@socialneuron/mcp-server 1.8.1 → 1.8.2

package/dist/sn.js

@@ -19,7 +19,7 @@ var MCP_VERSION;
 var init_version = __esm({
   "src/lib/version.ts"() {
     "use strict";
-    MCP_VERSION = "1.8.1";
+    MCP_VERSION = "1.8.2";
   }
 });
 
@@ -66,25 +66,140 @@ __export(credentials_exports, {
   saveSupabaseUrl: () => saveSupabaseUrl
 });
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import {
+  closeSync,
+  constants,
+  existsSync,
+  fchmodSync,
+  fstatSync,
+  ftruncateSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
 import { homedir, platform } from "node:os";
 import { join } from "node:path";
+function assertSafeCredentialPaths() {
+  if (platform() === "win32") return;
+  const uid = process.getuid?.();
+  if (existsSync(CONFIG_DIR)) {
+    const directory = lstatSync(CONFIG_DIR);
+    if (directory.isSymbolicLink() || !directory.isDirectory()) {
+      throw new Error("Unsafe Social Neuron credential directory. Refusing to use it.");
+    }
+    if (uid !== void 0 && directory.uid !== uid) {
+      throw new Error("Social Neuron credential directory is not owned by the current user.");
+    }
+  }
+  if (existsSync(CREDENTIALS_FILE)) {
+    const file = lstatSync(CREDENTIALS_FILE);
+    if (file.isSymbolicLink() || !file.isFile()) {
+      throw new Error("Unsafe Social Neuron credential file. Refusing to use it.");
+    }
+    if (uid !== void 0 && file.uid !== uid) {
+      throw new Error("Social Neuron credential file is not owned by the current user.");
+    }
+  }
+}
+function openValidatedCredentialPath(target, kind, flags) {
+  let fd;
+  try {
+    fd = openSync(
+      target,
+      flags | constants.O_NOFOLLOW | (kind === "directory" ? constants.O_DIRECTORY : 0)
+    );
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(`Unsafe Social Neuron credential ${kind}. Refusing to use it.`);
+  }
+  const opened = fstatSync(fd);
+  const uid = process.getuid?.();
+  if ((kind === "directory" ? !opened.isDirectory() : !opened.isFile()) || uid !== void 0 && opened.uid !== uid || kind === "file" && opened.nlink !== 1) {
+    closeSync(fd);
+    throw new Error(`Unsafe Social Neuron credential ${kind}. Refusing to use it.`);
+  }
+  return fd;
+}
+function hardenCredentialPath(target, kind, mode) {
+  const fd = openValidatedCredentialPath(target, kind, constants.O_RDONLY);
+  if (fd === null) return;
+  try {
+    const opened = fstatSync(fd);
+    if ((opened.mode & 63) !== 0) fchmodSync(fd, mode);
+  } finally {
+    closeSync(fd);
+  }
+}
+function hardenCredentialPermissions() {
+  if (platform() === "win32") return;
+  hardenCredentialPath(CONFIG_DIR, "directory", 448);
+  hardenCredentialPath(CREDENTIALS_FILE, "file", 384);
+}
 function readCredentialsFile() {
+  if (platform() !== "win32") hardenCredentialPath(CONFIG_DIR, "directory", 448);
+  const fd = platform() === "win32" ? (() => {
+    try {
+      return openSync(CREDENTIALS_FILE, constants.O_RDONLY);
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    }
+  })() : openValidatedCredentialPath(CREDENTIALS_FILE, "file", constants.O_RDONLY);
+  if (fd === null) return {};
   try {
-    if (!existsSync(CREDENTIALS_FILE)) return {};
-    const raw = readFileSync(CREDENTIALS_FILE, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return {};
+    if (platform() !== "win32") fchmodSync(fd, 384);
+    const parsed = JSON.parse(readFileSync(fd, "utf-8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("Social Neuron credential file is invalid.");
+    }
+    return parsed;
+  } finally {
+    closeSync(fd);
   }
 }
 function writeCredentialsFile(data) {
   if (!existsSync(CONFIG_DIR)) {
     mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
   }
-  writeFileSync(CREDENTIALS_FILE, JSON.stringify(data, null, 2) + "\n", {
-    mode: 384
-  });
+  assertSafeCredentialPaths();
+  const payload = JSON.stringify(data, null, 2) + "\n";
+  if (platform() === "win32") {
+    writeFileSync(CREDENTIALS_FILE, payload, { mode: 384 });
+  } else {
+    let fd;
+    try {
+      fd = openSync(
+        CREDENTIALS_FILE,
+        constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
+        384
+      );
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        throw new Error("Unsafe Social Neuron credential file. Refusing to write it.");
+      }
+      try {
+        fd = openSync(CREDENTIALS_FILE, constants.O_WRONLY | constants.O_NOFOLLOW);
+      } catch {
+        throw new Error("Unsafe Social Neuron credential file. Refusing to write it.");
+      }
+    }
+    try {
+      const opened = fstatSync(fd);
+      const uid = process.getuid?.();
+      if (!opened.isFile() || opened.nlink !== 1 || uid !== void 0 && opened.uid !== uid) {
+        throw new Error("Unsafe Social Neuron credential file. Refusing to write it.");
+      }
+      fchmodSync(fd, 384);
+      ftruncateSync(fd, 0);
+      writeFileSync(fd, payload);
+    } finally {
+      closeSync(fd);
+    }
+  }
+  hardenCredentialPermissions();
 }
 function macKeychainRead(service) {
   try {
@@ -294,7 +409,6 @@ async function validateApiKey(apiKey, _attempt = 0) {
       }
     );
     if (!response.ok) {
-      const text = await response.text();
       const retryable = response.status === 429 || response.status >= 500;
       if (retryable && _attempt < VALIDATE_MAX_RETRIES) {
         await sleep(300 * (_attempt + 1));
@@ -303,11 +417,19 @@ async function validateApiKey(apiKey, _attempt = 0) {
       return {
         valid: false,
         retryable,
-        error: `Validation failed (HTTP ${response.status}): ${text}`
+        error: `Validation failed (HTTP ${response.status}).`
       };
     }
-    return await response.json();
-  } catch (err) {
+    const result = await response.json();
+    if (!result.valid) {
+      return {
+        valid: false,
+        retryable: false,
+        error: "API key is invalid, expired, or revoked."
+      };
+    }
+    return result;
+  } catch {
     if (_attempt < VALIDATE_MAX_RETRIES) {
       await sleep(300 * (_attempt + 1));
       return validateApiKey(apiKey, _attempt + 1);
@@ -315,7 +437,7 @@ async function validateApiKey(apiKey, _attempt = 0) {
     return {
       valid: false,
       retryable: true,
-      error: err instanceof Error ? err.message : String(err)
+      error: "Authentication service is temporarily unavailable."
     };
   }
 }
@@ -336,10 +458,12 @@ __export(posthog_exports, {
   initPostHog: () => initPostHog,
   shutdownPostHog: () => shutdownPostHog
 });
-import { createHash } from "node:crypto";
+import { createHmac, randomBytes } from "node:crypto";
 import { PostHog } from "posthog-node";
 function hashUserId(userId) {
-  return createHash("sha256").update(`${POSTHOG_SALT}:${userId}`).digest("hex").substring(0, 32);
+  const hmac = createHmac("sha256", POSTHOG_PSEUDONYMIZATION_KEY);
+  hmac.update(userId);
+  return hmac.digest("hex").substring(0, 32);
 }
 function initPostHog() {
   if (isTelemetryDisabled()) return;
@@ -375,13 +499,13 @@ async function shutdownPostHog() {
     client = null;
   }
 }
-var POSTHOG_SALT, client;
+var POSTHOG_PSEUDONYMIZATION_KEY, client;
 var init_posthog = __esm({
   "src/lib/posthog.ts"() {
     "use strict";
     init_supabase();
     init_request_context();
-    POSTHOG_SALT = "socialneuron-mcp-ph-v1";
+    POSTHOG_PSEUDONYMIZATION_KEY = process.env.POSTHOG_PSEUDONYMIZATION_KEY || randomBytes(32).toString("hex");
     client = null;
   }
 });
@@ -603,7 +727,7 @@ var init_supabase = __esm({
 });
 
 // src/cli/sn/parse.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash } from "node:crypto";
 function parseSnArgs(argv) {
   const parsed = { _: [] };
   for (let i = 0; i < argv.length; i += 1) {
@@ -633,8 +757,8 @@ function isEnabledFlag(value) {
 }
 function emitSnResult(payload, asJson) {
   if (asJson) {
-    const envelope = { schema_version: "1", ...payload };
-    process.stdout.write(JSON.stringify(envelope, null, 2) + "\n");
+    const envelope2 = { schema_version: "1", ...payload };
+    process.stdout.write(JSON.stringify(envelope2, null, 2) + "\n");
   }
 }
 function isValidHttpsUrl(value) {
@@ -669,7 +793,7 @@ async function checkUrlReachability(url) {
   } catch (error) {
     return {
       ok: false,
-      error: error instanceof Error ? error.message : String(error)
+      error: "Network request failed."
