUrl}" looks like a handle, not a full URL. Provide a profile URL or use "platform:handle" shorthand (for example "instagram:acmefoods").`
+            }
+          ],
+          isError: true
+        };
+      }
+      const url = normalized.url;
       const ssrfCheck = await validateUrlForSSRF(url);
       if (!ssrfCheck.isValid) {
         return {
@@ -6718,7 +7505,7 @@ function registerRemotionTools(server) {
     },
     async ({ composition_id, output_format, props }) => {
       const userId = await getDefaultUserId();
-      const rateLimit = checkRateLimit("screenshot", `render_demo_video:${userId}`);
+      const rateLimit = checkRateLimit("generation", `render_demo_video:${userId}`);
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -6913,6 +7700,7 @@ function registerRemotionTools(server) {
 
 // src/tools/insights.ts
 import { z as z9 } from "zod";
+init_supabase();
 var MAX_INSIGHT_AGE_DAYS = 30;
 var PLATFORM_ENUM = [
   "youtube",
@@ -6937,22 +7725,25 @@ function asEnvelope6(data) {
 function registerInsightsTools(server) {
   server.tool(
     "get_performance_insights",
-    "Query performance insights derived from post analytics. Returns metrics like engagement rate, view velocity, and click rate aggregated over time. Use this to understand what content is performing well.",
+    "Query project-scoped performance insights derived from post analytics. Returns metrics like engagement rate, view velocity, and click rate aggregated over time. Use this to understand what content is performing well.",
     {
       insight_type: z9.enum(["top_hooks", "optimal_timing", "best_models", "competitor_patterns"]).optional().describe("Filter to a specific insight type."),
       days: z9.number().min(1).max(90).optional().describe("Number of days to look back. Defaults to 30. Max 90."),
       limit: z9.number().min(1).max(50).optional().describe("Maximum number of insights to return. Defaults to 10."),
+      project_id: z9.string().optional().describe("Project ID. Defaults to the active project context."),
       response_format: z9.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ insight_type, days, limit, response_format }) => {
+    async ({ insight_type, days, limit, project_id, response_format }) => {
       const format = response_format ?? "text";
       const lookbackDays = days ?? 30;
       const maxRows = limit ?? 10;
       const effectiveDays = Math.min(lookbackDays, MAX_INSIGHT_AGE_DAYS);
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
       const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
         action: "performance-insights",
         days: effectiveDays,
-        limit: maxRows
+        limit: maxRows,
+        ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
       });
       if (efError || !result?.success) {
         return {
@@ -7039,19 +7830,22 @@ function registerInsightsTools(server) {
   );
   server.tool(
     "get_best_posting_times",
-    "Analyze post analytics data to find the best times to post for maximum engagement. Returns the top 5 time slots (day of week + hour) ranked by average engagement.",
+    "Analyze project-scoped post analytics data to find the best times to post for maximum engagement. Returns the top 5 time slots (day of week + hour) ranked by average engagement.",
     {
       platform: z9.enum(PLATFORM_ENUM).optional().describe("Filter to a specific platform."),
       days: z9.number().min(1).max(90).optional().describe("Number of days to analyze. Defaults to 30. Max 90."),
+      project_id: z9.string().optional().describe("Project ID. Defaults to the active project context."),
       response_format: z9.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ platform: platform2, days, response_format }) => {
+    async ({ platform: platform2, days, project_id, response_format }) => {
       const format = response_format ?? "text";
       const lookbackDays = days ?? 30;
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
       const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
         action: "best-posting-times",
         days: lookbackDays,
-        platform: platform2 ?? void 0
+        platform: platform2 ?? void 0,
+        ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
       });
       if (efError || !result?.success) {
         return {
@@ -8144,7 +8938,7 @@ Schedule: ${JSON.stringify(updated.schedule_config)}`
       }
       const statusData = {
         activeConfigs: result?.activeConfigs ?? 0,
-        recentRuns: [],
+        recentRuns: result?.recentRuns ?? result?.recent_runs ?? [],
         pendingApprovals: result?.pendingApprovals ?? 0
       };
       if (format === "json") {
@@ -8166,8 +8960,20 @@ ${"=".repeat(40)}
       text += `Pending Approvals: ${statusData.pendingApprovals}
 