     };
   } finally {
     clearTimeout(timer);
@@ -699,7 +823,7 @@ function buildPublishIdempotencyKey(input) {
     title: input.title ?? "",
     scheduledAt: input.scheduledAt ?? ""
   });
-  return `sn_${createHash2("sha256").update(material).digest("hex").slice(0, 24)}`;
+  return `sn_${createHash("sha256").update(material).digest("hex").slice(0, 24)}`;
 }
 function normalizePlatforms(platformsRaw) {
   const caseMap = {
@@ -802,6 +926,52 @@ var edge_function_exports = {};
 __export(edge_function_exports, {
   callEdgeFunction: () => callEdgeFunction
 });
+function safeGatewayError(responseText, status) {
+  try {
+    const parsed = JSON.parse(responseText);
+    const nested = parsed.error && typeof parsed.error === "object" ? parsed.error : null;
+    const candidates = [
+      nested?.error_type,
+      nested?.code,
+      parsed.error_type,
+      parsed.error_code,
+      parsed.code,
+      typeof parsed.error === "string" ? parsed.error : null
+    ];
+    for (const value of candidates) {
+      if (typeof value !== "string") continue;
+      const normalized = value.trim().toLowerCase();
+      if (SAFE_GATEWAY_ERROR_CODES.has(normalized)) return normalized;
+      const embedded = [...SAFE_GATEWAY_ERROR_CODES].find((code) => normalized.includes(code));
+      if (embedded) return embedded;
+    }
+  } catch {
+  }
+  return `Backend request failed (HTTP ${status}).`;
+}
+function safeFailureData(responseText) {
+  try {
+    const parsed = JSON.parse(responseText);
+    const metric = (name) => {
+      const value = parsed[name];
+      return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+    };
+    const billingStatus = typeof parsed.billing_status === "string" && SAFE_BILLING_STATUSES.has(parsed.billing_status) ? parsed.billing_status : void 0;
+    const failureReason = parsed.failure_reason === "generation_failed" || parsed.failure_reason === "authentication_failed" || parsed.failure_reason === "cancelled_by_user" ? parsed.failure_reason : void 0;
+    const jobStatus = typeof parsed.status === "string" && SAFE_JOB_STATUSES.has(parsed.status) ? parsed.status : void 0;
+    const safe = {
+      ...jobStatus ? { status: jobStatus } : {},
+      ...metric("credits_reserved") !== void 0 ? { credits_reserved: metric("credits_reserved") } : {},
+      ...metric("credits_charged") !== void 0 ? { credits_charged: metric("credits_charged") } : {},
+      ...metric("credits_refunded") !== void 0 ? { credits_refunded: metric("credits_refunded") } : {},
+      ...billingStatus ? { billing_status: billingStatus } : {},
+      ...failureReason ? { failure_reason: failureReason } : {}
+    };
+    return Object.keys(safe).length > 0 ? safe : null;
+  } catch {
+    return null;
+  }
+}
 function getApiKeyOrNull() {
   const envKey = process.env.SOCIALNEURON_API_KEY;
   if (envKey && envKey.trim().length) return envKey.trim();
@@ -872,33 +1042,28 @@ async function callEdgeFunction(functionName, body, options) {
     clearTimeout(timer);
     const responseText = await response.text();
     if (!response.ok) {
-      let errorMessage;
-      try {
-        const errorJson = JSON.parse(responseText);
-        errorMessage = errorJson.error || errorJson.message || responseText;
-      } catch {
-        errorMessage = responseText || `HTTP ${response.status}`;
-      }
+      const errorCode = safeGatewayError(responseText, response.status);
+      const failureData = safeFailureData(responseText);
       if (response.status === 401) {
         return {
-          data: null,
+          data: failureData,
           error: `Authentication failed (HTTP 401). Run 'npx @socialneuron/mcp-server login' to re-authenticate.`
         };
       }
       if (response.status === 403) {
         return {
-          data: null,
-          error: `Forbidden (HTTP 403): ${errorMessage}. This action isn't permitted for your account, plan, or scope \u2014 your connection is still valid.`
+          data: failureData,
+          error: `Forbidden (HTTP 403): ${errorCode}. This action isn't permitted for your account, plan, or scope \u2014 your connection is still valid.`
         };
       }
       if (response.status === 429) {
         const retryAfter = response.headers.get("retry-after") || "60";
         return {
-          data: null,
+          data: failureData,
           error: `Rate limit exceeded (HTTP 429). Wait ${retryAfter}s before retrying. Reduce request frequency or upgrade your plan.`
         };
       }
-      return { data: null, error: errorMessage };
+      return { data: failureData, error: errorCode };
     }
     try {
       const data = JSON.parse(responseText);
@@ -914,15 +1079,48 @@ async function callEdgeFunction(functionName, body, options) {
         error: `Edge Function '${functionName}' timed out after ${timeoutMs}ms`
       };
     }
-    const message = err instanceof Error ? err.message : String(err);
-    return { data: null, error: message };
+    return { data: null, error: "Network request failed. Please retry." };
   }
 }
+var SAFE_GATEWAY_ERROR_CODES, SAFE_BILLING_STATUSES, SAFE_JOB_STATUSES;
 var init_edge_function = __esm({
   "src/lib/edge-function.ts"() {
     "use strict";
     init_supabase();
     init_request_context();
+    SAFE_GATEWAY_ERROR_CODES = /* @__PURE__ */ new Set([
+      "daily_limit_reached",
+      "insufficient_credits",
+      "project_scope_mismatch",
+      "schedule_conflict",
+      "post_not_found",
+      "post_not_reschedulable",
+      "post_in_progress",
+      "not_cancellable",
+      "publishing_in_progress",
+      "plan_upgrade_required",
+      "rate_limited",
+      "validation_error",
+      "permission_denied",
+      "not_found"
+    ]);
+    SAFE_BILLING_STATUSES = /* @__PURE__ */ new Set([
+      "reserved",
+      "charged",
+      "refunded",
+      "failed_no_charge",
+      "refund_pending",
+      "not_charged"
+    ]);
+    SAFE_JOB_STATUSES = /* @__PURE__ */ new Set([
+      "queued",
+      "pending",
+      "processing",
+      "completed",
+      "failed",
+      "cancelled",
+      "canceled"
+    ]);
   }
 });
 
@@ -938,6 +1136,7 @@ function evaluateQuality(input) {
   const firstLine = caption.split("\n")[0]?.trim() ?? "";
   const hashtags = countHashtags(caption);
   const threshold = Math.min(35, Math.max(0, input.threshold ?? 26));
+  const isShortFormX = platforms.length > 0 && platforms.every((p) => p === "twitter") && caption.length <= 280;
   const blockedTerms = [
     ...(input.brandAvoidPatterns ?? []).map((t) => t.trim()).filter(Boolean),
     ...(input.customBannedTerms ?? []).map((t) => t.trim()).filter(Boolean)
@@ -947,11 +1146,12 @@ function evaluateQuality(input) {
   if (firstLine.length >= 20 && firstLine.length <= 120) hookScore += 1;
   if (/[!?]/.test(firstLine) || /\b\d+(\.\d+)?\b/.test(firstLine)) hookScore += 1;
   if (/\b(how|why|stop|avoid|build|launch|scale|grow|mistake)\b/i.test(firstLine)) hookScore += 1;
+  if (isShortFormX) hookScore = Math.max(hookScore, 3);
   categories.push({
     name: "Hook Strength",
     score: Math.min(5, hookScore),
     maxScore: 5,
-    detail: "First line should create curiosity/value within 120 chars."
+    detail: isShortFormX ? "Short-form X: keyword-hook heuristics neutralized; substance judge arbitrates." : "First line should create curiosity/value within 120 chars."
   });
   let clarityScore = 2;
   if (caption.length >= 80 && caption.length <= 1200) clarityScore += 2;
@@ -977,7 +1177,8 @@ function evaluateQuality(input) {
     detail: "Length, title, and hashtag usage should match target platforms."
   });
   let brandScore = 3;
-  const brandKeyword = input.brandKeyword ?? process.env.SOCIALNEURON_BRAND_KEYWORD?.trim();
+  const rawBrandKeyword = input.brandKeyword ?? process.env.SOCIALNEURON_BRAND_KEYWORD?.trim();
+  const brandKeyword = rawBrandKeyword ? rawBrandKeyword.slice(0, 80).replace(/[.*+?^${}()|[\]\\]/g, "\\$&") : null;
   if (brandKeyword && new RegExp("\\b" + brandKeyword + "\\b", "i").test(title + " " + caption))
     brandScore += 1;
   if (!/\b(you|your|customer|audience)\b/i.test(caption)) brandScore -= 1;
@@ -988,11 +1189,12 @@ function evaluateQuality(input) {
       brandScore -= Math.min(2, matched.length);
     }
   }
+  if (isShortFormX) brandScore = Math.max(brandScore, 3);
   categories.push({
     name: "Brand Alignment",
     score: Math.max(0, Math.min(5, brandScore)),
     maxScore: 5,
-    detail: "Voice should match brand context and audience focus."
+    detail: isShortFormX ? "Short-form X: second-person-address heuristic neutralized; blocked terms still enforced." : "Voice should match brand context and audience focus."
   });
   let noveltyScore = 2;
   if (/\b(case study|framework|workflow|playbook|breakdown|behind the scenes)\b/i.test(caption))
@@ -1003,21 +1205,23 @@ function evaluateQuality(input) {
     const matched = blockedTerms.filter((term) => lowerCombined.includes(term.toLowerCase()));
     if (matched.length > 0) noveltyScore -= Math.min(2, matched.length);
   }
+  if (isShortFormX) noveltyScore = Math.max(noveltyScore, 3);
   categories.push({
     name: "Novelty",
     score: Math.max(0, Math.min(5, noveltyScore)),
     maxScore: 5,
-    detail: "Avoid generic phrasing; include distinct angle."
+    detail: isShortFormX ? "Short-form X: keyword-novelty neutralized; substance judge arbitrates." : "Avoid generic phrasing; include distinct angle."
   });
   let ctaScore = 2;
   if (/\b(comment|reply|share|save|follow|subscribe|click|try|book|download)\b/i.test(caption))
     ctaScore += 2;
   if (/\?$/.test(firstLine)) ctaScore += 1;
+  if (isShortFormX) ctaScore = Math.max(ctaScore, 3);
   categories.push({
     name: "CTA Strength",
     score: Math.min(5, ctaScore),
     maxScore: 5,
-    detail: "Should include a clear next action."
+    detail: isShortFormX ? "Short-form X: explicit CTA optional; native posts may close without one." : "Should include a clear next action."
   });
   let safetyScore = 5;
   if (/\b(guarantee|guaranteed|no risk|risk-free|always works|100%)\b/i.test(caption))
@@ -2022,9 +2226,6 @@ function searchTools(query) {
     (t) => t.name.toLowerCase().includes(q) || t.description.toLowerCase().includes(q)
   );
 }
-function getModules() {
-  return [...new Set(TOOL_CATALOG.map((t) => t.module))];
-}
 var TOOL_CATALOG;
 var init_tool_catalog = __esm({
   "src/lib/tool-catalog.ts"() {
@@ -2099,6 +2300,26 @@ var init_tool_catalog = __esm({
         module: "carousel",
         scope: "mcp:write"
       },
+      {
+        name: "cancel_async_job",
+        description: "Cancel an owned pending async job and refund an eligible debit",
+        module: "lifecycle",
+        scope: "mcp:write",
+        task_intent: "Stop a queued generation or render before worker execution",
+        use_when: "The user explicitly wants to cancel a pending job and has confirmed the action.",
+        avoid_when: "The job is already processing or terminal; check_status instead.",
+        next_tools: ["check_status", "get_credit_balance"]
+      },
+      {
+        name: "delete_carousel",
+        description: "Delete an owned carousel content record from one project",
+        module: "lifecycle",
+        scope: "mcp:write",
+        task_intent: "Remove an unwanted carousel record from Social Neuron",
+        use_when: "The user explicitly confirms deletion and understands stored media follows normal retention.",
+        avoid_when: "The user expects an already-published social post or retained media object to be removed.",
+        next_tools: ["list_recent_posts"]
+      },
       // media
       {
         name: "upload_media",
@@ -2119,6 +2340,26 @@ var init_tool_catalog = __esm({
         module: "distribution",
         scope: "mcp:distribute"
       },
+      {
+        name: "reschedule_post",
+        description: "Atomically move an unclaimed scheduled post to a new time within its brand project",
+        module: "distribution",
+        scope: "mcp:distribute",
+        task_intent: "Move an already scheduled post without creating a duplicate publication",
+        use_when: "A pending or scheduled post needs a different future publication time.",
+        avoid_when: "The post is already publishing or published; create a new post instead.",
+        next_tools: ["list_recent_posts", "open_content_calendar"]
+      },
+      {
+        name: "cancel_scheduled_post",
+        description: "Cancel an owned scheduled post before publishing begins",
+        module: "lifecycle",
+        scope: "mcp:distribute",
+        task_intent: "Unschedule a post without publishing it",
+        use_when: "The user explicitly confirms cancellation of a draft, pending, or scheduled post.",
+        avoid_when: "The post is already publishing or published.",
+        next_tools: ["list_recent_posts", "open_content_calendar"]
+      },
       {
         name: "list_recent_posts",
         description: "List recently published or scheduled posts",
@@ -2309,6 +2550,16 @@ var init_tool_catalog = __esm({
         module: "planning",
         scope: "mcp:write"
       },
+      {
+        name: "delete_content_plan",
+        description: "Permanently delete an owned content plan from one project",
+        module: "lifecycle",
+        scope: "mcp:write",
+        task_intent: "Remove an obsolete saved content plan",
+        use_when: "The user explicitly confirms permanent deletion of a specific plan.",
+        avoid_when: "The plan has scheduled posts the user also expects to cancel; cancel those posts separately.",
+        next_tools: ["plan_content_week", "list_recent_posts"]
+      },
       {
         name: "submit_content_plan_for_approval",
         description: "Submit a content plan for team approval",
@@ -2403,6 +2654,16 @@ var init_tool_catalog = __esm({
         module: "autopilot",
         scope: "mcp:autopilot"
       },
+      {
+        name: "delete_autopilot_config",
+        description: "Permanently delete an owned autopilot configuration from one project",
+        module: "lifecycle",
+        scope: "mcp:autopilot",
+        task_intent: "Remove an autopilot configuration while retaining historical run records",
+        use_when: "The user explicitly confirms deletion of the configuration.",
+        avoid_when: "The user only wants to pause or edit automation, or expects historical posts to be deleted.",
+        next_tools: ["list_autopilot_configs"]
+      },
       // extraction
       {
         name: "extract_url_content",
@@ -2519,7 +2780,13 @@ var init_tool_catalog = __esm({
       // apps (MCP Apps — interactive UI inside the host)
       {
         name: "open_content_calendar",
-        description: "Open an interactive drag-drop calendar of the user's scheduled posts inside the host (Claude Desktop / claude.ai). Renders an MCP App; backed by list_recent_posts, schedule_post, find_next_slots \u2014 no new tools needed.",
+        description: "Open a project-scoped interactive calendar inside MCP App-capable hosts. Uses reschedule_post for conflict-safe drag/drop and schedule_post for new posts.",
+        module: "apps",
+        scope: "mcp:read"
+      },
+      {
+        name: "open_analytics_pulse",
+        description: "Open a project-scoped interactive performance dashboard with views, engagement, platform mix, and top posts.",
         module: "apps",
         scope: "mcp:read"
       },
@@ -2634,6 +2901,12 @@ var init_tool_catalog = __esm({
         module: "skills",
         scope: "mcp:read"
       },
+      {
+        name: "get_skill",
+        description: "Fetch the full body and current compiled guidance for one Social Neuron skill by slug.",
+        module: "skills",
+        scope: "mcp:read"
+      },
       {
         name: "run_skill",
         description: "Run a Social Neuron workflow skill end-to-end (brand-locked content production). Returns a structured run preview with the step plan, credit cost, and a deep-link to launch in the SN dashboard.",
@@ -2665,17 +2938,21 @@ __export(discovery_exports, {
   handleInfo: () => handleInfo,
   handleTools: () => handleTools
 });
+function publicStdioTools() {
+  return TOOL_CATALOG.filter(
+    (t) => !t.internal && !t.hiddenFromPublicCount && t.module !== "apps"
+  );
+}
 async function handleTools(args, asJson) {
-  let tools = TOOL_CATALOG;
+  let tools = publicStdioTools();
   const scope = args.scope;
   if (typeof scope === "string") {
-    tools = getToolsByScope(scope);
+    tools = tools.filter((tool) => tool.scope === scope);
   }
   const module = args.module;
   if (typeof module === "string") {
-    tools = getToolsByModule(module);
+    tools = tools.filter((tool) => tool.module === module);
   }
-  tools = tools.filter((t) => !t.internal);
   if (asJson) {
     emitSnResult({ ok: true, command: "tools", toolCount: tools.length, tools }, true);
     return;
@@ -2704,27 +2981,31 @@ Module: ${moduleName} (${moduleTools.length} tools)`);
   process.exit(0);
 }
 async function handleInfo(args, asJson) {
+  const stdioTools = publicStdioTools();
   const info = {
     version: MCP_VERSION,
-    toolCount: TOOL_CATALOG.filter((t) => !t.internal).length,
-    modules: getModules()
+    toolCount: stdioTools.length,
+    modules: Array.from(new Set(stdioTools.map((tool) => tool.module))).sort(),
+    auth: null
   };
-  try {
-    const { loadApiKey: loadApiKey2 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));
-    const { validateApiKey: validateApiKey2 } = await Promise.resolve().then(() => (init_api_keys(), api_keys_exports));
-    const apiKey = await loadApiKey2();
-    if (apiKey) {
-      const result = await validateApiKey2(apiKey);
-      if (result.valid) {
-        info.auth = {
-          email: result.email || null,
-          scopes: result.scopes || [],
-          expiresAt: result.expiresAt || null
-        };
+  if (!isEnabledFlag(args.offline)) {
+    try {
+      const { loadApiKey: loadApiKey2 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));
+      const { validateApiKey: validateApiKey2 } = await Promise.resolve().then(() => (init_api_keys(), api_keys_exports));
+      const apiKey = await loadApiKey2();
+      if (apiKey) {
+        const result = await validateApiKey2(apiKey);
+        if (result.valid) {
+          info.auth = {
+            email: result.email || null,
+            scopes: result.scopes || [],
+            expiresAt: result.expiresAt || null
+          };
+        }
       }
+    } catch {
+      info.auth = null;
     }
-  } catch {
-    info.auth = null;
   }
   if (info.auth) {
     try {
@@ -2838,6 +3119,9 @@ var init_scopes = __esm({
       generate_carousel: "mcp:write",
       create_carousel: "mcp:write",
       upload_media: "mcp:write",
+      cancel_async_job: "mcp:write",
+      delete_carousel: "mcp:write",
+      delete_content_plan: "mcp:write",
       // mcp:read (media)
       get_media_url: "mcp:read",
       // F4 Hyperframes — HTML composition runtime
@@ -2845,6 +3129,8 @@ var init_scopes = __esm({
       render_hyperframes: "mcp:write",
       // mcp:distribute
       schedule_post: "mcp:distribute",
+      reschedule_post: "mcp:distribute",
+      cancel_scheduled_post: "mcp:distribute",
       start_platform_connection: "mcp:distribute",
       // mcp:analytics
       refresh_platform_analytics: "mcp:analytics",
@@ -2859,6 +3145,7 @@ var init_scopes = __esm({
       list_autopilot_configs: "mcp:autopilot",
       update_autopilot_config: "mcp:autopilot",
       get_autopilot_status: "mcp:autopilot",
+      delete_autopilot_config: "mcp:autopilot",
       // Recipes
       list_recipes: "mcp:read",
       get_recipe_details: "mcp:read",
@@ -2902,6 +3189,7 @@ var init_scopes = __esm({
       detect_anomalies: "mcp:analytics",
       // mcp:read (Apps — entry tool for the Content Calendar MCP App; reads recent posts)
       open_content_calendar: "mcp:read",
+      open_analytics_pulse: "mcp:read",
       // mcp:write (Agentic harness — learning loop write-back)
       write_agent_reflection: "mcp:write",
       record_outcome: "mcp:write",
@@ -2917,6 +3205,7 @@ var init_scopes = __esm({
       get_active_campaigns: "mcp:read",
       // mcp:read / mcp:write (Skills)
       list_skills: "mcp:read",
+      get_skill: "mcp:read",
       run_skill: "mcp:write",
       // mcp:read (Loop observability — growth-loop KPIs + content learning state)
       get_loop_pulse: "mcp:read",
@@ -3043,6 +3332,11 @@ var init_tool_annotations = __esm({
     OVERRIDES = {
       // Destructive or overwrite tools
       delete_comment: { destructiveHint: true },
+      cancel_async_job: { destructiveHint: true, idempotentHint: true },
+      cancel_scheduled_post: { destructiveHint: true, idempotentHint: true, openWorldHint: true },
+      delete_carousel: { destructiveHint: true, idempotentHint: true },
+      delete_content_plan: { destructiveHint: true, idempotentHint: true },
+      delete_autopilot_config: { destructiveHint: true, idempotentHint: true },
       moderate_comment: { destructiveHint: true },
       save_brand_profile: { destructiveHint: true, idempotentHint: true },
       update_platform_voice: { destructiveHint: true, idempotentHint: true },
@@ -3207,6 +3501,7 @@ var init_tool_profile = __esm({
       "list_hyperframes_blocks",
       "render_hyperframes",
       "list_skills",
+      "get_skill",
       "run_skill"
     ]);
   }
@@ -3240,7 +3535,8 @@ var init_constants = __esm({
         ssn: "\\d{3}-\\d{2}-\\d{4}",
         ip: "(?<![\\d.])(?:\\d{1,3}\\.){3}\\d{1,3}(?![\\d.])"
       },
-      MAX_LENGTH: 1e4
+      MAX_LENGTH: 1e4,
+      MAX_OUTPUT_LENGTH: 1e6
     };
   }
 });
@@ -3337,7 +3633,8 @@ var init_pii = __esm({
 function scan(text, options) {
   const flagged = /* @__PURE__ */ new Set();
   let risk = 0;
-  if (text.length > CONSTANTS.MAX_LENGTH) {
+  const maxLength = options.source === "mcp_tool_output" ? CONSTANTS.MAX_OUTPUT_LENGTH : CONSTANTS.MAX_LENGTH;
+  if (text.length > maxLength) {
     return {
       passed: false,
       risk_score: 1,
@@ -3412,6 +3709,7 @@ var CATEGORY_CONFIGS, RateLimiter, limiters;
 var init_rate_limit = __esm({
   "src/lib/rate-limit.ts"() {
     "use strict";
+    init_scopes();
     CATEGORY_CONFIGS = {
       posting: { maxTokens: 30, refillRate: 30 / 60 },
       // 30 req/min — publish/schedule/comment
@@ -3502,8 +3800,8 @@ function registerIdeationTools(server) {
       brand_voice: z.string().max(500).optional().describe(
         'Tone directive (e.g. "direct, no jargon, second person" or "witty Gen-Z energy with emoji"). Leave blank to auto-load from project brand profile if project_id is set.'
       ),
-      model: z.enum(["gemini-2.0-flash", "gemini-2.5-flash", "gemini-2.5-pro"]).optional().describe(
-        "AI model to use. Defaults to gemini-2.5-flash. Use gemini-2.5-pro for highest quality."
+      model: z.enum(["gemini-2.5-flash", "gemini-2.5-pro"]).optional().describe(
+        "AI model to use. Defaults to gemini-2.5-flash. Use gemini-2.5-pro for highest quality. Retired provider models are intentionally not accepted."
       ),
       project_id: z.string().uuid().optional().describe(
         "Project ID to auto-load brand profile and performance context for prompt enrichment."