 `;
-      text += `No recent runs.
+      if (statusData.recentRuns.length === 0) {
+        text += `No recent runs.
 `;
+      } else {
+        text += `Recent Runs (${statusData.recentRuns.length}):
+`;
+        for (const run of statusData.recentRuns.slice(0, 10)) {
+          const id = String(run.id ?? run.run_id ?? "unknown");
+          const status = String(run.status ?? "unknown");
+          const credits = run.credits_used ?? run.creditsUsed;
+          text += `  ${id}: ${status}${credits == null ? "" : ` (${String(credits)} credits)`}
+`;
+        }
+      }
       return {
         content: [{ type: "text", text }]
       };
@@ -10348,7 +11154,9 @@ function toolKnowledgeDocument(tool) {
 function getKnowledgeDocuments() {
   return [
     ...STATIC_KNOWLEDGE_DOCUMENTS,
-    ...TOOL_CATALOG.filter((t) => !t.internal).map(toolKnowledgeDocument)
+    ...TOOL_CATALOG.filter((t) => !t.internal && !t.hiddenFromPublicCount).map(
+      toolKnowledgeDocument
+    )
   ];
 }
 function tokenize(input) {
@@ -10465,7 +11273,7 @@ function registerDiscoveryTools(server) {
       if (query) {
         results = searchTools(query);
       }
-      results = results.filter((t) => !t.internal);
+      results = results.filter((t) => !t.internal && !t.hiddenFromPublicCount);
       if (module) {
         const moduleTools = getToolsByModule(module);
         results = results.filter((t) => moduleTools.some((mt) => mt.name === t.name));
@@ -12287,11 +13095,11 @@ function hexToLab(hex) {
   const lb = srgbToLinear(b);
   const x = lr * 0.4124564 + lg * 0.3575761 + lb * 0.1804375;
   const y = lr * 0.2126729 + lg * 0.7151522 + lb * 0.072175;
-  const z39 = lr * 0.0193339 + lg * 0.119192 + lb * 0.9503041;
+  const z41 = lr * 0.0193339 + lg * 0.119192 + lb * 0.9503041;
   const f = (t) => t > 8856e-6 ? Math.cbrt(t) : 7.787 * t + 16 / 116;
   const fx = f(x / 0.95047);
   const fy = f(y / 1);
-  const fz = f(z39 / 1.08883);
+  const fz = f(z41 / 1.08883);
   return { L: 116 * fy - 16, a: 500 * (fx - fy), b: 200 * (fy - fz) };
 }
 function deltaE2000(lab1, lab2) {
@@ -12524,10 +13332,10 @@ function registerBrandRuntimeTools(server) {
           pagesScraped: meta.pagesScraped || 0
         }
       };
-      const envelope = asEnvelope23(runtime);
+      const envelope2 = asEnvelope23(runtime);
       return {
-        structuredContent: envelope,
-        content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
+        structuredContent: envelope2,
+        content: [{ type: "text", text: JSON.stringify(envelope2, null, 2) }]
       };
     }
   );
@@ -12667,9 +13475,9 @@ function registerBrandRuntimeTools(server) {
       }
       const profile = row.profile_data;
       const checkResult = computeBrandConsistency(content, profile);
-      const envelope = asEnvelope23(checkResult);
+      const envelope2 = asEnvelope23(checkResult);
       return {
-        content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
+        content: [{ type: "text", text: JSON.stringify(envelope2, null, 2) }]
       };
     }
   );
@@ -12701,9 +13509,9 @@ function registerBrandRuntimeTools(server) {
         content_colors,
         threshold ?? 10
       );
-      const envelope = asEnvelope23(auditResult);
+      const envelope2 = asEnvelope23(auditResult);
       return {
-        content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
+        content: [{ type: "text", text: JSON.stringify(envelope2, null, 2) }]
       };
     }
   );
@@ -12736,9 +13544,9 @@ function registerBrandRuntimeTools(server) {
         row.profile_data.typography,
         format
       );
-      const envelope = asEnvelope23({ format, tokens: output });
+      const envelope2 = asEnvelope23({ format, tokens: output });
       return {
-        content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
+        content: [{ type: "text", text: JSON.stringify(envelope2, null, 2) }]
       };
     }
   );
@@ -12894,7 +13702,7 @@ function registerCarouselTools(server) {
         };
       }
       const userId = await getDefaultUserId();
-      const rateLimit = checkRateLimit("posting", `create_carousel:${userId}`);
+      const rateLimit = checkRateLimit("generation", `create_carousel:${userId}`);
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -12966,7 +13774,12 @@ function registerCarouselTools(server) {
                 slideNumber: slide.slideNumber,
                 jobId: null,
                 model: image_model,
-                error: error ?? "No job ID returned"
+                error: error ?? "No job ID returned",
+                creditsReserved: data?.credits_reserved ?? null,
+                creditsCharged: data?.credits_charged ?? null,
+                creditsRefunded: data?.credits_refunded ?? null,
+                billingStatus: data?.billing_status ?? "unknown",
+                failureReason: data?.failure_reason ?? null
               };
             }
             const jobId = data.asyncJobId ?? data.taskId ?? null;
@@ -12978,14 +13791,24 @@ function registerCarouselTools(server) {
               slideNumber: slide.slideNumber,
               jobId,
               model: image_model,
-              error: null
+              error: null,
+              creditsReserved: 0,
+              creditsCharged: data.creditsDeducted ?? perImageCost,
+              creditsRefunded: 0,
+              billingStatus: "charged",
+              failureReason: null
             };
           } catch (err) {
             return {
               slideNumber: slide.slideNumber,
               jobId: null,
               model: image_model,
-              error: sanitizeError(err)
+              error: sanitizeError(err),
+              creditsReserved: null,
+              creditsCharged: null,
+              creditsRefunded: null,
+              billingStatus: "unknown",
+              failureReason: null
             };
           }
         })
@@ -13010,7 +13833,8 @@ function registerCarouselTools(server) {
                       return {
                         ...s,
                         imageJobId: job?.jobId ?? null,
-                        imageError: job?.error ?? null
+                        imageError: job?.error ?? null,
+                        imageBillingStatus: job?.billingStatus ?? "unknown"
                       };
                     }),
                     imageModel: image_model,
@@ -13022,11 +13846,19 @@ function registerCarouselTools(server) {
                     jobIds: successfulJobs.map((j) => j.jobId),
                     failedSlides: failedJobs.map((j) => ({
                       slideNumber: j.slideNumber,
-                      error: j.error
+                      error: j.error,
+                      credits_reserved: j.creditsReserved,
+                      credits_charged: j.creditsCharged,
+                      credits_refunded: j.creditsRefunded,
+                      billing_status: j.billingStatus,
+                      failure_reason: j.failureReason
                     })),
                     credits: {
                       textGeneration: textCredits,
                       imagesEstimated: successfulJobs.length * perImageCost,
+                      imagesCharged: imageJobs.reduce((sum, job) => sum + (job.creditsCharged ?? 0), 0),
+                      imagesRefunded: imageJobs.reduce((sum, job) => sum + (job.creditsRefunded ?? 0), 0),
+                      billingUnknownSlides: imageJobs.filter((job) => job.billingStatus === "unknown").length,
                       totalEstimated: textCredits + successfulJobs.length * perImageCost
                     }
                   }
@@ -13297,7 +14129,7 @@ function registerHyperframesTools(server) {
   );
   server.tool(
     "render_hyperframes",
-    "Render an HTML video composition (Hyperframes) to MP4. Author the composition as HTML with data-* timing attributes and GSAP timelines \u2014 frame-accurate, no React build step. Use list_hyperframes_blocks to see the pre-built block catalog. Returns a job ID \u2014 poll with check_status. Note: F4 v1 ships the EF + scaffold; the worker container needs the hyperframes runtime installed (Phase 2) before this returns finished MP4s.",
+    "Render an HTML video composition (Hyperframes) to MP4 \u2014 frame-accurate, no React build step. The page MUST expose window.__hf = { duration: <seconds>, seek: (t) => void }; the renderer calls seek(t) per frame (GSAP timelines work when driven from seek). Missing window.__hf causes a terminal timeout; poll check_status and verify its reported billing/refund outcome. Use list_hyperframes_blocks for the pre-built block catalog. Pass project_id to keep the render with the correct brand/project. Returns a job ID \u2014 poll with check_status.",
     {
       composition_html: z30.string().max(5e5).optional().describe(
         "Inline HTML composition (full <html>...</html>). Max 500KB. Use composition_url for larger."
@@ -13309,7 +14141,9 @@ function registerHyperframesTools(server) {
       aspect_ratio: z30.enum(["9:16", "16:9", "1:1"]).optional().describe('Output aspect ratio. Default "9:16".'),
       duration_sec: z30.number().min(0.1).max(600).describe("Output duration in seconds. Required. Max 600 (10 min)."),
       fps: z30.union([z30.literal(24), z30.literal(30), z30.literal(60)]).optional().describe("Frames per second. Default 30."),
-      quality: z30.enum(["draft", "standard", "high"]).optional().describe("draft: fast iteration; standard: production; high: final master.")
+      quality: z30.enum(["draft", "standard", "high"]).optional().describe("draft: fast iteration; standard: production; high: final master."),
+      project_id: z30.string().optional().describe("Project ID to associate the Hyperframes render with."),
+      response_format: z30.enum(["text", "json"]).optional().describe("Response format. Use json for a stable job_id handoff.")
     },
     async ({
       composition_html,
@@ -13318,7 +14152,9 @@ function registerHyperframesTools(server) {
       aspect_ratio,
       duration_sec,
       fps,
-      quality
+      quality,
+      project_id,
+      response_format
     }) => {
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("generation", `render_hyperframes:${userId}`);
@@ -13363,23 +14199,36 @@ function registerHyperframesTools(server) {
           aspectRatio: aspect_ratio || "9:16",
           durationSec: duration_sec,
           fps: fps || 30,
-          quality: quality || "standard"
+          quality: quality || "standard",
+          ...project_id && { projectId: project_id }
         });
         if (error || !data?.jobId) {
           throw new Error(error || data?.error || "Failed to create Hyperframes render job");
         }
+        const payload = {
+          job_id: data.jobId,
+          jobId: data.jobId,
+          status: data.status,
+          credits_cost: data.creditsCost,
+          credits: data.creditsCost,
+          duration_sec,
+          fps: fps || 30,
+          aspect_ratio: aspect_ratio || "9:16",
+          quality: quality || "standard",
+          project_id: project_id || null
+        };
         return {
           content: [
             {
               type: "text",
-              text: [
+              text: response_format === "json" ? JSON.stringify({ data: payload }) : [
                 `Hyperframes render job queued.`,
                 `  Job ID: ${data.jobId}`,
                 `  Credits: ${data.creditsCost}`,
                 `  Duration: ${duration_sec}s @ ${fps || 30}fps (${aspect_ratio || "9:16"})`,
                 `  Quality: ${quality || "standard"}`,
                 ``,
-                `Poll with check_status. Note: until F4 Phase 2 wires the runtime, the job will fail with a clear "HyperframesNotInstalled" message.`
+                `Poll with check_status.`
               ].join("\n")
             }
           ]
@@ -13389,7 +14238,7 @@ function registerHyperframesTools(server) {
           content: [
             {
               type: "text",
-              text: `Failed to queue Hyperframes render: ${err instanceof Error ? err.message : "Unknown error"}`
+              text: `Failed to queue Hyperframes render: ${sanitizeError(err)}`
             }
           ],
           isError: true
@@ -13408,7 +14257,17 @@ import {
 import { z as z31 } from "zod";
 import fs from "node:fs/promises";
 import path from "node:path";
-var CALENDAR_URI = "ui://content-calendar/mcp-app.html";
+import { fileURLToPath } from "node:url";
+init_request_context();
+init_supabase();
+var CALENDAR_URI = "ui://content-calendar/v1/mcp-app.html";
+var CALENDAR_CSP = {
+  // The HTML is fully self-contained. Tool calls travel over the host bridge,
+  // not fetch/XHR, so the secure default is no network or remote resources.
+  connectDomains: [],
+  resourceDomains: [],
+  frameDomains: []
+};
 var RecentPostOutputSchema = z31.object({
   id: z31.string(),
   platform: z31.string(),
@@ -13421,47 +14280,119 @@ var RecentPostOutputSchema = z31.object({
 });
 function startOfCurrentWeekMonday() {
   const now = /* @__PURE__ */ new Date();
-  const day = now.getDay();
+  const day = now.getUTCDay();
   const monday = new Date(now);
-  monday.setUTCDate(now.getUTCDate() - day + (day === 0 ? -6 : 1));
+  monday.setUTCDate(now.getUTCDate() - (day + 6) % 7);
+  monday.setUTCHours(0, 0, 0, 0);
   return monday.toISOString().split("T")[0];
 }
+function endOfWeek(startDate) {
+  const end = /* @__PURE__ */ new Date(`${startDate}T00:00:00.000Z`);
+  end.setUTCDate(end.getUTCDate() + 7);
+  end.setUTCMilliseconds(end.getUTCMilliseconds() - 1);
+  return end.toISOString();
+}
+function isStrictIsoDate(value) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) return false;
+  const parsed = /* @__PURE__ */ new Date(`${value}T00:00:00.000Z`);
+  return Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 10) === value;
+}
+function publicRecentPost(value) {
+  if (!value || typeof value !== "object") return null;
+  const row = value;
+  if (typeof row.id !== "string" || typeof row.platform !== "string" || typeof row.status !== "string" || typeof row.created_at !== "string") {
+    return null;
+  }
+  const optional = (name) => typeof row[name] === "string" ? row[name] : null;
+  return {
+    id: row.id,
+    platform: row.platform,
+    status: row.status,
+    title: optional("title"),
+    external_post_id: optional("external_post_id"),
+    published_at: optional("published_at"),
+    scheduled_at: optional("scheduled_at"),
+    created_at: row.created_at
+  };
+}
+function calendarHtmlCandidates() {
+  const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+  return [
+    // Bundled HTTP entry: import.meta.url is dist/http.js.
+    path.join(moduleDir, "apps/content-calendar/mcp-app.html"),
+    // Source/tsx/vitest: import.meta.url is src/apps/content-calendar.ts.
+    path.resolve(moduleDir, "../../dist/apps/content-calendar/mcp-app.html"),
+    // Local development fallback; never the sole package path.
+    path.resolve(process.cwd(), "dist/apps/content-calendar/mcp-app.html")
+  ];
+}
+async function readCalendarHtml() {
+  for (const candidate of calendarHtmlCandidates()) {
+    try {
+      return await fs.readFile(candidate, "utf-8");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  throw new Error("calendar_bundle_missing");
+}
 function registerContentCalendarApp(server) {
   registerAppTool(
     server,
     "open_content_calendar",
     {
       title: "Content Calendar",
-      description: "Open an interactive drag-drop calendar showing the user's scheduled posts for the current week. Users can reschedule via drag, filter by platform, drill into any post, or quick-create a new post. Backed by list_recent_posts, schedule_post, and find_next_slots \u2014 no new tools needed.",
+      description: "Open a project-scoped interactive calendar for the current week. Users can filter, inspect, quick-create, suggest a slot, and reschedule pending posts with optimistic conflict protection.",
       inputSchema: {
-        start_date: z31.string().optional().describe(
+        project_id: z31.string().uuid().optional().describe(
+          "Brand/project ID. Defaults to the authenticated key's project or the account default."
+        ),
+        start_date: z31.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional().describe(
           "ISO date for the week start (YYYY-MM-DD); defaults to the current week's Monday."
         )
       },
       outputSchema: {
         start_date: z31.string(),
+        project_id: z31.string(),
         posts: z31.array(RecentPostOutputSchema),
         scopes: z31.array(z31.string())
       },
       _meta: {
         ui: {
-          resourceUri: CALENDAR_URI,
-          csp: {
-            "img-src": ["'self'", "https://*.r2.cloudflarestorage.com", "data:"],
-            "connect-src": ["'self'"]
-          }
+          resourceUri: CALENDAR_URI
         }
       }
     },
-    async ({ start_date }, extra) => {
-      const userScopes = extra.authInfo?.scopes ?? [];
+    async ({ project_id, start_date }) => {
+      const userScopes = getRequestScopes() ?? getAuthenticatedScopes();
+      const resolvedProjectId = project_id ?? await getDefaultProjectId();
+      if (!resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No project_id was provided and no default project is configured."
+            }
+          ],
+          isError: true
+        };
+      }
       const fromDate = start_date ?? startOfCurrentWeekMonday();
+      if (!isStrictIsoDate(fromDate)) {
+        return {
+          content: [{ type: "text", text: "start_date must be a valid YYYY-MM-DD date." }],
+          isError: true
+        };
+      }
       const { data: result, error } = await callEdgeFunction(
         "mcp-data",
         {
-          action: "recent-posts",
-          days: 14,
-          limit: 50
+          action: "scheduled-posts",
+          start_date: `${fromDate}T00:00:00.000Z`,
+          end_date: endOfWeek(fromDate),
+          statuses: ["pending", "scheduled", "draft"],
+          projectId: resolvedProjectId,
+          project_id: resolvedProjectId
         },
         { timeoutMs: 15e3 }
       );
@@ -13470,19 +14401,16 @@ function registerContentCalendarApp(server) {
           content: [
             {
               type: "text",
-              text: `Failed to load posts: ${error || result?.error || "Unknown error"}`
+              text: "The content calendar could not load posts. Please retry."
             }
           ],
           isError: true
         };
       }
-      const posts = (result.posts ?? []).filter((p) => {
-        const ts = p.scheduled_at ?? p.published_at ?? p.created_at;
-        if (!ts) return false;
-        return ts.split("T")[0] >= fromDate;
-      });
+      const posts = (result.posts ?? []).map(publicRecentPost).filter((post) => post !== null);
       const structuredContent = {
         start_date: fromDate,
+        project_id: resolvedProjectId,
         posts,
         scopes: userScopes
       };
@@ -13501,36 +14429,64 @@ function registerContentCalendarApp(server) {
     server,
     CALENDAR_URI,
     CALENDAR_URI,
-    { mimeType: RESOURCE_MIME_TYPE },
+    {
+      mimeType: RESOURCE_MIME_TYPE,
+      description: "Self-contained Social Neuron project content calendar.",
+      _meta: { ui: { csp: CALENDAR_CSP } }
+    },
     async () => {
-      const htmlPath = path.join(process.cwd(), "apps/content-calendar/dist/mcp-app.html");
       try {
-        const html = await fs.readFile(htmlPath, "utf-8");
+        const html = await readCalendarHtml();
         return {
-          contents: [{ uri: CALENDAR_URI, mimeType: RESOURCE_MIME_TYPE, text: html }]
+          contents: [
+            {
+              uri: CALENDAR_URI,
+              mimeType: RESOURCE_MIME_TYPE,
+              text: html,
+              _meta: { ui: { csp: CALENDAR_CSP } }
+            }
+          ]
         };
-      } catch (err) {
+      } catch {
         const errorHtml = `<!DOCTYPE html>
 <html><head><title>Content Calendar \u2014 unavailable</title></head>
 <body style="font-family:sans-serif;padding:24px;color:#444;">
   <h2>Content Calendar app bundle missing</h2>
-  <p>The server registered <code>open_content_calendar</code> but
-  <code>apps/content-calendar/dist/mcp-app.html</code> is not built.
-  Run <code>npm run build:app</code> in the mcp-server directory and redeploy.</p>
-  <p style="color:#999;font-size:12px;">${err.message}</p>
+  <p>The interactive bundle is unavailable on this deployment. Please contact Social Neuron support.</p>
 </body></html>`;
         return {
-          contents: [{ uri: CALENDAR_URI, mimeType: RESOURCE_MIME_TYPE, text: errorHtml }]
+          contents: [
+            {
+              uri: CALENDAR_URI,
+              mimeType: RESOURCE_MIME_TYPE,
+              text: errorHtml,
+              _meta: { ui: { csp: CALENDAR_CSP } }
+            }
+          ]
         };
       }
     }
   );
 }
 