@@ -3512,7 +3810,7 @@ function registerIdeationTools(server) {
     async ({ prompt: prompt2, content_type, platform: platform3, brand_voice, model, project_id }) => {
       try {
         const userId = await getDefaultUserId();
-        const rl = checkRateLimit("posting", userId);
+        const rl = checkRateLimit("generation", `generate_content:${userId}`);
         if (!rl.allowed) {
           return {
             content: [
@@ -3769,7 +4067,7 @@ Content Type: ${content_type}`;
     async ({ content, source_platform, target_platform, brand_voice, project_id }) => {
       try {
         const userId = await getDefaultUserId();
-        const rl = checkRateLimit("posting", userId);
+        const rl = checkRateLimit("generation", `adapt_content:${userId}`);
         if (!rl.allowed) {
           return {
             content: [
@@ -3881,11 +4179,12 @@ function buildCheckStatusPayload(job, liveStatus) {
   const progress = liveStatus?.progress ?? null;
   const resultUrl = liveStatus?.resultUrl ?? job.result_url ?? null;
   const r2Key = resultUrl && !resultUrl.startsWith("http") ? resultUrl : null;
-  const errorMessage = liveStatus?.error ?? job.error_message ?? null;
+  const rawError = liveStatus?.error ?? job.error_message ?? null;
+  const errorMessage = rawError && status === "failed" ? "Generation failed. Retry or choose another model." : rawError && (status === "cancelled" || status === "canceled") ? "Cancelled by user." : null;
   const allUrls = job.result_metadata?.all_urls ?? null;
   const modelRequested = job.result_metadata?.model_requested ?? null;
   const modelDelivered = job.result_metadata?.model_delivered ?? null;
-  const fallbackReason = job.result_metadata?.fallback_reason ?? null;
+  const fallbackReason = job.result_metadata?.fallback_reason ? "Requested model was unavailable; a fallback model was used." : null;
   return {
     job_id: job.id,
     job_type: job.job_type,
@@ -3897,6 +4196,11 @@ function buildCheckStatusPayload(job, liveStatus) {
     all_urls: allUrls,
     error: errorMessage,
     credits_cost: job.credits_cost,
+    credits_reserved: job.credits_reserved ?? null,
+    credits_charged: job.credits_charged ?? null,
+    credits_refunded: job.credits_refunded ?? null,
+    billing_status: job.billing_status ?? "unknown",
+    failure_reason: job.failure_reason ?? null,
     created_at: job.created_at,
     completed_at: job.completed_at,
     model_requested: modelRequested,
@@ -3998,6 +4302,13 @@ var init_budget = __esm({
 
 // src/tools/content.ts
 import { z as z2 } from "zod";
+function buildFallbackDisclosureLine(meta) {
+  const requested = meta?.model_requested;
+  const delivered = meta?.model_delivered;
+  if (!requested || !delivered || requested === delivered) return null;
+  const reason = meta?.fallback_reason ? " because the requested model was unavailable" : "";
+  return `Note: requested "${requested}" but delivered "${delivered}"${reason} \u2014 cost never exceeds the requested model's price.`;
+}
 function asEnvelope2(data) {
   return {
     _meta: {
@@ -4066,7 +4377,7 @@ function registerContentTools(server) {
           isError: true
         };
       }
-      const rateLimit = checkRateLimit("posting", `generate_video:${userId}`);
+      const rateLimit = checkRateLimit("generation", `generate_video:${userId}`);
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -4207,7 +4518,7 @@ function registerContentTools(server) {
           isError: true
         };
       }
-      const rateLimit = checkRateLimit("posting", `generate_image:${userId}`);
+      const rateLimit = checkRateLimit("generation", `generate_image:${userId}`);
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -4347,20 +4658,28 @@ function registerContentTools(server) {
           }
         );
         if (liveStatus) {
+          const livePayload = buildCheckStatusPayload(job, liveStatus);
           const lines2 = [
             `Job: ${job.id}`,
             `Type: ${job.job_type}`,
             `Model: ${job.model}`,
-            `Status: ${liveStatus.status}`,
-            `Progress: ${liveStatus.progress}%`
+            `Status: ${livePayload.status}`,
+            `Progress: ${livePayload.progress}%`
           ];
-          if (liveStatus.resultUrl) {
-            lines2.push(`Result URL: ${liveStatus.resultUrl}`);
+          if (livePayload.result_url) {
+            lines2.push(`Result URL: ${livePayload.result_url}`);
           }
-          if (liveStatus.error) {
-            lines2.push(`Error: ${liveStatus.error}`);
+          if (livePayload.error) {
+            lines2.push(`Error: ${livePayload.error}`);
           }
+          const fallbackDisclosure2 = buildFallbackDisclosureLine(job.result_metadata);
+          if (fallbackDisclosure2) lines2.push(fallbackDisclosure2);
           lines2.push(`Credits: ${job.credits_cost}`);
+          if (job.billing_status) {
+            lines2.push(
+              `Billing: ${job.billing_status} (charged ${job.credits_charged ?? 0}, refunded ${job.credits_refunded ?? 0})`
+            );
+          }
           lines2.push(`Created: ${job.created_at}`);
           if (format === "json") {
             return {
@@ -4378,7 +4697,7 @@ function registerContentTools(server) {
                     // `job` + `liveStatus`; do not duplicate them here.
                     asEnvelope2({
                       ...liveStatus,
-                      ...buildCheckStatusPayload(job, liveStatus)
+                      ...livePayload
                     }),
                     null,
                     2
@@ -4421,7 +4740,14 @@ function registerContentTools(server) {
       if (job.error_message) {
         lines.push(`Error: ${job.error_message}`);
       }
+      const fallbackDisclosure = buildFallbackDisclosureLine(job.result_metadata);
+      if (fallbackDisclosure) lines.push(fallbackDisclosure);
       lines.push(`Credits: ${job.credits_cost}`);
+      if (job.billing_status) {
+        lines.push(
+          `Billing: ${job.billing_status} (charged ${job.credits_charged ?? 0}, refunded ${job.credits_refunded ?? 0})`
+        );
+      }
       lines.push(`Created: ${job.created_at}`);
       if (job.completed_at) {
         lines.push(`Completed: ${job.completed_at}`);
@@ -4651,7 +4977,7 @@ Return ONLY valid JSON in this exact format:
         };
       }
       const rateLimit = checkRateLimit(
-        "posting",
+        "generation",
         `generate_voiceover:${userId}`
       );
       if (!rateLimit.allowed) {
@@ -4818,7 +5144,7 @@ Return ONLY valid JSON in this exact format:
       }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit(
-        "posting",
+        "generation",
         `generate_carousel:${userId}`
       );
       if (!rateLimit.allowed) {
@@ -4972,9 +5298,6 @@ var init_content2 = __esm({
 // src/lib/sanitize-error.ts
 function sanitizeError(error) {
   const msg = error instanceof Error ? error.message : typeof error === "string" ? error : "Unknown error";
-  if (process.env.NODE_ENV !== "production") {
-    console.error("[Error]", msg);
-  }
   for (const [pattern, userMessage] of ERROR_PATTERNS) {
     if (pattern.test(msg)) {
       return userMessage;
@@ -5178,7 +5501,7 @@ var init_ssrf = __esm({
 
 // src/tools/distribution.ts
 import { z as z3 } from "zod";
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 function snakeToCamel(obj) {
   const result = {};
   for (const [key, value] of Object.entries(obj)) {
@@ -5204,6 +5527,87 @@ function asEnvelope3(data) {
     data
   };
 }
+function publicConnectedAccount(value) {
+  if (!value || typeof value !== "object") return null;
+  const row = value;
+  if (typeof row.id !== "string" || typeof row.platform !== "string" || typeof row.status !== "string" || typeof row.created_at !== "string") {
+    return null;
+  }
+  return {
+    id: row.id,
+    platform: row.platform,
+    status: row.status,
+    ...typeof row.effective_status === "string" ? { effective_status: row.effective_status } : {},
+    username: typeof row.username === "string" ? row.username : null,
+    created_at: row.created_at,
+    ...typeof row.updated_at === "string" || row.updated_at === null ? { updated_at: row.updated_at } : {},
+    ...typeof row.expires_at === "string" || row.expires_at === null ? { expires_at: row.expires_at } : {},
+    ...typeof row.has_refresh_token === "boolean" ? { has_refresh_token: row.has_refresh_token } : {},
+    ...typeof row.project_id === "string" || row.project_id === null ? { project_id: row.project_id } : {}
+  };
+}
+function publicPostRecord(value) {
+  if (!value || typeof value !== "object") return null;
+  const row = value;
+  if (typeof row.id !== "string" || typeof row.platform !== "string" || typeof row.status !== "string" || typeof row.created_at !== "string") {
+    return null;
+  }
+  const nullableString = (field) => typeof row[field] === "string" ? row[field] : null;
+  return {
+    id: row.id,
+    platform: row.platform,
+    status: row.status,
+    title: nullableString("title"),
+    external_post_id: nullableString("external_post_id"),
+    published_at: nullableString("published_at"),
+    scheduled_at: nullableString("scheduled_at"),
+    created_at: row.created_at
+  };
+}
+function mediaTypeFromPath(value) {
+  try {
+    const pathname = value.startsWith("http") ? new URL(value).pathname : value;
+    const extension = pathname.split(".").pop()?.toLowerCase();
+    if (!extension) return null;
+    if (VIDEO_FILE_EXTENSIONS.has(extension)) return "VIDEO";
+    if (IMAGE_FILE_EXTENSIONS.has(extension)) return "IMAGE";
+  } catch {
+    return null;
+  }
+  return null;
+}
+function inferScheduleMediaType(explicit, singleCandidates, collectionCandidates) {
+  if (explicit) return explicit;
+  const populatedCollection = collectionCandidates.find(
+    (values) => Array.isArray(values) && values.length > 0
+  );
+  if (populatedCollection) {
+    if (populatedCollection.length > 1) return "CAROUSEL_ALBUM";
+    for (const values of collectionCandidates) {
+      if (!values || values.length !== 1) continue;
+      const inferred = mediaTypeFromPath(values[0]);
+      if (inferred) return inferred;
+    }
+    return null;
+  }
+  for (const value of singleCandidates) {
+    if (typeof value !== "string" || value.length === 0) continue;
+    const inferred = mediaTypeFromPath(value);
+    if (inferred) return inferred;
+  }
+  return null;
+}
+async function validatePublishMediaUrl(url) {
+  try {
+    if (new URL(url).protocol !== "https:") {
+      return "Media URLs must use HTTPS.";
+    }
+  } catch {
+    return "Media URL is invalid.";
+  }
+  const check = await validateUrlForSSRF(url);
+  return check.isValid ? null : check.error || "Media URL failed safety validation.";
+}
 function accountEffectiveStatus(account) {
   return account.effective_status || account.status;
 }
@@ -5222,22 +5626,11 @@ function requestedAccountIdForPlatform(accountId, accountIds, platform3) {
   if (!accountIds) return void 0;
   return accountIds[platform3] || accountIds[platform3.toLowerCase()];
 }
-function isAlreadyR2Signed(url) {
-  try {
-    const u = new URL(url);
-    return u.searchParams.has("X-Amz-Signature");
-  } catch {
-    return false;
-  }
-}
 async function rehostExternalUrl(mediaUrl, projectId) {
   const ssrf = await validateUrlForSSRF(mediaUrl);
   if (!ssrf.isValid) {
     return { error: ssrf.error ?? "URL rejected by SSRF check" };
   }
-  if (isAlreadyR2Signed(mediaUrl)) {
-    return { signedUrl: mediaUrl, r2Key: "" };
-  }
   const { data, error } = await callEdgeFunction(
     "upload-to-r2",
     { url: ssrf.sanitizedUrl ?? mediaUrl, projectId },
@@ -5256,19 +5649,19 @@ function registerDistributionTools(server) {
       media_url: z3.string().optional().describe(
         "URL of the media file to post. Any public HTTPS URL works \u2014 including ephemeral generator URLs (Replicate, OpenAI, DALL-E). The server persists non-R2 URLs into R2 before posting so scheduled posts and byte-upload platforms (X, LinkedIn, YouTube, Bluesky) do not 404 when the source URL expires. Set auto_rehost=false to skip. Not needed if media_urls, r2_key, or job_id is provided."
       ),
-      media_urls: z3.array(z3.string()).optional().describe(
+      media_urls: z3.array(z3.string().url()).min(2).max(10).optional().describe(
         "Array of 2-10 image URLs for carousel posts. Same rehosting rules as media_url \u2014 ephemeral URLs are persisted automatically. Use with media_type=CAROUSEL_ALBUM."
       ),
       r2_key: z3.string().optional().describe(
         "R2 object key from upload_media. Signed on demand at post time \u2014 survives scheduling delays. Alternative to media_url."
       ),
-      r2_keys: z3.array(z3.string()).optional().describe(
+      r2_keys: z3.array(z3.string()).min(2).max(10).optional().describe(
         "Array of R2 object keys for carousel posts. Each is signed on demand. Alternative to media_urls."
       ),
       job_id: z3.string().optional().describe(
         "Async job ID from generate_image/generate_video. Resolves the completed job's R2 key and signs it. Alternative to media_url/r2_key."
       ),
-      job_ids: z3.array(z3.string()).optional().describe(
+      job_ids: z3.array(z3.string()).min(2).max(10).optional().describe(
         "Array of async job IDs for carousel posts. Each resolved to its R2 key. Alternative to media_urls/r2_keys."
       ),
       platform_metadata: z3.object({
@@ -5298,7 +5691,10 @@ function registerDistributionTools(server) {
           category_id: z3.string().optional(),
           tags: z3.array(z3.string()).optional(),
           made_for_kids: z3.boolean().optional(),
-          notify_subscribers: z3.boolean().optional()
+          notify_subscribers: z3.boolean().optional(),
+          contains_synthetic_media: z3.boolean().optional().describe(
+            "YouTube altered-or-synthetic-content disclosure. Defaults to true for MCP posts; set false explicitly for verified non-AI media."
+          )
         }).optional(),
         facebook: z3.object({
           page_id: z3.string().optional().describe("Facebook Page ID to post to."),
@@ -5381,14 +5777,8 @@ function registerDistributionTools(server) {
       auto_rehost: z3.boolean().optional().describe(
         "Whether to persist non-R2 media_url/media_urls into R2 before posting. Default: true. Set to false only if you know the source URL will outlive the scheduling window and every target platform supports URL ingest."
       ),
-      visual_gate_result: z3.object({ passed: z3.boolean() }).passthrough().optional().describe(
-        "Visual QA gate verdict from the carousel/image generation pipeline. Required when mediaType is CAROUSEL_ALBUM, IMAGE, or VIDEO and VISUAL_GATE_ENFORCE is enabled on the EF. Produce with visual_quality_check tool. Must have passed=true for the gate to allow the publish."
-      ),
-      origin: z3.enum(["human", "hermes", "user"]).optional().describe(
-        "Originator lineage for the post. Marks who scheduled it; use the agent value when calling from an autonomous workflow, otherwise default 'human'."
-      ),
-      hermes_run_id: z3.string().optional().describe(
-        "Optional agent run identifier for traceability between a draft and the run that produced it."
+      idempotency_key: z3.string().regex(/^[a-zA-Z0-9_-]{8,128}$/).optional().describe(
+        "Stable 8-128 character retry key (letters, numbers, underscore, hyphen). Reuse the same key when retrying the same publish request to prevent duplicate posts."
       )
     },
     async ({
@@ -5411,9 +5801,7 @@ function registerDistributionTools(server) {
       platform_metadata,
       account_id,
       account_ids,
-      visual_gate_result,
-      origin,
-      hermes_run_id
+      idempotency_key
     }) => {
       const format = response_format ?? "text";
       if ((!caption || caption.trim().length === 0) && (!title || title.trim().length === 0)) {
@@ -5442,6 +5830,8 @@ function registerDistributionTools(server) {
       }
       let resolvedMediaUrl = media_url;
       let resolvedMediaUrls = media_urls;
+      let resolvedMediaUrlIsTrustedR2 = false;
+      let resolvedMediaUrlsAreTrustedR2 = (media_urls ?? []).map(() => false);
       const signR2Key = async (key) => {
         const cleanKey = key.startsWith("r2://") ? key.slice(5) : key;
         const { data: signData } = await callEdgeFunction(
@@ -5459,8 +5849,11 @@ function registerDistributionTools(server) {
         );
         const resultUrl = jobData?.job?.result_url;
         if (!resultUrl) return null;
-        if (!resultUrl.startsWith("http")) return signR2Key(resultUrl);
-        return resultUrl;
+        if (!resultUrl.startsWith("http")) {
+          const signed = await signR2Key(resultUrl);
+          return signed ? { url: signed, trustedR2: true } : null;
+        }
+        return { url: resultUrl, trustedR2: false };
       };
       try {
         if (r2_key && !resolvedMediaUrl) {
@@ -5477,6 +5870,7 @@ function registerDistributionTools(server) {
             };
           }
           resolvedMediaUrl = signed;
+          resolvedMediaUrlIsTrustedR2 = true;
         } else if (job_id && !resolvedMediaUrl && !r2_key) {
           const resolved = await resolveJobId(job_id);
           if (!resolved) {
@@ -5490,7 +5884,8 @@ function registerDistributionTools(server) {
               isError: true
             };
           }
-          resolvedMediaUrl = resolved;
+          resolvedMediaUrl = resolved.url;
+          resolvedMediaUrlIsTrustedR2 = resolved.trustedR2;
         }
         if (r2_keys && r2_keys.length > 0 && !resolvedMediaUrls) {
           const signed = await Promise.all(r2_keys.map(signR2Key));
@@ -5507,6 +5902,7 @@ function registerDistributionTools(server) {
             };
           }
           resolvedMediaUrls = signed;
+          resolvedMediaUrlsAreTrustedR2 = signed.map(() => true);
         } else if (job_ids && job_ids.length > 0 && !resolvedMediaUrls && !r2_keys) {
           const resolved = await Promise.all(job_ids.map(resolveJobId));
           const failIdx = resolved.findIndex((r) => !r);
@@ -5521,10 +5917,12 @@ function registerDistributionTools(server) {
               isError: true
             };
           }
-          resolvedMediaUrls = resolved;
+          const resolvedJobs = resolved;
+          resolvedMediaUrls = resolvedJobs.map((item) => item.url);
+          resolvedMediaUrlsAreTrustedR2 = resolvedJobs.map((item) => item.trustedR2);
         }
         const shouldRehost = auto_rehost !== false;
-        if (shouldRehost && resolvedMediaUrl) {
+        if (shouldRehost && resolvedMediaUrl && !resolvedMediaUrlIsTrustedR2) {
           const rehost = await rehostExternalUrl(resolvedMediaUrl, project_id);
           if ("error" in rehost) {
             return {
@@ -5538,10 +5936,13 @@ function registerDistributionTools(server) {
             };
           }
           resolvedMediaUrl = rehost.signedUrl;
+          resolvedMediaUrlIsTrustedR2 = true;
         }
         if (shouldRehost && resolvedMediaUrls && resolvedMediaUrls.length > 0) {
           const rehosted = await Promise.all(
-            resolvedMediaUrls.map((u) => rehostExternalUrl(u, project_id))
+            resolvedMediaUrls.map(
+              (u, index) => resolvedMediaUrlsAreTrustedR2[index] ? Promise.resolve({ signedUrl: u, r2Key: "" }) : rehostExternalUrl(u, project_id)
+            )
           );
           const failIdx = rehosted.findIndex((r) => "error" in r);
           if (failIdx !== -1) {
@@ -5557,6 +5958,7 @@ function registerDistributionTools(server) {
             };
           }
           resolvedMediaUrls = rehosted.map((r) => r.signedUrl);
+          resolvedMediaUrlsAreTrustedR2 = resolvedMediaUrls.map(() => true);
         }
       } catch (resolveErr) {
         return {
@@ -5569,6 +5971,42 @@ function registerDistributionTools(server) {
           isError: true
         };
       }
+      const hasResolvedMedia = Boolean(
+        resolvedMediaUrl || resolvedMediaUrls && resolvedMediaUrls.length > 0
+      );
+      const resolvedMediaType = inferScheduleMediaType(
+        media_type,
+        [resolvedMediaUrl, r2_key],
+        [resolvedMediaUrls, r2_keys]
+      );
+      if (hasResolvedMedia && !resolvedMediaType) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "media_type is required when the media format cannot be inferred from a file extension. Set IMAGE, VIDEO, or CAROUSEL_ALBUM explicitly."
+            }
+          ],
+          isError: true
+        };
+      }
+      const finalUrls = [resolvedMediaUrl, ...resolvedMediaUrls ?? []].filter(
+        (value) => typeof value === "string" && value.length > 0
+      );
+      for (const url of finalUrls) {
+        const validationError = await validatePublishMediaUrl(url);
+        if (validationError) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Media URL blocked: ${validationError}`
+              }
+            ],
+            isError: true
+          };
+        }
+      }
       const normalizedPlatforms = platforms.map(
         (p) => PLATFORM_CASE_MAP[p.toLowerCase()] || p
       );
@@ -5694,12 +6132,32 @@ Created with Social Neuron`;
         };
         return true;
       })();
+      const defaultAiDisclosure = (platformKey, field) => {
+        const existing = normalizedPlatformMetadata?.[platformKey];
+        if (existing && existing[field] !== void 0) return;
+        normalizedPlatformMetadata = {
+          ...normalizedPlatformMetadata ?? {},
+          [platformKey]: {
+            ...existing ?? {},
+            [field]: true
+          }
+        };
+      };
+      if (normalizedPlatforms.includes("TikTok")) {
+        defaultAiDisclosure("tiktok", "is_ai_generated");
+      }
+      if (normalizedPlatforms.includes("Instagram")) {
+        defaultAiDisclosure("instagram", "is_ai_generated");
+      }
+      if (normalizedPlatforms.includes("YouTube")) {
+        defaultAiDisclosure("youtube", "contains_synthetic_media");
+      }
       const { data, error } = await callEdgeFunction(
         "schedule-post",
         {
           mediaUrl: resolvedMediaUrl,
           mediaUrls: resolvedMediaUrls,
-          mediaType: media_type,
+          mediaType: resolvedMediaType ?? void 0,
           caption: finalCaption,
           platforms: normalizedPlatforms,
           title,
@@ -5712,14 +6170,10 @@ Created with Social Neuron`;
               normalizedPlatformMetadata
             )
           } : {},
-          // Forward visual gate verdict + source so the EF can enforce on media posts.
-          ...visual_gate_result ? { visualGateResult: visual_gate_result } : {},
-          visualGateSource: "mcp",
-          // Originator lineage (Hermes integration, 2026-05-22). EF validates origin
-          // against the posts.origin CHECK constraint and persists hermesRunId when
-          // origin === 'hermes'.
-          ...origin ? { origin } : {},
-          ...hermes_run_id ? { hermesRunId: hermes_run_id } : {}
+          ...idempotency_key ? { idempotencyKey: idempotency_key } : {}
+          // Attribution is assigned by the authenticated gateway. Visual QA
+          // attestations are server-produced evidence and are deliberately not
+          // accepted from an MCP caller.
         },
         { timeoutMs: 3e4 }
       );
@@ -5785,6 +6239,99 @@ Created with Social Neuron`;
       };
     }
   );
+  server.tool(
+    "reschedule_post",
+    "Move an existing pending or scheduled post to a new future time without creating a duplicate. Pass project_id for the post's brand. expected_scheduled_at is recommended: it prevents overwriting a change made in another client after the calendar was loaded.",
+    {
+      post_id: z3.string().uuid().describe("Post ID returned by list_recent_posts."),
+      project_id: z3.string().uuid().optional().describe(
+        "Brand/project ID that owns the post. Defaults to the authenticated key's project or the account default."
+      ),
+      scheduled_at: z3.string().datetime({ offset: true }).describe("New future publish time as an ISO 8601 datetime with timezone."),
+      expected_scheduled_at: z3.string().datetime({ offset: true }).optional().describe(
+        "Optional current schedule timestamp. If it changed since you read it, the update is rejected instead of silently overwriting it."
+      ),
+      response_format: z3.enum(["text", "json"]).default("text")
+    },
+    async ({
+      post_id,
+      project_id,
+      scheduled_at,
+      expected_scheduled_at,
+      response_format
+    }) => {
+      const next = new Date(scheduled_at);
+      if (!Number.isFinite(next.getTime()) || next.getTime() <= Date.now()) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "scheduled_at must be a valid future ISO datetime with timezone."
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      if (!resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No project_id was provided and no default project is configured."