-// src/tools/connections.ts
+// src/apps/analytics-pulse.ts
+import {
+  registerAppResource as registerAppResource2,
+  registerAppTool as registerAppTool2,
+  RESOURCE_MIME_TYPE as RESOURCE_MIME_TYPE2
+} from "@modelcontextprotocol/ext-apps/server";
 import { z as z32 } from "zod";
+import fs2 from "node:fs/promises";
+import path2 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 init_supabase();
-var PLATFORM_ENUM4 = [
+var ANALYTICS_URI = "ui://analytics-pulse/v1/mcp-app.html";
+var ANALYTICS_CSP = {
+  connectDomains: [],
+  resourceDomains: [],
+  frameDomains: []
+};
+var PLATFORM_VALUES = [
   "youtube",
   "tiktok",
   "instagram",
@@ -13538,34 +14494,262 @@ var PLATFORM_ENUM4 = [
   "linkedin",
   "facebook",
   "threads",
-  "bluesky",
-  "shopify",
-  "etsy"
+  "bluesky"
 ];
-function findActiveAccount(accounts, platform2) {
-  const target = platform2.toLowerCase();
-  return accounts.find((a) => {
-    const effectiveStatus = a.effective_status || a.status;
-    return a.platform.toLowerCase() === target && (effectiveStatus === "active" || effectiveStatus === "expires_soon");
-  }) ?? null;
+var AnalyticsPostOutputSchema = z32.object({
+  platform: z32.string(),
+  title: z32.string().nullable(),
+  views: z32.number(),
+  likes: z32.number(),
+  comments: z32.number(),
+  shares: z32.number(),
+  engagement_rate: z32.number(),
+  captured_at: z32.string(),
+  published_at: z32.string().nullable()
+});
+function finiteMetric(value) {
+  const parsed = Number(value ?? 0);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+}
+function publicAnalyticsPost(value) {
+  if (!value || typeof value !== "object") return null;
+  const row = value;
+  const post = row.posts && typeof row.posts === "object" ? row.posts : {};
+  const platform2 = typeof row.platform === "string" ? row.platform : typeof post.platform === "string" ? post.platform : null;
+  const capturedAt = typeof row.captured_at === "string" ? row.captured_at : null;
+  if (!platform2 || !capturedAt) return null;
+  const views = finiteMetric(row.views);
+  const likes = finiteMetric(row.likes);
+  const comments = finiteMetric(row.comments);
+  const shares = finiteMetric(row.shares);
+  const engagement = likes + comments + shares;
+  return {
+    platform: platform2,
+    title: typeof post.title === "string" ? post.title : null,
+    views,
+    likes,
+    comments,
+    shares,
+    engagement_rate: views > 0 ? Number((engagement / views * 100).toFixed(2)) : 0,
+    captured_at: capturedAt,
+    published_at: typeof post.published_at === "string" ? post.published_at : null
+  };
 }
-var MAX_CONCURRENT_WAITS_PER_USER = 3;
-var inFlightWaitsByUser = /* @__PURE__ */ new Map();
-function registerConnectionTools(server) {
-  server.tool(
+function latestAnalyticsRows(values) {
+  const rows = values.filter((value) => Boolean(value) && typeof value === "object").sort((a, b) => String(b.captured_at ?? "").localeCompare(String(a.captured_at ?? "")));
+  const seen = /* @__PURE__ */ new Set();
+  const latest = [];
+  for (const row of rows) {
+    if (typeof row.post_id !== "string" || typeof row.platform !== "string") continue;
+    const key = `${row.post_id}:${row.platform.toLowerCase()}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    latest.push(row);
+  }
+  return latest;
+}
+function analyticsHtmlCandidates() {
+  const moduleDir = path2.dirname(fileURLToPath2(import.meta.url));
+  return [
+    path2.join(moduleDir, "apps/analytics-pulse/mcp-app.html"),
+    path2.resolve(moduleDir, "../../dist/apps/analytics-pulse/mcp-app.html"),
+    path2.resolve(process.cwd(), "dist/apps/analytics-pulse/mcp-app.html")
+  ];
+}
+async function readAnalyticsHtml() {
+  for (const candidate of analyticsHtmlCandidates()) {
+    try {
+      return await fs2.readFile(candidate, "utf-8");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  throw new Error("analytics_bundle_missing");
+}
+function registerAnalyticsPulseApp(server) {
+  registerAppTool2(
+    server,
+    "open_analytics_pulse",
+    {
+      title: "Analytics Pulse",
+      description: "Open a project-scoped performance dashboard with views, engagement, platform mix, and top-post metrics. Use it to review results visually before planning the next content cycle.",
+      inputSchema: {
+        project_id: z32.string().uuid().optional().describe("Brand/project ID. Defaults to the authenticated key's project or account default."),
+        platform: z32.enum(PLATFORM_VALUES).optional().describe("Optional platform filter."),
+        days: z32.number().int().min(1).max(365).optional().describe("Lookback window. Defaults to 30 days.")
+      },
+      outputSchema: {
+        project_id: z32.string(),
+        platform: z32.string().nullable(),
+        days: z32.number(),
+        summary: z32.object({
+          views: z32.number(),
+          engagement: z32.number(),
+          engagement_rate: z32.number(),
+          posts: z32.number()
+        }),
+        platform_totals: z32.array(
+          z32.object({
+            platform: z32.string(),
+            views: z32.number(),
+            engagement: z32.number(),
+            posts: z32.number()
+          })
+        ),
+        posts: z32.array(AnalyticsPostOutputSchema)
+      },
+      _meta: { ui: { resourceUri: ANALYTICS_URI } }
+    },
+    async ({ project_id, platform: platform2, days }) => {
+      const resolvedProjectId = project_id ?? await getDefaultProjectId();
+      if (!resolvedProjectId) {
+        return {
+          content: [{ type: "text", text: "No project_id was provided and no default project is configured." }],
+          isError: true
+        };
+      }
+      const lookbackDays = days ?? 30;
+      const { data: result, error } = await callEdgeFunction(
+        "mcp-data",
+        {
+          action: "analytics",
+          projectId: resolvedProjectId,
+          project_id: resolvedProjectId,
+          days: lookbackDays,
+          // The table stores cumulative snapshots. Request a wider window and
+          // deduplicate below so refresh frequency cannot inflate the totals.
+          limit: 100,
+          latestOnly: true,
+          ...platform2 ? { platform: platform2 } : {}
+        },
+        { timeoutMs: 15e3 }
+      );
+      if (error || !result?.success) {
+        return {
+          content: [{ type: "text", text: "The analytics dashboard could not load data. Please retry." }],
+          isError: true
+        };
+      }
+      const posts = latestAnalyticsRows(result.rows ?? []).map(publicAnalyticsPost).filter((post) => post !== null).sort((a, b) => b.views - a.views);
+      const totals = /* @__PURE__ */ new Map();
+      let totalViews = 0;
+      let totalEngagement = 0;
+      for (const post of posts) {
+        const engagement = post.likes + post.comments + post.shares;
+        totalViews += post.views;
+        totalEngagement += engagement;
+        const aggregate = totals.get(post.platform) ?? {
+          platform: post.platform,
+          views: 0,
+          engagement: 0,
+          posts: 0
+        };
+        aggregate.views += post.views;
+        aggregate.engagement += engagement;
+        aggregate.posts += 1;
+        totals.set(post.platform, aggregate);
+      }
+      const structuredContent = {
+        project_id: resolvedProjectId,
+        platform: platform2 ?? null,
+        days: lookbackDays,
+        summary: {
+          views: totalViews,
+          engagement: totalEngagement,
+          engagement_rate: totalViews > 0 ? Number((totalEngagement / totalViews * 100).toFixed(2)) : 0,
+          posts: posts.length
+        },
+        platform_totals: [...totals.values()].sort((a, b) => b.views - a.views),
+        posts
+      };
+      return {
+        structuredContent,
+        content: [
+          {
+            type: "text",
+            text: `Loaded ${posts.length} analytics record${posts.length === 1 ? "" : "s"} for the last ${lookbackDays} days.`
+          }
+        ]
+      };
+    }
+  );
+  registerAppResource2(
+    server,
+    ANALYTICS_URI,
+    ANALYTICS_URI,
+    {
+      mimeType: RESOURCE_MIME_TYPE2,
+      description: "Self-contained Social Neuron project analytics dashboard.",
+      _meta: { ui: { csp: ANALYTICS_CSP } }
+    },
+    async () => {
+      try {
+        const html = await readAnalyticsHtml();
+        return {
+          contents: [
+            {
+              uri: ANALYTICS_URI,
+              mimeType: RESOURCE_MIME_TYPE2,
+              text: html,
+              _meta: { ui: { csp: ANALYTICS_CSP } }
+            }
+          ]
+        };
+      } catch {
+        return {
+          contents: [
+            {
+              uri: ANALYTICS_URI,
+              mimeType: RESOURCE_MIME_TYPE2,
+              text: "<!doctype html><html><body><h2>Analytics Pulse unavailable</h2><p>The interactive bundle is unavailable on this deployment. Please contact Social Neuron support.</p></body></html>",
+              _meta: { ui: { csp: ANALYTICS_CSP } }
+            }
+          ]
+        };
+      }
+    }
+  );
+}
+
+// src/tools/connections.ts
+import { z as z33 } from "zod";
+init_supabase();
+var PLATFORM_ENUM4 = [
+  "youtube",
+  "tiktok",
+  "instagram",
+  "twitter",
+  "linkedin",
+  "facebook",
+  "threads",
+  "bluesky",
+  "shopify",
+  "etsy"
+];
+function findActiveAccount(accounts, platform2) {
+  const target = platform2.toLowerCase();
+  return accounts.find((a) => {
+    const effectiveStatus = a.effective_status || a.status;
+    return a.platform.toLowerCase() === target && (effectiveStatus === "active" || effectiveStatus === "expires_soon");
+  }) ?? null;
+}
+var MAX_CONCURRENT_WAITS_PER_USER = 3;
+var inFlightWaitsByUser = /* @__PURE__ */ new Map();
+function registerConnectionTools(server) {
+  server.tool(
     "start_platform_connection",
     "Begin connecting a social platform (Instagram, TikTok, YouTube, etc.). Returns a single-use deep link the user opens in a browser to complete the one-time OAuth handshake on socialneuron.com. This is NOT another OAuth in Claude \u2014 platform connections require a browser session because the social platforms (Meta, Google, TikTok) only accept callbacks on socialneuron.com. After the user clicks the link and approves on the platform, call `wait_for_connection` to detect completion. Link expires in 2 minutes; mint a new one if needed. Use `list_connected_accounts` first to check whether the platform is already connected before calling this.",
     {
-      platform: z32.enum(PLATFORM_ENUM4).describe("Platform to connect. Lower-case: instagram, tiktok, youtube, etc."),
-      project_id: z32.string().optional().describe(
+      platform: z33.enum(PLATFORM_ENUM4).describe("Platform to connect. Lower-case: instagram, tiktok, youtube, etc."),
+      project_id: z33.string().optional().describe(
         "Brand/project ID to bind the new social account to. Use this when connecting a brand-specific account."
       ),
-      response_format: z32.enum(["text", "json"]).optional().describe("Response format. Default: text.")
+      response_format: z33.enum(["text", "json"]).optional().describe("Response format. Default: text.")
     },
     async ({ platform: platform2, project_id, response_format }) => {
       const format = response_format ?? "text";
       const userId = await getDefaultUserId();
-      const rl = checkRateLimit("read", `start_platform_connection:${userId}`);
+      const rl = checkRateLimit("posting", `start_platform_connection:${userId}`);
       if (!rl.allowed) {
         return {
           content: [
@@ -13645,13 +14829,13 @@ function registerConnectionTools(server) {
     "wait_for_connection",
     "Poll until a platform connection becomes active. Use after `start_platform_connection` while the user completes the browser OAuth flow. Returns when the account row appears with status=active, or when the timeout elapses. Default timeout 120s, max 600s.",
     {
-      platform: z32.enum(PLATFORM_ENUM4).describe("Platform to wait for."),
-      project_id: z32.string().optional().describe(
+      platform: z33.enum(PLATFORM_ENUM4).describe("Platform to wait for."),
+      project_id: z33.string().optional().describe(
         "Brand/project ID to scope the connection poll. Use the same project_id passed to start_platform_connection."
       ),
-      timeout_s: z32.number().min(5).max(600).optional().describe("How long to wait, in seconds. Default 120."),
-      poll_interval_s: z32.number().min(2).max(30).optional().describe("Poll interval in seconds. Default 5."),
-      response_format: z32.enum(["text", "json"]).optional().describe("Response format. Default: text.")
+      timeout_s: z33.number().min(5).max(600).optional().describe("How long to wait, in seconds. Default 120."),
+      poll_interval_s: z33.number().min(2).max(30).optional().describe("Poll interval in seconds. Default 5."),
+      response_format: z33.enum(["text", "json"]).optional().describe("Response format. Default: text.")
     },
     async ({ platform: platform2, project_id, timeout_s, poll_interval_s, response_format }) => {
       const format = response_format ?? "text";
@@ -13784,7 +14968,7 @@ function registerConnectionTools(server) {
 }
 