+            }
+          ],
+          isError: true
+        };
+      }
+      const userId = await getDefaultUserId();
+      const rateLimit = checkRateLimit("posting", `reschedule_post:${userId}`);
+      if (!rateLimit.allowed) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Rate limit exceeded. Retry in ~${rateLimit.retryAfter}s.`
+            }
+          ],
+          isError: true
+        };
+      }
+      const { data: result, error } = await callEdgeFunction("mcp-data", {
+        action: "reschedule-scheduled-post",
+        post_id,
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId,
+        scheduled_at: next.toISOString(),
+        ...expected_scheduled_at ? { expected_scheduled_at: new Date(expected_scheduled_at).toISOString() } : {}
+      });
+      if (error || !result?.success) {
+        const code = result?.error ?? error ?? "reschedule_failed";
+        const recovery = code === "publishing_in_progress" ? "The worker has already started publishing this post." : code === "schedule_conflict" ? `The schedule changed in another client${result?.current_scheduled_at ? ` to ${result.current_scheduled_at}` : ""}; refresh the calendar before retrying.` : code === "not_found" ? "The post was not found in this project." : code === "not_reschedulable" ? `This post can no longer be rescheduled${result?.status ? ` (status: ${result.status})` : ""}.` : "The post could not be rescheduled.";
+        return {
+          content: [{ type: "text", text: recovery }],
+          isError: true
+        };
+      }
+      const publicResult = {
+        success: true,
+        post_id: result.post_id ?? post_id,
+        project_id: result.project_id ?? resolvedProjectId,
+        previous_scheduled_at: result.previous_scheduled_at ?? null,
+        scheduled_at: result.scheduled_at ?? next.toISOString()
+      };
+      const structuredContent = asEnvelope3(publicResult);
+      return {
+        structuredContent,
+        content: [
+          {
+            type: "text",
+            text: response_format === "json" ? JSON.stringify(structuredContent, null, 2) : `Post ${publicResult.post_id} rescheduled to ${publicResult.scheduled_at}.`
+          }
+        ]
+      };
+    }
+  );
   server.tool(
     "list_connected_accounts",
     "Check which social platforms have active OAuth connections for posting. Call this before schedule_post to verify credentials. Pass project_id to list the accounts for a specific brand/project, then pass the returned account id as account_id/account_ids when posting. If a platform is missing or expired, the user needs to reconnect at socialneuron.com/settings/connections.",
@@ -5813,14 +6360,16 @@ Created with Social Neuron`;
           isError: true
         };
       }
-      const accounts = result.accounts ?? [];
+      const accounts = (result.accounts ?? []).map(publicConnectedAccount).filter((account) => account !== null);
       if (accounts.length === 0) {
         if (format === "json") {
+          const structuredContent = asEnvelope3({ accounts: [] });
           return {
+            structuredContent,
             content: [
               {
                 type: "text",
-                text: JSON.stringify(asEnvelope3({ accounts: [] }), null, 2)
+                text: JSON.stringify(structuredContent, null, 2)
               }
             ]
           };
@@ -5848,11 +6397,13 @@ Created with Social Neuron`;
         );
       }
       if (format === "json") {
+        const structuredContent = asEnvelope3({ accounts });
         return {
+          structuredContent,
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope3({ accounts }), null, 2)
+              text: JSON.stringify(structuredContent, null, 2)
             }
           ]
         };
@@ -5866,6 +6417,9 @@ Created with Social Neuron`;
     "list_recent_posts",
     "List recent published and scheduled posts with status, platform, title, and timestamps. Use to check what has been posted before planning new content, or to find post IDs for fetch_analytics. Filter by platform or status to narrow results.",
     {
+      project_id: z3.string().uuid().optional().describe(
+        "Brand/project ID to scope posts. Defaults to the authenticated key's project or the account default."
+      ),
       platform: z3.enum([
         "youtube",
         "tiktok",
@@ -5881,13 +6435,27 @@ Created with Social Neuron`;
       limit: z3.number().min(1).max(50).optional().describe("Maximum number of posts to return. Defaults to 20."),
       response_format: z3.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ platform: platform3, status, days, limit, response_format }) => {
+    async ({ project_id, platform: platform3, status, days, limit, response_format }) => {
       const format = response_format ?? "text";
       const lookbackDays = days ?? 7;
-      const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
-        action: "recent-posts",
-        days: lookbackDays,
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      if (!resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No project_id was provided and no default project is configured."
+            }
+          ],
+          isError: true
+        };
+      }
+      const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
+        action: "recent-posts",
+        days: lookbackDays,
         limit: limit ?? 20,
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId,
         ...platform3 ? { platform: platform3 } : {},
         ...status ? { status } : {}
       });
@@ -5902,7 +6470,7 @@ Created with Social Neuron`;
           isError: true
         };
       }
-      const rows = result.posts ?? [];
+      const rows = (result.posts ?? []).map(publicPostRecord).filter((post) => post !== null);
       if (rows.length === 0) {
         if (format === "json") {
           const structuredContent2 = asEnvelope3({ posts: [] });
@@ -5977,8 +6545,11 @@ Created with Social Neuron`;
   };
   server.tool(
     "find_next_slots",
-    "Find optimal posting time slots based on best posting times and existing schedule. Returns non-conflicting slots sorted by engagement score.",
+    "Find optimal posting time slots for one brand/project based on preferred posting times and that project's existing schedule. Returns non-conflicting slots sorted by engagement score.",
     {
+      project_id: z3.string().uuid().optional().describe(
+        "Brand/project ID used for conflict detection. Defaults to the authenticated key's project or the account default."
+      ),
       platforms: z3.array(
         z3.enum([
           "youtube",
@@ -5997,6 +6568,7 @@ Created with Social Neuron`;
       response_format: z3.enum(["text", "json"]).default("text")
     },
     async ({
+      project_id,
       platforms,
       count,
       start_after,
@@ -6004,13 +6576,35 @@ Created with Social Neuron`;
       response_format
     }) => {
       try {
+        const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+        if (!resolvedProjectId) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: "No project_id was provided and no default project is configured."
+              }
+            ],
+            isError: true
+          };
+        }
         const startDate = start_after ? new Date(start_after) : /* @__PURE__ */ new Date();
+        if (!Number.isFinite(startDate.getTime())) {
+          return {
+            content: [
+              { type: "text", text: "start_after must be a valid ISO datetime." }
+            ],
+            isError: true
+          };
+        }
         const endDate = new Date(startDate.getTime() + 7 * 24 * 60 * 60 * 1e3);
         const { data: postsResult, error: postsError } = await callEdgeFunction("mcp-data", {
           action: "scheduled-posts",
           start_date: startDate.toISOString(),
           end_date: endDate.toISOString(),
-          statuses: ["scheduled", "draft"]
+          statuses: ["pending", "scheduled", "draft"],
+          projectId: resolvedProjectId,
+          project_id: resolvedProjectId
         });
         const existingPosts = postsError ? [] : postsResult?.posts ?? [];
         const gapMs = min_gap_hours * 60 * 60 * 1e3;
@@ -6050,19 +6644,17 @@ Created with Social Neuron`;
         const slots = candidates.filter((s) => !s.conflict).sort((a, b) => b.engagement_score - a.engagement_score).slice(0, count);
         const conflictsAvoided = candidates.filter((s) => s.conflict).length;
         if (response_format === "json") {
+          const structuredContent = asEnvelope3({
+            slots,
+            total_candidates: candidates.length,
+            conflicts_avoided: conflictsAvoided
+          });
           return {
+            structuredContent,
             content: [
               {
                 type: "text",
-                text: JSON.stringify(
-                  asEnvelope3({
-                    slots,
-                    total_candidates: candidates.length,
-                    conflicts_avoided: conflictsAvoided
-                  }),
-                  null,
-                  2
-                )
+                text: JSON.stringify(structuredContent, null, 2)
               }
             ],
             isError: false
@@ -6427,7 +7019,7 @@ Created with Social Neuron`;
         const results = [];
         const buildIdempotencyKey = (post) => {
           const planId = effectivePlanId ?? (typeof workingPlan.plan_id === "string" ? String(workingPlan.plan_id) : "inline");
-          const captionHash = createHash3("sha256").update(post.caption).digest("hex").slice(0, 16);
+          const captionHash = createHash2("sha256").update(post.caption).digest("hex").slice(0, 16);
           const raw = [
             "schedule_content_plan",
             planId,
@@ -6437,7 +7029,7 @@ Created with Social Neuron`;
             captionHash,
             idempotency_seed ?? ""
           ].join(":");
-          return `plan-${createHash3("sha256").update(raw).digest("hex").slice(0, 48)}`;
+          return `plan-${createHash2("sha256").update(raw).digest("hex").slice(0, 48)}`;
         };
         const scheduleOne = async (post) => {
           if (!post.schedule_at) {
@@ -6623,7 +7215,7 @@ Created with Social Neuron`;
     }
   );
 }
-var PLATFORM_CASE_MAP, TIKTOK_AUDIT_APPROVED, MCP_NOT_LIVE_FOR_POSTING;
+var PLATFORM_CASE_MAP, TIKTOK_AUDIT_APPROVED, MCP_NOT_LIVE_FOR_POSTING, VIDEO_FILE_EXTENSIONS, IMAGE_FILE_EXTENSIONS;
 var init_distribution = __esm({
   "src/tools/distribution.ts"() {
     "use strict";
@@ -6644,8 +7236,29 @@ var init_distribution = __esm({
       threads: "Threads",
       bluesky: "Bluesky"
     };
-    TIKTOK_AUDIT_APPROVED = false;
+    TIKTOK_AUDIT_APPROVED = !["false", "0", "no"].includes(
+      (process.env.TIKTOK_AUDIT_APPROVED ?? "").toLowerCase()
+    );
     MCP_NOT_LIVE_FOR_POSTING = /* @__PURE__ */ new Set(["LinkedIn", "Pinterest", "Reddit"]);
+    VIDEO_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
+      "mp4",
+      "mov",
+      "m4v",
+      "webm",
+      "avi",
+      "mkv",
+      "mpeg",
+      "mpg"
+    ]);
+    IMAGE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
+      "jpg",
+      "jpeg",
+      "png",
+      "webp",
+      "gif",
+      "avif",
+      "heic"
+    ]);
   }
 });
 
@@ -6926,7 +7539,10 @@ function registerMediaTools(server) {
                 content: [
                   {
                     type: "text",
-                    text: `R2 upload failed (HTTP ${putResp.status}): ${await putResp.text().catch(() => "Unknown error")}`
+                    // Presigned-store bodies may include provider request IDs,
+                    // bucket names, or signed URL fragments. Status is enough
+                    // for user recovery and safe diagnostics.
+                    text: `R2 upload failed (HTTP ${putResp.status}). Please retry.`
                   }
                 ],
                 isError: true
@@ -7169,7 +7785,11 @@ function registerAnalyticsTools(server) {
         action: "analytics",
         platform: platform3,
         days: lookbackDays,
-        limit: maxPosts,
+        // Fetch extra snapshots, then deduplicate to the requested post count.
+        // The backend understands latestOnly after the paired application
+        // deployment; older deployments safely ignore the hint.