 // src/tools/harness.ts
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 var ALLOWED_AGENTS = [
   "conductor",
   "brand-brain",
@@ -13794,38 +14978,38 @@ var ALLOWED_AGENTS = [
   "engager"
 ];
 var writeReflectionSchema = {
-  reflection_text: z33.string().min(1).max(4e3).describe("The verbal reflection text produced by the agent. 1\u20134000 characters."),
-  generated_by_agent: z33.enum(ALLOWED_AGENTS).describe(
+  reflection_text: z34.string().min(1).max(4e3).describe("The verbal reflection text produced by the agent. 1\u20134000 characters."),
+  generated_by_agent: z34.enum(ALLOWED_AGENTS).describe(
     "Which agent produced this reflection. Must be one of: conductor, brand-brain, drafter, publisher, analyst, engager."
   ),
-  provenance: z33.object({
-    content_history_id: z33.string().optional().describe("Related content_history row UUID."),
-    outcome_event_id: z33.string().optional().describe("Related outcome event UUID."),
-    prm_score_ids: z33.array(z33.string()).optional().describe("PRM score IDs that informed this reflection."),
-    handoff_ids: z33.array(z33.string()).optional().describe("Handoff event IDs that triggered this reflection.")
+  provenance: z34.object({
+    content_history_id: z34.string().optional().describe("Related content_history row UUID."),
+    outcome_event_id: z34.string().optional().describe("Related outcome event UUID."),
+    prm_score_ids: z34.array(z34.string()).optional().describe("PRM score IDs that informed this reflection."),
+    handoff_ids: z34.array(z34.string()).optional().describe("Handoff event IDs that triggered this reflection.")
   }).strict().describe(
     "Source evidence for this reflection. Only these four keys are accepted \u2014 unknown keys are rejected to prevent spurious provenance claims."
   ),
-  brand_id: z33.string().describe("Brand profile UUID this reflection belongs to."),
-  pipeline_id: z33.string().optional().describe("Optional: pipeline run UUID."),
-  post_id: z33.string().optional().describe("Optional: post UUID if reflection targets a post.")
+  brand_id: z34.string().describe("Brand profile UUID this reflection belongs to."),
+  pipeline_id: z34.string().optional().describe("Optional: pipeline run UUID."),
+  post_id: z34.string().optional().describe("Optional: post UUID if reflection targets a post.")
 };
 var readReflectionSchema = {
-  brand_id: z33.string().describe("Brand profile UUID to read reflections for."),
-  generated_by_agent: z33.enum(ALLOWED_AGENTS).optional().describe(
+  brand_id: z34.string().describe("Brand profile UUID to read reflections for."),
+  generated_by_agent: z34.enum(ALLOWED_AGENTS).optional().describe(
     "Optional filter: only return reflections produced by this agent. One of: conductor, brand-brain, drafter, publisher, analyst, engager."
   ),
-  limit: z33.number().int().min(1).max(100).optional().describe(
+  limit: z34.number().int().min(1).max(100).optional().describe(
     "Maximum number of reflections to return. Clamped to [1, 100]. Default: 50. Results are ordered by created_at DESC, then id ASC (deterministic tiebreak)."
   )
 };
 var recordOutcomeSchema = {
-  decision_event_id: z33.string().describe("UUID of the decision_events row to record an outcome for."),
-  horizon: z33.enum(["1h", "6h", "24h"]).describe(
+  decision_event_id: z34.string().describe("UUID of the decision_events row to record an outcome for."),
+  horizon: z34.enum(["1h", "6h", "24h"]).describe(
     "Observation horizon. Only horizon=24h with a non-null reward triggers a learning-loop update; 1h/6h are stored but inert for learning."
   ),
-  reward: z33.number().min(0).max(1).describe("Normalised reward signal in [0, 1]. Higher = better outcome."),
-  outcome_metrics: z33.record(z33.string(), z33.number()).optional().describe(
+  reward: z34.number().min(0).max(1).describe("Normalised reward signal in [0, 1]. Higher = better outcome."),
+  outcome_metrics: z34.record(z34.string(), z34.number()).optional().describe(
     'Optional map of raw metric name \u2192 value (e.g. {"likes": 42, "reach": 1200}). Stored verbatim; not used for learning directly.'
   )
 };
@@ -13921,7 +15105,7 @@ function registerHarnessTools(server, _ctx) {
 }
 
 // src/tools/hermes.ts
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 function asEnvelope25(data) {
   return {
     _meta: {
@@ -13931,7 +15115,7 @@ function asEnvelope25(data) {
     data
   };
 }
-var PLATFORM = z34.enum([
+var PLATFORM = z35.enum([
   "instagram",
   "twitter",
   "linkedin",
@@ -13947,12 +15131,12 @@ function registerHermesTools(server) {
     "Save a draft post to the SN content library. Use when an autonomous agent wants to persist a draft for review before publishing. Lands in the content library with status='draft'. The draft can then be approved/edited in the SN UI.",
     {
       platform: PLATFORM.describe("Target platform for the draft."),
-      copy: z34.string().min(1).max(8e3).describe("The draft post body."),
-      project_id: z34.string().optional().describe("SN project UUID. Optional but recommended."),
-      media_url: z34.string().url().optional().describe("Optional cover/media URL (R2 signed URL)."),
-      hermes_run_id: z34.string().optional().describe("Agent run id, for traceability."),
-      source_intel_ids: z34.array(z34.string()).optional().describe("Optional list of intel_signals.id rows that informed this draft."),
-      response_format: z34.enum(["text", "json"]).optional()
+      copy: z35.string().min(1).max(8e3).describe("The draft post body."),
+      project_id: z35.string().optional().describe("SN project UUID. Optional but recommended."),
+      media_url: z35.string().url().optional().describe("Optional cover/media URL (R2 signed URL)."),
+      hermes_run_id: z35.string().optional().describe("Agent run id, for traceability."),
+      source_intel_ids: z35.array(z35.string()).optional().describe("Optional list of intel_signals.id rows that informed this draft."),
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ platform: platform2, copy, project_id, media_url, hermes_run_id, response_format }) => {
       const { data, error } = await callEdgeFunction(
@@ -13990,15 +15174,15 @@ function registerHermesTools(server) {
     "record_voice_lesson",
     'Persist a learned voice lesson to brand_profiles.platform_voice.voice_lessons. Use after weekly reflection identifies a hook/format/CTA pattern that beats median engagement by \u226530%. Appears in SN Brand > BrandBrainPreview > "Voice lessons (auto)".',
     {
-      project_id: z34.string().describe("SN project UUID."),
-      lesson: z34.string().min(1).max(500).describe('One-sentence rule (e.g. "lowercase IG hooks beat title-case").'),
-      evidence: z34.object({
-        engagement_lift_pct: z34.number().describe("Engagement lift vs baseline, in percentage points."),
-        sample_size: z34.number().int().min(1).describe("Number of posts behind this lesson."),
-        top_examples: z34.array(z34.string()).optional().describe("Up to 3 hook examples from the top quartile.")
+      project_id: z35.string().describe("SN project UUID."),
+      lesson: z35.string().min(1).max(500).describe('One-sentence rule (e.g. "lowercase IG hooks beat title-case").'),
+      evidence: z35.object({
+        engagement_lift_pct: z35.number().describe("Engagement lift vs baseline, in percentage points."),
+        sample_size: z35.number().int().min(1).describe("Number of posts behind this lesson."),
+        top_examples: z35.array(z35.string()).optional().describe("Up to 3 hook examples from the top quartile.")
       }).describe("Quantitative evidence backing the lesson."),
-      applies_to: z34.array(PLATFORM).min(1).describe("Platforms this lesson applies to."),
-      response_format: z34.enum(["text", "json"]).optional()
+      applies_to: z35.array(PLATFORM).min(1).describe("Platforms this lesson applies to."),
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ project_id, lesson, evidence, applies_to, response_format }) => {
       const { data, error } = await callEdgeFunction("mcp-data", {
@@ -14034,10 +15218,10 @@ function registerHermesTools(server) {
     "record_observation",
     'Record an agent observation (e.g. "topic X engagement up 23% this week"). Surfaces in the analytics Playbook. Use for weekly reflection digests and mid-campaign pulse summaries.',
     {
-      summary: z34.string().min(1).max(2e3).describe("One-paragraph summary, shown to the account owner."),
-      deltas: z34.record(z34.string(), z34.union([z34.number(), z34.string(), z34.boolean()])).optional().describe("Optional structured key/value payload (e.g. {topic_x_er_pct: 23})."),
-      run_id: z34.string().optional().describe("Agent run id for traceability."),
-      response_format: z34.enum(["text", "json"]).optional()
+      summary: z35.string().min(1).max(2e3).describe("One-paragraph summary, shown to the account owner."),
+      deltas: z35.record(z35.string(), z35.union([z35.number(), z35.string(), z35.boolean()])).optional().describe("Optional structured key/value payload (e.g. {topic_x_er_pct: 23})."),
+      run_id: z35.string().optional().describe("Agent run id for traceability."),
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ summary, deltas, run_id, response_format }) => {
       const { data, error } = await callEdgeFunction("mcp-data", { action: "record-observation", summary, deltas, run_id });
@@ -14064,13 +15248,13 @@ function registerHermesTools(server) {
     "record_intel_signal",
     "Record a research/trend signal (news, HN post, competitor change, arxiv paper). Surfaces in SN Brand > Niche Intelligence. Dedupes by URL per user \u2014 safe to call multiple times for the same source.",
     {
-      source: z34.string().min(1).max(100).describe('Watcher name (e.g. "news-watch", "hackernews-watch").'),
-      url: z34.string().url().max(2e3).describe("Canonical URL of the source. Used for dedupe."),
-      topic: z34.string().max(200).optional().describe("Best-fit topic key."),
-      title: z34.string().max(500).optional(),
-      summary: z34.string().max(4e3).optional().describe("One-paragraph summary of the signal."),
-      score: z34.number().optional().describe("Relevance score from the watcher (0\u201310 typical)."),
-      response_format: z34.enum(["text", "json"]).optional()
+      source: z35.string().min(1).max(100).describe('Watcher name (e.g. "news-watch", "hackernews-watch").'),
+      url: z35.string().url().max(2e3).describe("Canonical URL of the source. Used for dedupe."),
+      topic: z35.string().max(200).optional().describe("Best-fit topic key."),
+      title: z35.string().max(500).optional(),
+      summary: z35.string().max(4e3).optional().describe("One-paragraph summary of the signal."),
+      score: z35.number().optional().describe("Relevance score from the watcher (0\u201310 typical)."),
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ source, url, topic, title, summary, score, response_format }) => {
       const { data, error } = await callEdgeFunction("mcp-data", {
@@ -14108,16 +15292,16 @@ function registerHermesTools(server) {
     "record_campaign_spend",
     "Log a campaign cost line. Use when an autonomous agent incurs spend that should be attributed to a campaign \u2014 drafts, renders, paid amp. Read aggregate via get_active_campaigns.",
     {
-      campaign_id: z34.string().min(1).max(200).describe("Campaign identifier (slug)."),
-      category: z34.enum([
+      campaign_id: z35.string().min(1).max(200).describe("Campaign identifier (slug)."),
+      category: z35.enum([
         "hermes_drafts",
         "carousel_renders",
         "analytics_pulls",
         "paid_amplification",
         "other"
       ]).describe("Cost category."),
-      amount_usd: z34.number().min(0).describe("Amount in USD; supports 4 decimal places."),
-      response_format: z34.enum(["text", "json"]).optional()
+      amount_usd: z35.number().min(0).describe("Amount in USD; supports 4 decimal places."),
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ campaign_id, category, amount_usd, response_format }) => {
       const { data, error } = await callEdgeFunction("mcp-data", {
@@ -14152,7 +15336,7 @@ function registerHermesTools(server) {
     "get_active_campaigns",
     "List currently-running campaigns with thesis, budget, hero format, and current spend. Use to bias drafts toward active campaign themes.",
     {
-      response_format: z34.enum(["text", "json"]).optional()
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ response_format }) => {
       const { data, error } = await callEdgeFunction("mcp-data", { action: "get-active-campaigns" });
@@ -14197,7 +15381,7 @@ ${"=".repeat(40)}
 }
 
 // src/tools/skills.ts
-import { z as z35 } from "zod";
+import { z as z36 } from "zod";
 
 // src/lib/skills-manifest.ts
 var SKILLS_MANIFEST = [
@@ -14226,6 +15410,19 @@ function listSkills(opts) {
 }
 