+        limit: Math.min(maxPosts * 5, 100),
+        latestOnly: true,
         contentId: content_id,
         ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
       });
@@ -7179,7 +7799,14 @@ function registerAnalyticsTools(server) {
           isError: true
         };
       }
-      const rows = result?.rows ?? [];
+      const snapshotRows = result?.rows ?? [];
+      const seenSnapshots = /* @__PURE__ */ new Set();
+      const rows = [...snapshotRows].sort((a, b) => b.captured_at.localeCompare(a.captured_at)).filter((row) => {
+        const key = `${row.post_id}:${row.platform.toLowerCase()}`;
+        if (seenSnapshots.has(key)) return false;
+        seenSnapshots.add(key);
+        return true;
+      }).slice(0, maxPosts);
       if (rows.length === 0) {
         if (format === "json") {
           const structuredContent = asEnvelope4({
@@ -7358,6 +7985,84 @@ var init_analytics2 = __esm({
   }
 });
 
+// src/lib/brandUrlInput.ts
+function canonicalizeHost(hostname) {
+  return hostname.replace(UNICODE_DOT_VARIANTS, ".").replace(/\.+$/, "");
+}
+function hostLooksLikeDomain(hostname) {
+  return /\S+\.\S+/.test(canonicalizeHost(hostname));
+}
+function resolveHandle(handle, platform3) {
+  const normalized = handle.replace(/^@/, "").trim();
+  if (!normalized) return { url: null, handle: null, platform: null, ambiguous: false };
+  if (!platform3) return { url: null, handle: normalized, platform: null, ambiguous: true };
+  return {
+    url: PROFILE_URL_BUILDERS[platform3](normalized),
+    handle: normalized,
+    platform: platform3,
+    ambiguous: false
+  };
+}
+function normalizeBrandUrlInput(raw, explicitPlatform) {
+  const input = (raw ?? "").trim();
+  if (!input) return { url: null, handle: null, platform: null, ambiguous: false };
+  if (/^https?:\/\//i.test(input)) {
+    let parsed;
+    try {
+      parsed = new URL(input);
+    } catch {
+      return { url: null, handle: null, platform: null, ambiguous: false, invalidUrl: true };
+    }
+    if (hostLooksLikeDomain(parsed.hostname)) {
+      return { url: parsed.toString(), handle: null, platform: null, ambiguous: false };
+    }
+    return resolveHandle(canonicalizeHost(parsed.hostname), explicitPlatform);
+  }
+  const qualified = input.match(/^([a-z]{1,10}):\s*@?(.+)$/i);
+  if (qualified) {
+    const platform3 = PLATFORM_ALIASES[qualified[1].toLowerCase()];
+    if (platform3) return resolveHandle(qualified[2], platform3);
+  }
+  if (input.startsWith("@")) return resolveHandle(input, explicitPlatform);
+  if (!/\s/.test(input)) {
+    try {
+      const parsed = new URL(`https://${input}`);
+      if (hostLooksLikeDomain(parsed.hostname)) {
+        return { url: parsed.toString(), handle: null, platform: null, ambiguous: false };
+      }
+    } catch {
+    }
+  }
+  return resolveHandle(input.replace(UNICODE_DOT_VARIANTS, ".").replace(/\.+$/, ""), explicitPlatform);
+}
+var PLATFORM_ALIASES, PROFILE_URL_BUILDERS, UNICODE_DOT_VARIANTS;
+var init_brandUrlInput = __esm({
+  "src/lib/brandUrlInput.ts"() {
+    "use strict";
+    PLATFORM_ALIASES = {
+      instagram: "instagram",
+      ig: "instagram",
+      insta: "instagram",
+      tiktok: "tiktok",
+      tt: "tiktok",
+      twitter: "twitter",
+      x: "twitter",
+      linkedin: "linkedin",
+      li: "linkedin",
+      youtube: "youtube",
+      yt: "youtube"
+    };
+    PROFILE_URL_BUILDERS = {
+      instagram: (handle) => `https://instagram.com/${encodeURIComponent(handle)}`,
+      tiktok: (handle) => `https://tiktok.com/@${encodeURIComponent(handle)}`,
+      twitter: (handle) => `https://x.com/${encodeURIComponent(handle)}`,
+      linkedin: (handle) => `https://linkedin.com/company/${encodeURIComponent(handle)}`,
+      youtube: (handle) => `https://youtube.com/@${encodeURIComponent(handle)}`
+    };
+    UNICODE_DOT_VARIANTS = /[。．｡]/g;
+  }
+});
+
 // src/tools/brand.ts
 import { z as z6 } from "zod";
 function asEnvelope5(data) {
@@ -7374,12 +8079,31 @@ function registerBrandTools(server) {
     "extract_brand",
     "Analyze a website URL and extract brand identity data including brand name, colors, voice/tone, target audience, and logo. Uses AI-powered analysis of the page HTML. Useful for understanding a brand before generating content for it.",
     {
-      url: z6.string().url().describe(
-        'The website URL to analyze for brand identity (e.g. "https://example.com").'
+      url: z6.string().min(1).max(2048).describe(
+        'The website URL to analyze for brand identity (e.g. "https://example.com"). Bare handles are rejected; supply a full profile URL or use "platform:handle" shorthand (e.g. "instagram:acmefoods").'
       ),
       response_format: z6.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ url, response_format }) => {
+    async ({ url: rawUrl, response_format }) => {
+      const normalized = normalizeBrandUrlInput(rawUrl);
+      if (normalized.invalidUrl) {
+        return {
+          content: [{ type: "text", text: `URL blocked: "${rawUrl}" is not a valid URL.` }],
+          isError: true
+        };
+      }
+      if (!normalized.url) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `"${rawUrl}" looks like a handle, not a full URL. Provide a profile URL or use "platform:handle" shorthand (for example "instagram:acmefoods").`
+            }
+          ],
+          isError: true
+        };
+      }
+      const url = normalized.url;
       const ssrfCheck = await validateUrlForSSRF(url);
       if (!ssrfCheck.isValid) {
         return {
@@ -7687,6 +8411,7 @@ var init_brand = __esm({
     init_supabase();
     init_ssrf();
     init_version();
+    init_brandUrlInput();
   }
 });
 
@@ -8062,7 +8787,7 @@ function registerRemotionTools(server) {
     },
     async ({ composition_id, output_format, props }) => {
       const userId = await getDefaultUserId();
-      const rateLimit = checkRateLimit("screenshot", `render_demo_video:${userId}`);
+      const rateLimit = checkRateLimit("generation", `render_demo_video:${userId}`);
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -11896,7 +12621,9 @@ function toolKnowledgeDocument(tool) {
 function getKnowledgeDocuments() {
   return [
     ...STATIC_KNOWLEDGE_DOCUMENTS,
-    ...TOOL_CATALOG.filter((t) => !t.internal).map(toolKnowledgeDocument)
+    ...TOOL_CATALOG.filter((t) => !t.internal && !t.hiddenFromPublicCount).map(
+      toolKnowledgeDocument
+    )
   ];
 }
 function tokenize(input) {
@@ -12013,7 +12740,7 @@ function registerDiscoveryTools(server) {
       if (query) {
         results = searchTools(query);
       }
-      results = results.filter((t) => !t.internal);
+      results = results.filter((t) => !t.internal && !t.hiddenFromPublicCount);
       if (module) {
         const moduleTools = getToolsByModule(module);
         results = results.filter((t) => moduleTools.some((mt) => mt.name === t.name));
@@ -13944,11 +14671,11 @@ function hexToLab(hex) {
   const lb = srgbToLinear(b);
   const x = lr * 0.4124564 + lg * 0.3575761 + lb * 0.1804375;
   const y = lr * 0.2126729 + lg * 0.7151522 + lb * 0.072175;
-  const z38 = lr * 0.0193339 + lg * 0.119192 + lb * 0.9503041;
+  const z40 = lr * 0.0193339 + lg * 0.119192 + lb * 0.9503041;
   const f = (t) => t > 8856e-6 ? Math.cbrt(t) : 7.787 * t + 16 / 116;
   const fx = f(x / 0.95047);
   const fy = f(y / 1);
-  const fz = f(z38 / 1.08883);
+  const fz = f(z40 / 1.08883);
   return { L: 116 * fy - 16, a: 500 * (fx - fy), b: 200 * (fy - fz) };
 }
 function deltaE2000(lab1, lab2) {
@@ -14188,10 +14915,10 @@ function registerBrandRuntimeTools(server) {
           pagesScraped: meta.pagesScraped || 0
         }
       };
-      const envelope = asEnvelope23(runtime);
+      const envelope2 = asEnvelope23(runtime);
       return {
-        structuredContent: envelope,
-        content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
+        structuredContent: envelope2,
+        content: [{ type: "text", text: JSON.stringify(envelope2, null, 2) }]
       };
     }
   );
@@ -14331,9 +15058,9 @@ function registerBrandRuntimeTools(server) {
       }
       const profile = row.profile_data;
       const checkResult = computeBrandConsistency(content, profile);
-      const envelope = asEnvelope23(checkResult);
+      const envelope2 = asEnvelope23(checkResult);
       return {
-        content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
+        content: [{ type: "text", text: JSON.stringify(envelope2, null, 2) }]
       };
     }
   );
@@ -14365,9 +15092,9 @@ function registerBrandRuntimeTools(server) {
         content_colors,
         threshold ?? 10
       );
-      const envelope = asEnvelope23(auditResult);
+      const envelope2 = asEnvelope23(auditResult);
       return {
-        content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
+        content: [{ type: "text", text: JSON.stringify(envelope2, null, 2) }]
       };
     }
   );
@@ -14400,9 +15127,9 @@ function registerBrandRuntimeTools(server) {
         row.profile_data.typography,
         format
       );
-      const envelope = asEnvelope23({ format, tokens: output });
+      const envelope2 = asEnvelope23({ format, tokens: output });
       return {
-        content: [{ type: "text", text: JSON.stringify(envelope, null, 2) }]
+        content: [{ type: "text", text: JSON.stringify(envelope2, null, 2) }]
       };
     }
   );
@@ -14556,7 +15283,7 @@ function registerCarouselTools(server) {
         };
       }
       const userId = await getDefaultUserId();
-      const rateLimit = checkRateLimit("posting", `create_carousel:${userId}`);
+      const rateLimit = checkRateLimit("generation", `create_carousel:${userId}`);
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -14628,7 +15355,12 @@ function registerCarouselTools(server) {
                 slideNumber: slide.slideNumber,
                 jobId: null,
                 model: image_model,
-                error: error ?? "No job ID returned"
+                error: error ?? "No job ID returned",
+                creditsReserved: data?.credits_reserved ?? null,
+                creditsCharged: data?.credits_charged ?? null,
+                creditsRefunded: data?.credits_refunded ?? null,
+                billingStatus: data?.billing_status ?? "unknown",
+                failureReason: data?.failure_reason ?? null
               };
             }
             const jobId = data.asyncJobId ?? data.taskId ?? null;
@@ -14640,14 +15372,24 @@ function registerCarouselTools(server) {
               slideNumber: slide.slideNumber,
               jobId,
               model: image_model,
-              error: null
+              error: null,
+              creditsReserved: 0,
+              creditsCharged: data.creditsDeducted ?? perImageCost,
+              creditsRefunded: 0,
+              billingStatus: "charged",
+              failureReason: null
             };
           } catch (err) {
             return {
               slideNumber: slide.slideNumber,
               jobId: null,
               model: image_model,
-              error: sanitizeError(err)
+              error: sanitizeError(err),
+              creditsReserved: null,
+              creditsCharged: null,
+              creditsRefunded: null,
+              billingStatus: "unknown",
+              failureReason: null
             };
           }
         })
@@ -14672,7 +15414,8 @@ function registerCarouselTools(server) {
                       return {
                         ...s,
                         imageJobId: job?.jobId ?? null,
-                        imageError: job?.error ?? null
+                        imageError: job?.error ?? null,
+                        imageBillingStatus: job?.billingStatus ?? "unknown"
                       };
                     }),
                     imageModel: image_model,
@@ -14684,11 +15427,19 @@ function registerCarouselTools(server) {
                     jobIds: successfulJobs.map((j) => j.jobId),
                     failedSlides: failedJobs.map((j) => ({
                       slideNumber: j.slideNumber,
-                      error: j.error
+                      error: j.error,
+                      credits_reserved: j.creditsReserved,
+                      credits_charged: j.creditsCharged,
+                      credits_refunded: j.creditsRefunded,
+                      billing_status: j.billingStatus,
+                      failure_reason: j.failureReason
                     })),
                     credits: {
                       textGeneration: textCredits,
                       imagesEstimated: successfulJobs.length * perImageCost,
+                      imagesCharged: imageJobs.reduce((sum, job) => sum + (job.creditsCharged ?? 0), 0),
+                      imagesRefunded: imageJobs.reduce((sum, job) => sum + (job.creditsRefunded ?? 0), 0),
+                      billingUnknownSlides: imageJobs.filter((job) => job.billingStatus === "unknown").length,
                       totalEstimated: textCredits + successfulJobs.length * perImageCost
                     }
                   }
@@ -14884,7 +15635,7 @@ function registerHyperframesTools(server) {
   );
   server.tool(
     "render_hyperframes",
-    "Render an HTML video composition (Hyperframes) to MP4. Author the composition as HTML with data-* timing attributes and GSAP timelines \u2014 frame-accurate, no React build step. Use list_hyperframes_blocks to see the pre-built block catalog. Pass project_id to keep the render with the correct brand/project. Returns a job ID \u2014 poll with check_status.",
+    "Render an HTML video composition (Hyperframes) to MP4 \u2014 frame-accurate, no React build step. The page MUST expose window.__hf = { duration: <seconds>, seek: (t) => void }; the renderer calls seek(t) per frame (GSAP timelines work when driven from seek). Missing window.__hf causes a terminal timeout; poll check_status and verify its reported billing/refund outcome. Use list_hyperframes_blocks for the pre-built block catalog. Pass project_id to keep the render with the correct brand/project. Returns a job ID \u2014 poll with check_status.",
     {
       composition_html: z30.string().max(5e5).optional().describe(
         "Inline HTML composition (full <html>...</html>). Max 500KB. Use composition_url for larger."