 // src/tools/skills.ts
+function renderCatalogRow(row) {
+  const lines = [];
+  const platform2 = row.platform ? ` \xB7 ${row.platform}` : "";
+  lines.push(`${row.slug} (${row.kind}${platform2})`);
+  const desc = row.frontmatter && typeof row.frontmatter.description === "string" ? row.frontmatter.description : null;
+  if (desc) lines.push(`  ${desc}`);
+  const lock = row.locked ? ` \u{1F512} (upgrade to unlock)` : "";
+  lines.push(`  Tier: ${row.tier_minimum}${lock}`);
+  lines.push(
+    `  Model: ${row.model_id ?? "n/a"} \xB7 ${row.body_chars} chars` + (row.updated_at ? ` \xB7 updated ${row.updated_at}` : "")
+  );
+  return lines.join("\n");
+}
 function asEnvelope26(data) {
   return {
     _meta: {
@@ -14235,7 +15432,14 @@ function asEnvelope26(data) {
     data
   };
 }
-var STUDIO_VALUES = ["video", "avatar", "carousel", "voice", "caption", "edit"];
+var STUDIO_VALUES = [
+  "video",
+  "avatar",
+  "carousel",
+  "voice",
+  "caption",
+  "edit"
+];
 function renderSkillSummary(skill) {
   const lines = [];
   lines.push(`${skill.name} (${skill.id})`);
@@ -14254,19 +15458,88 @@ function registerSkillsTools(server) {
     "list_skills",
     'List Social Neuron content workflow skills available to the authenticated user. A skill is a brand-locked multi-step pipeline (research \u2192 hook \u2192 script \u2192 visuals \u2192 voice \u2192 captions \u2192 assembly \u2192 quality gate \u2192 schedule) inspired by documented viral patterns (MrBeast 3-second hook, Hormozi pattern interrupt, etc.). Use this tool when the user asks "what can SN do", "what skills are available", "show me viral templates", or before calling run_skill so you can pick the right one.',
     {
-      studio: z35.enum(STUDIO_VALUES).optional().describe("Filter to one studio (video, avatar, carousel, voice, caption, edit)."),
-      featured_only: z35.boolean().optional().describe("Return only featured (recommended) skills. Defaults to false."),
-      response_format: z35.enum(["text", "json"]).optional().describe("Response format. Defaults to text \u2014 human-readable summary.")
+      studio: z36.enum(STUDIO_VALUES).optional().describe(
+        "Filter to one studio (video, avatar, carousel, voice, caption, edit)."
+      ),
+      featured_only: z36.boolean().optional().describe(
+        "Return only featured (recommended) skills. Defaults to false."
+      ),
+      response_format: z36.enum(["text", "json"]).optional().describe(
+        "Response format. Defaults to text \u2014 human-readable summary."
+      )
     },
     async ({ studio, featured_only, response_format }) => {
-      const skills = listSkills({ studio, featuredOnly: featured_only });
       const format = response_format ?? "text";
+      const { data: efData, error: efError } = await callEdgeFunction("mcp-data", { action: "get-skills" });
+      const catalogRows = efData?.skills;
+      if (!efError && Array.isArray(catalogRows) && catalogRows.length > 0) {
+        const workflows = listSkills({ studio, featuredOnly: featured_only });
+        const filteredGuideRows = catalogRows.filter(
+          (row) => !studio && (!featured_only || row.frontmatter?.featured === true)
+        );
+        const guides = filteredGuideRows.map((row) => ({
+          ...row,
+          use_with: "get_skill"
+        }));
+        const total = guides.length + workflows.length;
+        if (format === "json") {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(
+                  asEnvelope26({
+                    count: total,
+                    guides,
+                    workflows: workflows.map((w) => ({
+                      ...w,
+                      use_with: "run_skill"
+                    }))
+                  }),
+                  null,
+                  2
+                )
+              }
+            ]
+          };
+        }
+        const guideBlocks = filteredGuideRows.map(
+          (row) => `${renderCatalogRow(row)}
+\u2192 Read it: get_skill(slug: "${row.slug}")`
+        ).join("\n\n");
+        const workflowBlocks = workflows.map(renderSkillSummary).join("\n\n");
+        const header2 = `${total} skill${total === 1 ? "" : "s"} available (${guides.length} guide${guides.length === 1 ? "" : "s"} \xB7 ${workflows.length} workflow${workflows.length === 1 ? "" : "s"})
+${"=".repeat(40)}`;
+        const sections = [
+          guides.length > 0 ? `GUIDES \u2014 living how-to documents. Fetch with get_skill(slug).
+
+${guideBlocks}` : "",
+          workflows.length > 0 ? `WORKFLOWS \u2014 executable content pipelines. Launch with run_skill(skill_id).
+
+${workflowBlocks}` : ""
+        ].filter(Boolean);
+        return {
+          content: [
+            {
+              type: "text",
+              text: `${header2}
+
+${sections.join("\n\n")}`
+            }
+          ]
+        };
+      }
+      const skills = listSkills({ studio, featuredOnly: featured_only });
       if (format === "json") {
         return {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope26({ count: skills.length, skills }), null, 2)
+              text: JSON.stringify(
+                asEnvelope26({ count: skills.length, skills }),
+                null,
+                2
+              )
             }
           ]
         };
@@ -14276,7 +15549,9 @@ function registerSkillsTools(server) {
           content: [
             {
               type: "text",
-              text: "No skills match the filter." + (studio ? ` Studio "${studio}" has no skills yet.` : "") + "\n\nAvailable studios with skills: " + Array.from(new Set(SKILLS_MANIFEST.map((s) => s.studio))).join(", ")
+              text: "No skills match the filter." + (studio ? ` Studio "${studio}" has no skills yet.` : "") + "\n\nAvailable studios with skills: " + Array.from(new Set(SKILLS_MANIFEST.map((s) => s.studio))).join(
+                ", "
+              )
             }
           ]
         };
@@ -14295,18 +15570,22 @@ ${blocks}` }]
     "run_skill",
     "Run a Social Neuron workflow skill end-to-end (brand-locked content production). Returns a structured run preview with the exact step plan, credit cost, and a deep-link to launch the run in the SN dashboard. A future release executes in-process so you can stream step-by-step progress back to the user. Call list_skills first to discover available skill ids.",
     {
-      skill_id: z35.string().describe(
+      skill_id: z36.string().describe(
         'The id of the skill to run (e.g. "skill-brand-locked-viral-hook-reel"). Use list_skills to discover available ids.'
       ),
-      topic: z35.string().min(1).describe('What the content is about (e.g. "why we built Social Neuron").'),
-      audience: z35.string().optional().describe(
+      topic: z36.string().min(1).describe(
+        'What the content is about (e.g. "why we built Social Neuron").'
+      ),
+      audience: z36.string().optional().describe(
         'Who the content is for (e.g. "first-time founders"). Defaults to brand persona.'
       ),
-      hook: z35.string().optional().describe(
+      hook: z36.string().optional().describe(
         "Optional explicit hook. If omitted, the skill drafts and scores 3-5 candidates."
       ),
-      cta: z35.string().optional().describe("Optional call-to-action override. Defaults to brand standard CTA."),
-      response_format: z35.enum(["text", "json"]).optional().describe("Response format. Defaults to text.")
+      cta: z36.string().optional().describe(
+        "Optional call-to-action override. Defaults to brand standard CTA."
+      ),
+      response_format: z36.enum(["text", "json"]).optional().describe("Response format. Defaults to text.")
     },
     async ({ skill_id, topic, audience, hook, cta, response_format }) => {
       const skill = getSkill(skill_id);
@@ -14374,10 +15653,78 @@ ${blocks}` }]
       };
     }
   );
+  server.tool(
+    "get_skill",
+    `Fetch the full body of a single Social Neuron skill by slug \u2014 the hand-maintained strategy/specs plus the machine-maintained "what's working now" compiled section. Use this after list_skills when the user wants the actual playbook for a platform (e.g. "show me the TikTok skill"). Returns the skill body, compiled section, tier, and linked recipe slug (if any).`,
+    {
+      slug: z36.string().min(1).max(100).regex(/^[a-z0-9][a-z0-9-]*$/).describe(
+        'The skill slug (e.g. "tiktok-content"). Use list_skills to discover slugs.'
+      ),
+      response_format: z36.enum(["text", "json"]).optional().describe("Response format. Defaults to text.")
+    },
+    async ({ slug, response_format }) => {
+      const format = response_format ?? "text";
+      const { data, error } = await callEdgeFunction("mcp-data", {
+        action: "get-skill",
+        slug
+      });
+      if (error) {
+        return toolError(
+          "upstream_error",
+          "The skill catalogue could not be loaded. Please retry."
+        );
+      }
+      const skill = data?.skill;
+      if (!skill) {
+        return toolError("not_found", `No skill found with slug "${slug}".`, {
+          recover_with: ["Call list_skills to see available skills."]
+        });
+      }
+      if (skill.locked) {
+        return toolError(
+          "permission_denied",
+          "This skill requires a higher plan tier.",
+          {
+            details: { slug: skill.slug, tier_minimum: skill.tier_minimum },
+            recover_with: [
+              "Upgrade the account or choose an unlocked skill from list_skills."
+            ]
+          }
+        );
+      }
+      if (format === "json") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope26(skill), null, 2)
+            }
+          ]
+        };
+      }
+      const platform2 = skill.platform ? ` \xB7 ${skill.platform}` : "";
+      const lock = skill.locked ? " \u{1F512} (upgrade to unlock)" : "";
+      const header = [
+        `${skill.slug} (${skill.kind}${platform2})`,
+        "=".repeat(40),
+        `Tier: ${skill.tier_minimum}${lock} \xB7 version ${skill.version}` + (skill.recipe_slug ? ` \xB7 recipe: ${skill.recipe_slug}` : ""),
+        ""
+      ].join("\n");
+      const compiled = skill.compiled_section ? `
+
+--- What's working now ---
+${skill.compiled_section}` : "";
+      return {
+        content: [
+          { type: "text", text: `${header}${skill.body}${compiled}` }
+        ]
+      };
+    }
+  );
 }
 
 // src/tools/loopPulse.ts
-import { z as z36 } from "zod";
+import { z as z37 } from "zod";
 function asEnvelope27(data) {
   return {
     _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
@@ -14389,7 +15736,7 @@ function registerLoopPulseTools(server) {
     "get_loop_pulse",
     'Read the dynamic loop-health KPIs for the Social Neuron growth loop over the last 7 days. Returns reflection coverage, decision coverage, visual gate pass rate, learning-update application rate, per-platform learning uptake, autopilot lag, and pattern aggregation counts \u2014 each with a status ("ok" / "warn" / "bad") and a why-line explaining what the metric measures. Use this to decide whether the loop is closing or where it is stuck before recommending next moves.',
     {
-      response_format: z36.enum(["text", "json"]).optional().describe("Output format. Defaults to text.")
+      response_format: z37.enum(["text", "json"]).optional().describe("Output format. Defaults to text.")
     },
     async ({ response_format }) => {
       const format = response_format ?? "text";
@@ -14432,7 +15779,7 @@ function registerLoopPulseTools(server) {
 }
 
 // src/tools/banditState.ts
-import { z as z37 } from "zod";
+import { z as z38 } from "zod";
 init_supabase();
 function asEnvelope28(data) {
   return {
@@ -14445,8 +15792,8 @@ function registerBanditStateTools(server) {
     "get_bandit_state",
     "Read the current content learning state for a project. Returns top-K arms per (arm_type, platform) with expected performance and uncertainty. Use this to reason about which hook family / format / timing slot currently performs best on each platform before recommending next moves. Arm types: hook_family, length_bucket (xs/s/m/l/xl by platform), posting_time_bucket (morning/midday/evening/late), content_format (video/carousel/image/caption/text/avatar/storyboard).",
     {
-      project_id: z37.string().uuid().optional().describe("Project UUID. Defaults to the authenticated user default project."),
-      platform: z37.enum([
+      project_id: z38.string().uuid().optional().describe("Project UUID. Defaults to the authenticated user default project."),
+      platform: z38.enum([
         "instagram",
         "tiktok",
         "youtube",
@@ -14458,7 +15805,7 @@ function registerBanditStateTools(server) {
       ]).optional().describe(
         "Lowercase platform name. Omit to return both platform-scoped and legacy platform-agnostic arms."
       ),
-      arm_type: z37.enum([
+      arm_type: z38.enum([
         "hook_family",
         "hook_type",
         "format",
@@ -14472,8 +15819,8 @@ function registerBanditStateTools(server) {
         "posting_time_bucket",
         "content_format"
       ]).optional().describe("Arm dimension. Omit to return all types grouped."),
-      top_k: z37.number().min(1).max(50).optional().describe("Max arms per (arm_type) group. Default 5."),
-      response_format: z37.enum(["text", "json"]).optional().describe("Output format. Defaults to text.")
+      top_k: z38.number().min(1).max(50).optional().describe("Max arms per (arm_type) group. Default 5."),
+      response_format: z38.enum(["text", "json"]).optional().describe("Output format. Defaults to text.")
     },
     async ({ project_id, platform: platform2, arm_type, top_k, response_format }) => {
       const format = response_format ?? "text";
@@ -14528,12 +15875,128 @@ function registerBanditStateTools(server) {
   );
 }
 
+// src/tools/lifecycle.ts
+import { z as z39 } from "zod";
+init_supabase();
+function envelope(data) {
+  return {
+    _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+    data
+  };
+}
+function lifecycleFailure(error) {
+  if (/not_found|not found/i.test(error)) {
+    return toolError("not_found", "The requested object was not found in this project.");
+  }
+  if (/not_cancellable|publishing_in_progress|schedule_conflict|post_in_progress/i.test(error)) {
+    return toolError("validation_error", "The object can no longer be cancelled in its current state.", {
+      recover_with: ["Refresh its status before deciding the next action."]
+    });
+  }
+  return toolError("upstream_error", "The lifecycle operation could not be completed. Please retry.");
+}
+async function projectContext(projectId) {
+  return projectId ?? await getDefaultProjectId();
+}
+async function invokeLifecycle(action, projectId, identifiers) {
+  const resolvedProjectId = await projectContext(projectId);
+  if (!resolvedProjectId) {
+    return toolError("validation_error", "A project_id is required because no default project is configured.");
+  }
+  const { data, error } = await callEdgeFunction("mcp-data", {
+    action,
+    projectId: resolvedProjectId,
+    project_id: resolvedProjectId,
+    ...identifiers
+  });
+  if (error) return lifecycleFailure(error);
+  if (!data?.success) return toolError("upstream_error", "The lifecycle operation returned no result.");
+  const result = envelope(data);
+  return {
+    structuredContent: result,
+    content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+  };
+}
+var PROJECT_ID = z39.string().uuid().optional().describe("Brand/project ID. Defaults to the authenticated key's project or account default.");
+var CONFIRM = z39.literal(true).describe("Must be true only after the user explicitly confirms this destructive action.");
+function registerLifecycleTools(server) {
+  server.tool(
+    "cancel_async_job",
+    "Cancel an owned pending async generation/render job before a worker starts it. If credits were already debited, the backend attempts an idempotent refund and reports the result. Processing or terminal jobs are not cancellable.",
+    {
+      job_id: z39.string().uuid().describe("Owned async_jobs ID returned by a generation tool."),
+      project_id: PROJECT_ID,
+      confirm: CONFIRM
+    },
+    async ({ job_id, project_id }) => invokeLifecycle("cancel-async-job", project_id, { job_id })
+  );
+  server.tool(
+    "cancel_scheduled_post",
+    "Cancel an owned draft, pending, or scheduled post before publishing starts. This closes its pending schedule job first; it refuses once a worker has claimed the publication.",
+    {
+      post_id: z39.string().uuid().describe("Owned scheduled post ID."),
+      project_id: PROJECT_ID,
+      confirm: CONFIRM
+    },
+    async ({ post_id, project_id }) => invokeLifecycle("cancel-scheduled-post", project_id, { post_id })
+  );
+  server.tool(
+    "delete_carousel",
+    "Delete an owned carousel content-history record from one project. Stored media is retained until the normal retention cleanup; this does not delete already-published platform posts.",
+    {
+      content_id: z39.string().uuid().describe("Owned carousel content_history ID."),
+      project_id: PROJECT_ID,
+      confirm: CONFIRM
+    },
+    async ({ content_id, project_id }) => invokeLifecycle("delete-carousel", project_id, { content_id })
+  );
+  server.tool(
+    "delete_content_plan",
+    "Permanently delete an owned content plan in one project. This does not cancel posts that were already scheduled from the plan.",
+    {
+      plan_id: z39.string().uuid().describe("Owned content plan ID."),
+      project_id: PROJECT_ID,
+      confirm: CONFIRM
+    },
+    async ({ plan_id, project_id }) => invokeLifecycle("delete-content-plan", project_id, { plan_id })
+  );
+  server.tool(
+    "delete_autopilot_config",
+    "Permanently delete an owned autopilot configuration in one project. Historical runs and already-published posts are retained.",
+    {
+      config_id: z39.string().uuid().describe("Owned autopilot configuration ID."),
+      project_id: PROJECT_ID,
+      confirm: CONFIRM
+    },
+    async ({ config_id, project_id }) => invokeLifecycle("delete-autopilot-config", project_id, { config_id })
+  );
+}
+
 // src/lib/register-tools.ts
+var BASE64_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["file_data", "fileData"]);
+var DATA_URI_PREFIX2 = /^data:[\w.+-]+\/[\w.+-]+;base64,/;
+var STRICT_BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+function redactBase64Payloads(args) {
+  if (typeof args !== "object" || args === null || Array.isArray(args)) return args;
+  let changed = false;
+  const out = { ...args };
+  for (const key of BASE64_PAYLOAD_KEYS) {
+    const value = out[key];
+    if (typeof value !== "string" || value.length < 64) continue;
+    const body = value.replace(DATA_URI_PREFIX2, "");
+    if (STRICT_BASE64.test(body)) {
+      out[key] = `[base64:${body.length} chars omitted from prose scan]`;
+      changed = true;
+    }
+  }
+  return changed ? out : args;
+}
 function wrapToolWithScanner(toolName, handler) {
   return async function scannerWrappedHandler(...handlerArgs) {
     const args = handlerArgs[0];
     const ctx = handlerArgs[1];
-    const inputText = args === void 0 ? "{}" : typeof args === "string" ? args : JSON.stringify(args);
+    const scanArgs = redactBase64Payloads(args);
+    const inputText = scanArgs === void 0 ? "{}" : typeof scanArgs === "string" ? scanArgs : JSON.stringify(scanArgs);
     const inputScan = scan(inputText, {
       mode: "block",
       source: "mcp_tool_input",
@@ -14561,6 +16024,16 @@ function wrapToolWithScanner(toolName, handler) {
       source: "mcp_tool_output",
       user_id: ctx?.userId
     });
+    if (!outputScan.passed) {
+      try {
+        ctx?.logScan?.(toolName, "output", outputScan);
+      } catch {
+      }
+      return toolError(
+        "server_error",
+        "The response exceeded the safe output limit and was not returned."
+      );
+    }
     if (outputScan.sanitized_text !== void 0) {
       try {
         ctx?.logScan?.(toolName, "output", outputScan);
@@ -14569,7 +16042,10 @@ function wrapToolWithScanner(toolName, handler) {
       try {
         return JSON.parse(outputScan.sanitized_text);
       } catch {
-        return result;
+        return toolError(
+          "server_error",
+          "The response could not be returned safely. Please retry or contact support."
+        );
       }
     }
     return result;
@@ -14619,8 +16095,7 @@ function applyScopeEnforcement(server, scopeResolver) {
             details: {
               source: "wrapper",
               // A thrown exception escaped the handler — an unclassified fault.
-              error_type: "server_error",
-              exception: err instanceof Error ? err.message.slice(0, 200) : "unknown"
+              error_type: "server_error"
             }
           });
           throw err;
@@ -14753,24 +16228,26 @@ function registerAllTools(server, options) {
   registerSkillsTools(server);
   registerLoopPulseTools(server);
   registerBanditStateTools(server);
+  registerLifecycleTools(server);
   if (!options?.skipApps) {
     registerContentCalendarApp(server);
+    registerAnalyticsPulseApp(server);
   }
   applyAnnotations(server);
 }
 
 // src/prompts.ts
-import { z as z38 } from "zod";
+import { z as z40 } from "zod";
 function registerPrompts(server) {
   server.prompt(
     "create_weekly_content_plan",
     "Generate a full week of social media content (7 days, multiple platforms). Returns a structured plan with topics, formats, and posting times.",
     {
-      niche: z38.string().describe('Your content niche or industry (e.g., "fitness coaching", "SaaS marketing")'),
-      platforms: z38.string().optional().describe(
+      niche: z40.string().describe('Your content niche or industry (e.g., "fitness coaching", "SaaS marketing")'),
+      platforms: z40.string().optional().describe(
         'Comma-separated platforms to target (default: "YouTube, Instagram, TikTok, LinkedIn")'
       ),
-      tone: z38.string().optional().describe('Brand tone of voice (e.g., "professional", "casual", "bold and edgy")')
+      tone: z40.string().optional().describe('Brand tone of voice (e.g., "professional", "casual", "bold and edgy")')
     },
     ({ niche, platforms, tone }) => {
       const targetPlatforms = platforms || "YouTube, Instagram, TikTok, LinkedIn";
@@ -14812,8 +16289,8 @@ After building the plan, use \`save_content_plan\` to save it.`
     "analyze_top_content",
     "Analyze your best-performing posts to identify patterns and replicate success. Returns insights on hooks, formats, timing, and topics that resonate.",
     {
-      timeframe: z38.string().optional().describe('Analysis period (default: "30 days"). E.g., "7 days", "90 days"'),
-      platform: z38.string().optional().describe('Filter to a specific platform (e.g., "youtube", "instagram")')
+      timeframe: z40.string().optional().describe('Analysis period (default: "30 days"). E.g., "7 days", "90 days"'),
+      platform: z40.string().optional().describe('Filter to a specific platform (e.g., "youtube", "instagram")')
     },
     ({ timeframe, platform: platform2 }) => {
       const period = timeframe || "30 days";
@@ -14850,10 +16327,10 @@ Format as a clear, actionable performance report.`
     "repurpose_content",
     "Take one piece of content and transform it into 8-10 pieces across multiple platforms and formats.",
     {
-      source: z38.string().describe(
+      source: z40.string().describe(
         "The source content to repurpose \u2014 a URL, transcript, or the content text itself"
       ),
-      target_platforms: z38.string().optional().describe(
+      target_platforms: z40.string().optional().describe(
         'Comma-separated target platforms (default: "Twitter, LinkedIn, Instagram, TikTok, YouTube")'
       )
     },
@@ -14895,9 +16372,9 @@ For each piece, include the platform, format, character count, and suggested pos
     "setup_brand_voice",
     "Define or refine your brand voice profile so all generated content stays on-brand. Walks through tone, audience, values, and style.",
     {
-      brand_name: z38.string().describe("Your brand or business name"),
-      industry: z38.string().optional().describe('Your industry or niche (e.g., "B2B SaaS", "fitness coaching")'),
-      website: z38.string().optional().describe("Your website URL for context")
+      brand_name: z40.string().describe("Your brand or business name"),
+      industry: z40.string().optional().describe('Your industry or niche (e.g., "B2B SaaS", "fitness coaching")'),
+      website: z40.string().optional().describe("Your website URL for context")
     },
     ({ brand_name, industry, website }) => {
       const industryContext = industry ? ` in the ${industry} space` : "";
@@ -15260,11 +16737,7 @@ init_request_context();
 
 // src/lib/discovery-catalog.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-var PUBLIC_SCHEMA_OMIT_PROPERTIES = {
-  // Internal lineage fields are accepted by the runtime for Social Neuron's own
-  // automation, but should not be advertised in public MCP/OpenAPI discovery.
-  schedule_post: ["origin", "hermes_run_id"]
-};
+var PUBLIC_SCHEMA_OMIT_PROPERTIES = {};
 var cached = /* @__PURE__ */ new Map();
 function buildDiscoveryCatalog(profile = "full") {
   const existing = cached.get(profile);
@@ -15391,7 +16864,9 @@ function buildOpenApiDocument() {
 async function computeOpenApiDocument() {
   const discovery = await buildDiscoveryCatalog();
   const schemaByName = new Map(discovery.map((t) => [t.name, t.inputSchema]));
-  const publicTools = TOOL_CATALOG.filter((t) => !t.localOnly && !t.internal);
+  const publicTools = TOOL_CATALOG.filter(
+    (t) => !t.localOnly && !t.internal && !t.hiddenFromPublicCount
+  );
   const paths = {};
   for (const tool of publicTools) {
     const scope = TOOL_SCOPES[tool.name];
@@ -15474,7 +16949,11 @@ function getCallHandler() {
   return cachedCallHandler;
 }
 function restToolNames() {
-  return new Set(TOOL_CATALOG.filter((t) => !t.localOnly && !t.internal).map((t) => t.name));
+  return new Set(
+    TOOL_CATALOG.filter((t) => !t.localOnly && !t.internal && !t.hiddenFromPublicCount).map(
+      (t) => t.name
+    )
+  );
 }
 async function invokeToolRest(name, args) {
   const handler = getCallHandler();
@@ -15549,7 +17028,7 @@ function httpStatusForResult(result) {
 }
 
 // src/lib/token-verifier.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import * as jose from "jose";
 var jwks = null;
 function getJWKS(supabaseUrl) {
@@ -15560,10 +17039,21 @@ function getJWKS(supabaseUrl) {
   return jwks;
 }
 var tokenValidationCache = /* @__PURE__ */ new Map();
-var CONNECTOR_TOKEN_VALIDATION_CACHE_TTL_MS = 3e5;
+var CONNECTOR_TOKEN_VALIDATION_CACHE_TTL_MS = 6e4;
 var DEFAULT_MCP_RESOURCE = "https://mcp.socialneuron.com";
+var VALID_MCP_SCOPES = new Set(getAllScopes());
+function validScopes(value) {
+  if (!Array.isArray(value)) return [];
+  return Array.from(
+    new Set(
+      value.filter(
+        (scope) => typeof scope === "string" && VALID_MCP_SCOPES.has(scope)
+      )
+    )
+  );
+}
 function cacheKey(token) {
-  return createHash3("sha256").update(token).digest("hex");
+  return createHash2("sha256").update(token).digest("hex");
 }
 function evictFromCache(token) {
   tokenValidationCache.delete(cacheKey(token));
@@ -15598,6 +17088,7 @@ async function verifyCachedOpaqueToken(token, validate, ttlMs) {
 }
 function createTokenVerifier(options) {
   const { supabaseUrl, supabaseAnonKey } = options;
+  const allowSupabaseSessionTokens = options.allowSupabaseSessionTokens ?? process.env.MCP_ALLOW_SUPABASE_SESSION_TOKENS === "true";
   const expectedResource = normalizeResource(
     options.resource ?? process.env.MCP_RESOURCE_URL ?? process.env.MCP_SERVER_URL
   ) ?? DEFAULT_MCP_RESOURCE;
@@ -15613,7 +17104,10 @@ function createTokenVerifier(options) {
           CONNECTOR_TOKEN_VALIDATION_CACHE_TTL_MS
         );
       }
-      return verifySupabaseJwt(token, supabaseUrl);
+      if (!allowSupabaseSessionTokens) {
+        throw new Error("Unsupported access token");
+      }
+      return verifySupabaseJwt(token, supabaseUrl, supabaseAnonKey);
     }
   };
 }
@@ -15621,7 +17115,10 @@ function normalizeResource(value) {
   if (!value) return void 0;
   try {
     const parsed = new URL(value);
-    return `${parsed.protocol}//${parsed.host}`;
+    parsed.hash = "";
+    parsed.search = "";
+    if (parsed.pathname !== "/") parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+    return parsed.toString().replace(/\/$/, "");
   } catch {
     return value.replace(/\/$/, "");
   }
@@ -15635,7 +17132,7 @@ function audienceIncludesExpected(audience, expectedResource) {
   }
   return false;
 }
-async function verifySupabaseJwt(token, supabaseUrl) {
+async function verifySupabaseJwt(token, supabaseUrl, supabaseAnonKey) {
   const jwksKeySet = getJWKS(supabaseUrl);
   const { payload } = await jose.jwtVerify(token, jwksKeySet, {
     issuer: `${supabaseUrl}/auth/v1`,
@@ -15647,14 +17144,41 @@ async function verifySupabaseJwt(token, supabaseUrl) {
   if (!userId) {
     throw new Error("JWT missing sub claim");
   }
-  const appMetadata = payload.app_metadata ?? {};
-  const scopes = Array.isArray(appMetadata.mcp_scopes) ? appMetadata.mcp_scopes.map(String) : ["mcp:read"];
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 1e4);
+  let entitlements;
+  try {
+    const response = await fetch(
+      `${supabaseUrl}/functions/v1/mcp-auth?action=validate-user-token`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${supabaseAnonKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ access_token: token }),
+        signal: controller.signal
+      }
+    );
+    if (!response.ok) throw new Error("JWT entitlement validation unavailable");
+    entitlements = await response.json();
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new Error("JWT entitlement validation timed out");
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+  if (!entitlements.valid || entitlements.userId !== userId) {
+    throw new Error("JWT is not authorized for MCP");
+  }
   return {
     token,
     clientId: payload.client_id ?? "supabase-oauth",
-    scopes,
+    scopes: validScopes(entitlements.scopes),
     expiresAt: payload.exp,
-    extra: { userId }
+    extra: { userId, tier: entitlements.tier }
   };
 }
 async function verifyApiKey(apiKey, supabaseUrl, supabaseAnonKey) {
@@ -15686,12 +17210,12 @@ async function verifyApiKey(apiKey, supabaseUrl, supabaseAnonKey) {
       throw new Error("API key expired");
     }
     const projectId = data.projectId ?? data.project_id ?? null;
-    const extra = { userId: data.userId, email: data.email };
+    const extra = { userId: data.userId };
     if (projectId) extra.projectId = projectId;
     return {
       token: apiKey,
       clientId: "api-key",
-      scopes: data.scopes ?? ["mcp:read"],
+      scopes: validScopes(data.scopes),
       expiresAt,
       extra
     };
@@ -15737,9 +17261,9 @@ async function verifyConnectorToken(accessToken, supabaseUrl, supabaseAnonKey, e
     return {
       token: accessToken,
       clientId: data.clientId ?? "connector-oauth",
-      scopes: data.scopes ?? ["mcp:read"],
+      scopes: validScopes(data.scopes),
       expiresAt,
-      extra: { userId: data.userId, email: data.email, resource: expectedResource }
+      extra: { userId: data.userId, resource: expectedResource }
     };
   } catch (err) {
     if (err instanceof Error && err.name === "AbortError") {
@@ -15886,7 +17410,7 @@ function createClientsStore() {
   function markUnavailable(reason) {
     if (supabaseAvailable) {
       console.error(
-        `[oauth] persistent client store unavailable: ${reason}. Falling back to in-memory only for this process. Run the mcp_oauth_clients migration to enable persistence.`
+        `[oauth] persistent client store unavailable: ${sanitizeError(reason)} Falling back to in-memory only for this process. Run the mcp_oauth_clients migration to enable persistence.`
       );
       supabaseAvailable = false;
     }
@@ -15915,7 +17439,7 @@ function createClientsStore() {
           const { error: deleteError } = await supabase.from("mcp_oauth_clients").delete().eq("client_id", clientId);
           if (deleteError) {
             console.error(
-              `[oauth] failed to remove client with disallowed redirect URI: ${deleteError.message}`
+              `[oauth] failed to remove client with disallowed redirect URI: ${sanitizeError(deleteError)}`
             );
           }
           return void 0;
@@ -15976,7 +17500,11 @@ function createOAuthProvider(options) {
   const { supabaseUrl, supabaseAnonKey } = options;
   const appBaseUrl = options.appBaseUrl ?? "https://www.socialneuron.com";
   const clientsStore = createClientsStore();
-  const tokenVerifier2 = createTokenVerifier({ supabaseUrl, supabaseAnonKey });
+  const tokenVerifier2 = createTokenVerifier({
+    supabaseUrl,
+    supabaseAnonKey,
+    resource: options.resource
+  });
   return {
     get clientsStore() {
       return clientsStore;
@@ -16049,12 +17577,11 @@ function createOAuthProvider(options) {
       }
       clearTimeout(timer);
       if (!response.ok) {
-        const err = await response.json().catch(() => ({ error: "Exchange failed" }));
-        throw new Error(err.error ?? `HTTP ${response.status}`);
+        throw new Error(`Authorization code exchange failed (HTTP ${response.status})`);
       }
       const data = await response.json();
       if (!data.access_token) {
-        throw new Error(data.error ?? "No access token returned from exchange");
+        throw new Error("No access token returned from exchange");
       }
       return {
         access_token: data.access_token,
@@ -16086,12 +17613,11 @@ function createOAuthProvider(options) {
           }
         );
         if (!response.ok) {
-          const err = await response.json().catch(() => ({ error: "Refresh failed" }));
-          throw new Error(err.error ?? `HTTP ${response.status}`);
+          throw new Error(`Refresh token exchange failed (HTTP ${response.status})`);
         }
         const data = await response.json();
         if (!data.access_token) {
-          throw new Error(data.error ?? "No access token returned from refresh");
+          throw new Error("No access token returned from refresh");
         }
         return {
           access_token: data.access_token,
@@ -16135,8 +17661,7 @@ function createOAuthProvider(options) {
           throw new Error(`Token revocation failed: HTTP ${response.status}`);
         }
       } catch (err) {
-        const msg = err instanceof Error ? err.message : "unknown";
-        console.error(`[oauth] Token revocation call failed: ${msg}`);
+        console.error(`[oauth] Token revocation call failed: ${sanitizeError(err)}`);
       } finally {
         clearTimeout(timer);
       }
@@ -16148,6 +17673,10 @@ function createOAuthProvider(options) {
 init_posthog();
 
 // src/lib/protected-resource-metadata.ts
+var PROTECTED_RESOURCE_METADATA_PATHS = [
+  "/.well-known/oauth-protected-resource",
+  "/.well-known/oauth-protected-resource/mcp"
+];
 function buildProtectedResourceMetadata(options) {
   return {
     resource: options.resourceUrl,
@@ -16195,18 +17724,16 @@ function parseAllowedOrigins(raw) {
 }
 function buildOriginPolicy(input) {
   const envOrigins = parseAllowedOrigins(input.allowedOriginsEnv);
-  if (envOrigins.size > 0) {
-    return { allowedOrigins: envOrigins, source: "env" };
-  }
-  const fallback = new Set(PRODUCTION_FALLBACK_ORIGINS);
+  const source = envOrigins.size > 0 ? "env" : "fallback";
+  const allowedOrigins = source === "env" ? envOrigins : new Set(PRODUCTION_FALLBACK_ORIGINS);
   for (const configuredUrl of input.configuredUrls ?? []) {
     const normalized = normalizeOrigin(configuredUrl);
-    if (normalized) fallback.add(normalized);
+    if (normalized) allowedOrigins.add(normalized);
   }
-  if (input.nodeEnv !== "production") {
-    for (const origin of DEVELOPMENT_FALLBACK_ORIGINS) fallback.add(origin);
+  if (source === "fallback" && input.nodeEnv !== "production") {
+    for (const origin of DEVELOPMENT_FALLBACK_ORIGINS) allowedOrigins.add(origin);
   }
-  return { allowedOrigins: fallback, source: "fallback" };
+  return { allowedOrigins, source };
 }
 function validateBrowserOrigin(originHeader, policy) {
   if (originHeader === void 0) return { allowed: true, origin: null };
@@ -16218,6 +17745,20 @@ function validateBrowserOrigin(originHeader, policy) {
   return { allowed: true, origin: normalized };
 }
 
+// src/lib/session-lru.ts
+function findOldestIdleSessionId(sessions2, userId) {
+  let candidateId = null;
+  let candidateActivity = Number.POSITIVE_INFINITY;
+  for (const [sessionId, entry] of sessions2) {
+    if (userId !== void 0 && entry.userId !== userId) continue;
+    if (entry.activeRequests > 0) continue;
+    if (entry.lastActivity >= candidateActivity) continue;
+    candidateId = sessionId;
+    candidateActivity = entry.lastActivity;
+  }
+  return candidateId;
+}
+
 // src/http.ts
 process.env.MCP_TRANSPORT = "http";
 var PORT = parseInt(process.env.PORT ?? "8080", 10);
@@ -16227,9 +17768,19 @@ var MCP_SERVER_URL = process.env.MCP_SERVER_URL ?? `http://localhost:${PORT}/mcp
 var APP_BASE_URL = process.env.APP_BASE_URL ?? "https://www.socialneuron.com";
 var NODE_ENV = process.env.NODE_ENV ?? "development";
 var TOOL_PROFILE = resolveToolProfile(process.env.MCP_TOOL_PROFILE);
+var TRUSTED_BROWSER_MCP_CLIENTS = [
+  "https://claude.ai",
+  "https://claude.com",
+  "https://chatgpt.com",
+  "https://chat.openai.com"
+];
 var ORIGIN_POLICY = buildOriginPolicy({
   allowedOriginsEnv: process.env.ALLOWED_ORIGINS,
-  configuredUrls: [APP_BASE_URL, MCP_SERVER_URL],
+  configuredUrls: [
+    APP_BASE_URL,
+    MCP_SERVER_URL,
+    ...TRUSTED_BROWSER_MCP_CLIENTS
+  ],
   nodeEnv: NODE_ENV
 });
 function deriveOAuthIssuerUrl() {
@@ -16254,6 +17805,18 @@ function deriveOAuthIssuerUrl() {
   return "https://mcp.socialneuron.com";
 }
 var OAUTH_ISSUER_URL = deriveOAuthIssuerUrl();
+function logOperationalError(label, error) {
+  const category = error === void 0 ? "An internal error occurred." : sanitizeError(error);
+  console.error(`[MCP HTTP] ${label}: ${category}`);
+}
+function safeEndpointForLog(value) {
+  try {
+    const url = new URL(value);
+    return `${url.origin}${url.pathname}`;
+  } catch {
+    return "[invalid endpoint configuration]";
+  }
+}
 if (!SUPABASE_URL2 || !SUPABASE_ANON_KEY) {
   console.error("[MCP HTTP] Missing SUPABASE_URL or SUPABASE_ANON_KEY");
   process.exit(1);
@@ -16265,17 +17828,19 @@ if (SUPABASE_SERVICE_ROLE_KEY && SUPABASE_SERVICE_ROLE_KEY.length < 100) {
   );
 }
 process.on("uncaughtException", (err) => {
-  console.error(`[MCP HTTP] Uncaught exception: ${err.message}`);
+  logOperationalError("Uncaught exception", err);
   process.exit(1);
 });
 process.on("unhandledRejection", (reason) => {
-  const message = reason instanceof Error ? reason.message : String(reason);
-  console.error(`[MCP HTTP] Unhandled rejection: ${message}`);
+  logOperationalError("Unhandled rejection", reason);
   process.exit(1);
 });
 var tokenVerifier = createTokenVerifier({
   supabaseUrl: SUPABASE_URL2,
-  supabaseAnonKey: SUPABASE_ANON_KEY
+  supabaseAnonKey: SUPABASE_ANON_KEY,
+  // Match RFC 9728 metadata exactly. Opaque connector tokens minted for the
+  // issuer origin must not be replayable at the more-specific /mcp resource.
+  resource: MCP_SERVER_URL
 });
 initPostHog();
 var MAX_SESSIONS = 500;
@@ -16289,15 +17854,46 @@ function countUserSessions(userId) {
   }
   return count;
 }
+async function closeSessionEntry(sessionId, entry) {
+  sessions.delete(sessionId);
+  for (const close of [
+    () => entry.transport.close(),
+    () => entry.server.close()
+  ]) {
+    try {
+      await close();
+    } catch {
+    }
+  }
+}
+async function reclaimOldestIdleSession(userId) {
+  const sessionId = findOldestIdleSessionId(sessions, userId);
+  if (!sessionId) return false;
+  const entry = sessions.get(sessionId);
+  if (!entry) return false;
+  await closeSessionEntry(sessionId, entry);
+  console.log(
+    `[MCP HTTP] Reclaimed one idle ${userId ? "user" : "global"} session.`
+  );
+  return true;
+}
+async function runInSession(entry, callback) {
+  entry.activeRequests += 1;
+  entry.lastActivity = Date.now();
+  try {
+    return await callback();
+  } finally {
+    entry.activeRequests = Math.max(0, entry.activeRequests - 1);
+    entry.lastActivity = Date.now();
+  }
+}
 var cleanupInterval = setInterval(
   () => {
     const now = Date.now();
     for (const [sessionId, entry] of sessions) {
-      if (now - entry.lastActivity > SESSION_TIMEOUT_MS) {
-        entry.transport.close();
-        entry.server.close();
-        sessions.delete(sessionId);
-        console.log(`[MCP HTTP] Cleaned up stale session: ${sessionId}`);
+      if (now - entry.lastActivity > SESSION_TIMEOUT_MS && entry.activeRequests === 0) {
+        void closeSessionEntry(sessionId, entry);
+        console.log("[MCP HTTP] Cleaned up one stale session.");
       }
     }
   },
@@ -16320,7 +17916,7 @@ setInterval(() => {
   }
 }, IP_RATE_CLEANUP_INTERVAL).unref();
 app.use((req, res, next) => {
-  if (req.path === "/health" || req.path === "/.well-known/oauth-protected-resource" || req.path === "/.well-known/oauth-authorization-server" || req.path === "/config")
+  if (req.path === "/health" || PROTECTED_RESOURCE_METADATA_PATHS.includes(req.path) || req.path === "/.well-known/oauth-authorization-server" || req.path === "/config")
     return next();
   const ip = req.ip ?? req.socket.remoteAddress ?? "unknown";
   const now = Date.now();
@@ -16391,7 +17987,8 @@ app.use((req, res, next) => {
 var oauthProvider = createOAuthProvider({
   supabaseUrl: SUPABASE_URL2,
   supabaseAnonKey: SUPABASE_ANON_KEY,
-  appBaseUrl: APP_BASE_URL
+  appBaseUrl: APP_BASE_URL,
+  resource: MCP_SERVER_URL
 });
 var SCOPES_SUPPORTED = [
   "mcp:full",
@@ -16402,7 +17999,7 @@ var SCOPES_SUPPORTED = [
   "mcp:comments",
   "mcp:autopilot"
 ];
-app.get("/.well-known/oauth-protected-resource", (_req, res) => {
+app.get(PROTECTED_RESOURCE_METADATA_PATHS, (_req, res) => {
   res.json(
     buildProtectedResourceMetadata({
       resourceUrl: MCP_SERVER_URL,
@@ -16458,7 +18055,7 @@ app.use((req, _res, next) => {
 app.use((req, res, next) => {
   authRouter(req, res, (err) => {
     if (err) {
-      console.error("[MCP HTTP] Auth router error:", err);
+      logOperationalError("Auth router error", err);
     }
     next(err);
   });
@@ -16491,8 +18088,8 @@ async function authenticateRequest(req, res, next) {
       projectId: authInfo.extra?.projectId ?? null
     };
     next();
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Token verification failed";
+  } catch {
+    const message = "The access token is invalid, expired, or not authorized for MCP.";
     res.setHeader(
       "WWW-Authenticate",
       buildWwwAuthenticateHeader({
@@ -16600,11 +18197,7 @@ app.get(
       status: "ok",
       version: MCP_VERSION,
       transport: "streamable-http",
-      sessions: sessions.size,
-      sessionCap: MAX_SESSIONS,
-      uptime: Math.floor(process.uptime()),
-      memory: Math.round(process.memoryUsage().rss / 1024 / 1024),
-      env: NODE_ENV
+      uptime: Math.floor(process.uptime())
     });
   }
 );
@@ -16656,7 +18249,8 @@ app.post(
       });
       return;
     }
-    const rl = checkRateLimit("read", `rest:${auth.userId}`);
+    const category = rateLimitCategoryForTool(name);
+    const rl = checkRateLimit(category, `rest:${auth.userId}`);
     if (!rl.allowed) {
       res.setHeader("Retry-After", String(rl.retryAfter));
       res.status(429).json({
@@ -16723,7 +18317,9 @@ app.post(
 app.post("/mcp", async (req, res) => {
   const auth = req.auth;
   const existingSessionId = req.headers["mcp-session-id"];
-  const rl = checkRateLimit("read", auth.userId);
+  const requestedTool = req.body?.method === "tools/call" && typeof req.body?.params?.name === "string" ? req.body.params.name : void 0;
+  const category = rateLimitCategoryForTool(requestedTool);
+  const rl = checkRateLimit(category, `mcp:${auth.userId}`);
   if (!rl.allowed) {
     res.setHeader("Retry-After", String(rl.retryAfter));
     res.status(429).json({
@@ -16743,31 +18339,33 @@ app.post("/mcp", async (req, res) => {
         });
         return;
       }
-      entry.lastActivity = Date.now();
-      await requestContext.run(
-        {
-          userId: auth.userId,
-          scopes: auth.scopes,
-          token: auth.token,
-          creditsUsed: 0,
-          assetsGenerated: 0,
-          projectId: auth.projectId
-        },
-        () => entry.transport.handleRequest(req, res, req.body)
+      await runInSession(
+        entry,
+        () => requestContext.run(
+          {
+            userId: auth.userId,
+            scopes: auth.scopes,
+            token: auth.token,
+            creditsUsed: 0,
+            assetsGenerated: 0,
+            projectId: auth.projectId
+          },
+          () => entry.transport.handleRequest(req, res, req.body)
+        )
       );
       return;
     }
-    if (sessions.size >= MAX_SESSIONS) {
+    if (countUserSessions(auth.userId) >= MAX_SESSIONS_PER_USER && !await reclaimOldestIdleSession(auth.userId)) {
       res.status(429).json({
         error: "too_many_sessions",
-        error_description: `Server session limit reached (${MAX_SESSIONS}). Try again later.`
+        error_description: `Per-user session limit reached (${MAX_SESSIONS_PER_USER}); all sessions are active. Close an existing client and retry.`
       });
       return;
     }
-    if (countUserSessions(auth.userId) >= MAX_SESSIONS_PER_USER) {
+    if (sessions.size >= MAX_SESSIONS && !await reclaimOldestIdleSession()) {
       res.status(429).json({
         error: "too_many_sessions",
-        error_description: `Per-user session limit reached (${MAX_SESSIONS_PER_USER}). Close existing sessions or wait for timeout.`
+        error_description: `Server session limit reached (${MAX_SESSIONS}); all sessions are active. Try again later.`
       });
       return;
     }
@@ -16782,14 +18380,17 @@ app.post("/mcp", async (req, res) => {
     });
     registerPrompts(server);
     registerResources(server);
+    let initializedSessionId = null;
     const transport = new StreamableHTTPServerTransport({
       sessionIdGenerator: () => randomUUID4(),
       onsessioninitialized: (sessionId) => {
+        initializedSessionId = sessionId;
         sessions.set(sessionId, {
           transport,
           server,
           lastActivity: Date.now(),
-          userId: auth.userId
+          userId: auth.userId,
+          activeRequests: 1
         });
       }
     });
@@ -16799,20 +18400,29 @@ app.post("/mcp", async (req, res) => {
       }
     };
     await server.connect(transport);
-    await requestContext.run(
-      {
-        userId: auth.userId,
-        scopes: auth.scopes,
-        token: auth.token,
-        creditsUsed: 0,
-        assetsGenerated: 0,
-        projectId: auth.projectId
-      },
-      () => transport.handleRequest(req, res, req.body)
-    );
+    try {
+      await requestContext.run(
+        {
+          userId: auth.userId,
+          scopes: auth.scopes,
+          token: auth.token,
+          creditsUsed: 0,
+          assetsGenerated: 0,
+          projectId: auth.projectId
+        },
+        () => transport.handleRequest(req, res, req.body)
+      );
+    } finally {
+      if (initializedSessionId) {
+        const entry = sessions.get(initializedSessionId);
+        if (entry) {
+          entry.activeRequests = Math.max(0, entry.activeRequests - 1);
+          entry.lastActivity = Date.now();
+        }
+      }
+    }
   } catch (err) {
-    const rawMessage = err instanceof Error ? err.message : "Internal server error";
-    console.error(`[MCP HTTP] POST /mcp error: ${rawMessage}`);
+    logOperationalError("POST /mcp error", err);
     if (!res.headersSent) {
       res.status(500).json({
         jsonrpc: "2.0",
@@ -16832,19 +18442,21 @@ app.get("/mcp", authenticateRequest, async (req, res) => {
     res.status(403).json({ error: "Session belongs to another user" });
     return;
   }
-  entry.lastActivity = Date.now();
   res.setHeader("X-Accel-Buffering", "no");
   res.setHeader("Cache-Control", "no-cache");
-  await requestContext.run(
-    {
-      userId: req.auth.userId,
-      scopes: req.auth.scopes,
-      token: req.auth.token,
-      creditsUsed: 0,
-      assetsGenerated: 0,
-      projectId: req.auth.projectId
-    },
-    () => entry.transport.handleRequest(req, res)
+  await runInSession(
+    entry,
+    () => requestContext.run(
+      {
+        userId: req.auth.userId,
+        scopes: req.auth.scopes,
+        token: req.auth.token,
+        creditsUsed: 0,
+        assetsGenerated: 0,
+        projectId: req.auth.projectId
+      },
+      () => entry.transport.handleRequest(req, res)
+    )
   );
 });
 app.delete(
@@ -16861,18 +18473,13 @@ app.delete(
       res.status(403).json({ error: "Session belongs to another user" });
       return;
     }
-    await entry.transport.close();
-    await entry.server.close();
-    sessions.delete(sessionId);
+    await closeSessionEntry(sessionId, entry);
     res.status(200).json({ status: "session_closed" });
   }
 );
 app.use(
   (err, _req, res, _next) => {
-    console.error(
-      "[MCP HTTP] Unhandled Express error:",
-      err.stack || err.message || err
-    );
+    logOperationalError("Unhandled Express error", err);
     if (res.headersSent) return;
     const e = err;
     const status = e.status ?? e.statusCode;
@@ -16891,9 +18498,8 @@ var httpServer = app.listen(PORT, "0.0.0.0", () => {
     `[MCP HTTP] Social Neuron MCP Server listening on 0.0.0.0:${PORT}`
   );
   console.log(`[MCP HTTP] Health: http://localhost:${PORT}/health`);
-  console.log(`[MCP HTTP] MCP endpoint: ${MCP_SERVER_URL}`);
+  console.log(`[MCP HTTP] MCP endpoint: ${safeEndpointForLog(MCP_SERVER_URL)}`);
   console.log(`[MCP HTTP] Tool profile: ${TOOL_PROFILE}`);
-  console.log(`[MCP HTTP] Environment: ${NODE_ENV}`);
 });
 async function shutdown(signal) {
   console.log(`[MCP HTTP] ${signal} received, shutting down...`);