@@ -14897,7 +15648,8 @@ function registerHyperframesTools(server) {
       duration_sec: z30.number().min(0.1).max(600).describe("Output duration in seconds. Required. Max 600 (10 min)."),
       fps: z30.union([z30.literal(24), z30.literal(30), z30.literal(60)]).optional().describe("Frames per second. Default 30."),
       quality: z30.enum(["draft", "standard", "high"]).optional().describe("draft: fast iteration; standard: production; high: final master."),
-      project_id: z30.string().optional().describe("Project ID to associate the Hyperframes render with.")
+      project_id: z30.string().optional().describe("Project ID to associate the Hyperframes render with."),
+      response_format: z30.enum(["text", "json"]).optional().describe("Response format. Use json for a stable job_id handoff.")
     },
     async ({
       composition_html,
@@ -14907,7 +15659,8 @@ function registerHyperframesTools(server) {
       duration_sec,
       fps,
       quality,
-      project_id
+      project_id,
+      response_format
     }) => {
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("generation", `render_hyperframes:${userId}`);
@@ -14958,11 +15711,23 @@ function registerHyperframesTools(server) {
         if (error || !data?.jobId) {
           throw new Error(error || data?.error || "Failed to create Hyperframes render job");
         }
+        const payload = {
+          job_id: data.jobId,
+          jobId: data.jobId,
+          status: data.status,
+          credits_cost: data.creditsCost,
+          credits: data.creditsCost,
+          duration_sec,
+          fps: fps || 30,
+          aspect_ratio: aspect_ratio || "9:16",
+          quality: quality || "standard",
+          project_id: project_id || null
+        };
         return {
           content: [
             {
               type: "text",
-              text: [
+              text: response_format === "json" ? JSON.stringify({ data: payload }) : [
                 `Hyperframes render job queued.`,
                 `  Job ID: ${data.jobId}`,
                 `  Credits: ${data.creditsCost}`,
@@ -14979,7 +15744,7 @@ function registerHyperframesTools(server) {
           content: [
             {
               type: "text",
-              text: `Failed to queue Hyperframes render: ${err instanceof Error ? err.message : "Unknown error"}`
+              text: `Failed to queue Hyperframes render: ${sanitizeError(err)}`
             }
           ],
           isError: true
@@ -14995,6 +15760,7 @@ var init_hyperframes = __esm({
     init_rate_limit();
     init_supabase();
     init_edge_function();
+    init_sanitize_error();
     HYPERFRAMES_BLOCKS = [
       // Transitions
       {
@@ -15112,49 +15878,122 @@ import {
 import { z as z31 } from "zod";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 function startOfCurrentWeekMonday() {
   const now = /* @__PURE__ */ new Date();
-  const day = now.getDay();
+  const day = now.getUTCDay();
   const monday = new Date(now);
-  monday.setUTCDate(now.getUTCDate() - day + (day === 0 ? -6 : 1));
+  monday.setUTCDate(now.getUTCDate() - (day + 6) % 7);
+  monday.setUTCHours(0, 0, 0, 0);
   return monday.toISOString().split("T")[0];
 }
+function endOfWeek(startDate) {
+  const end = /* @__PURE__ */ new Date(`${startDate}T00:00:00.000Z`);
+  end.setUTCDate(end.getUTCDate() + 7);
+  end.setUTCMilliseconds(end.getUTCMilliseconds() - 1);
+  return end.toISOString();
+}
+function isStrictIsoDate(value) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) return false;
+  const parsed = /* @__PURE__ */ new Date(`${value}T00:00:00.000Z`);
+  return Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 10) === value;
+}
+function publicRecentPost(value) {
+  if (!value || typeof value !== "object") return null;
+  const row = value;
+  if (typeof row.id !== "string" || typeof row.platform !== "string" || typeof row.status !== "string" || typeof row.created_at !== "string") {
+    return null;
+  }
+  const optional = (name) => typeof row[name] === "string" ? row[name] : null;
+  return {
+    id: row.id,
+    platform: row.platform,
+    status: row.status,
+    title: optional("title"),
+    external_post_id: optional("external_post_id"),
+    published_at: optional("published_at"),
+    scheduled_at: optional("scheduled_at"),
+    created_at: row.created_at
+  };
+}
+function calendarHtmlCandidates() {
+  const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+  return [
+    // Bundled HTTP entry: import.meta.url is dist/http.js.
+    path.join(moduleDir, "apps/content-calendar/mcp-app.html"),
+    // Source/tsx/vitest: import.meta.url is src/apps/content-calendar.ts.
+    path.resolve(moduleDir, "../../dist/apps/content-calendar/mcp-app.html"),
+    // Local development fallback; never the sole package path.
+    path.resolve(process.cwd(), "dist/apps/content-calendar/mcp-app.html")
+  ];
+}
+async function readCalendarHtml() {
+  for (const candidate of calendarHtmlCandidates()) {
+    try {
+      return await fs.readFile(candidate, "utf-8");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  throw new Error("calendar_bundle_missing");
+}
 function registerContentCalendarApp(server) {
   registerAppTool(
     server,
     "open_content_calendar",
     {
       title: "Content Calendar",
-      description: "Open an interactive drag-drop calendar showing the user's scheduled posts for the current week. Users can reschedule via drag, filter by platform, drill into any post, or quick-create a new post. Backed by list_recent_posts, schedule_post, and find_next_slots \u2014 no new tools needed.",
+      description: "Open a project-scoped interactive calendar for the current week. Users can filter, inspect, quick-create, suggest a slot, and reschedule pending posts with optimistic conflict protection.",
       inputSchema: {
-        start_date: z31.string().optional().describe(
+        project_id: z31.string().uuid().optional().describe(
+          "Brand/project ID. Defaults to the authenticated key's project or the account default."
+        ),
+        start_date: z31.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional().describe(
           "ISO date for the week start (YYYY-MM-DD); defaults to the current week's Monday."
         )
       },
       outputSchema: {
         start_date: z31.string(),
+        project_id: z31.string(),
         posts: z31.array(RecentPostOutputSchema),
         scopes: z31.array(z31.string())
       },
       _meta: {
         ui: {
-          resourceUri: CALENDAR_URI,
-          csp: {
-            "img-src": ["'self'", "https://*.r2.cloudflarestorage.com", "data:"],
-            "connect-src": ["'self'"]
-          }
+          resourceUri: CALENDAR_URI
         }
       }
     },
-    async ({ start_date }, extra) => {
-      const userScopes = extra.authInfo?.scopes ?? [];
+    async ({ project_id, start_date }) => {
+      const userScopes = getRequestScopes() ?? getAuthenticatedScopes();
+      const resolvedProjectId = project_id ?? await getDefaultProjectId();
+      if (!resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "No project_id was provided and no default project is configured."
+            }
+          ],
+          isError: true
+        };
+      }
       const fromDate = start_date ?? startOfCurrentWeekMonday();
+      if (!isStrictIsoDate(fromDate)) {
+        return {
+          content: [{ type: "text", text: "start_date must be a valid YYYY-MM-DD date." }],
+          isError: true
+        };
+      }
       const { data: result, error } = await callEdgeFunction(
         "mcp-data",
         {
-          action: "recent-posts",
-          days: 14,
-          limit: 50
+          action: "scheduled-posts",
+          start_date: `${fromDate}T00:00:00.000Z`,
+          end_date: endOfWeek(fromDate),
+          statuses: ["pending", "scheduled", "draft"],
+          projectId: resolvedProjectId,
+          project_id: resolvedProjectId
         },
         { timeoutMs: 15e3 }
       );
@@ -15163,19 +16002,16 @@ function registerContentCalendarApp(server) {
           content: [
             {
               type: "text",
-              text: `Failed to load posts: ${error || result?.error || "Unknown error"}`
+              text: "The content calendar could not load posts. Please retry."
             }
           ],
           isError: true
         };
       }
-      const posts = (result.posts ?? []).filter((p) => {
-        const ts = p.scheduled_at ?? p.published_at ?? p.created_at;
-        if (!ts) return false;
-        return ts.split("T")[0] >= fromDate;
-      });
+      const posts = (result.posts ?? []).map(publicRecentPost).filter((post) => post !== null);
       const structuredContent = {
         start_date: fromDate,
+        project_id: resolvedProjectId,
         posts,
         scopes: userScopes
       };
@@ -15194,37 +16030,60 @@ function registerContentCalendarApp(server) {
     server,
     CALENDAR_URI,
     CALENDAR_URI,
-    { mimeType: RESOURCE_MIME_TYPE },
+    {
+      mimeType: RESOURCE_MIME_TYPE,
+      description: "Self-contained Social Neuron project content calendar.",
+      _meta: { ui: { csp: CALENDAR_CSP } }
+    },
     async () => {
-      const htmlPath = path.join(process.cwd(), "apps/content-calendar/dist/mcp-app.html");
       try {
-        const html = await fs.readFile(htmlPath, "utf-8");
+        const html = await readCalendarHtml();
         return {
-          contents: [{ uri: CALENDAR_URI, mimeType: RESOURCE_MIME_TYPE, text: html }]
+          contents: [
+            {
+              uri: CALENDAR_URI,
+              mimeType: RESOURCE_MIME_TYPE,
+              text: html,
+              _meta: { ui: { csp: CALENDAR_CSP } }
+            }
+          ]
         };
-      } catch (err) {
+      } catch {
         const errorHtml = `<!DOCTYPE html>
 <html><head><title>Content Calendar \u2014 unavailable</title></head>
 <body style="font-family:sans-serif;padding:24px;color:#444;">
   <h2>Content Calendar app bundle missing</h2>
-  <p>The server registered <code>open_content_calendar</code> but
-  <code>apps/content-calendar/dist/mcp-app.html</code> is not built.
-  Run <code>npm run build:app</code> in the mcp-server directory and redeploy.</p>
-  <p style="color:#999;font-size:12px;">${err.message}</p>
+  <p>The interactive bundle is unavailable on this deployment. Please contact Social Neuron support.</p>
 </body></html>`;
         return {
-          contents: [{ uri: CALENDAR_URI, mimeType: RESOURCE_MIME_TYPE, text: errorHtml }]
+          contents: [
+            {
+              uri: CALENDAR_URI,
+              mimeType: RESOURCE_MIME_TYPE,
+              text: errorHtml,
+              _meta: { ui: { csp: CALENDAR_CSP } }
+            }
+          ]
         };
       }
     }
   );
 }
-var CALENDAR_URI, RecentPostOutputSchema;
+var CALENDAR_URI, CALENDAR_CSP, RecentPostOutputSchema;
 var init_content_calendar = __esm({
   "src/apps/content-calendar.ts"() {
     "use strict";
     init_edge_function();
-    CALENDAR_URI = "ui://content-calendar/mcp-app.html";
+    init_request_context();
+    init_supabase();
+    CALENDAR_URI = "ui://content-calendar/v1/mcp-app.html";
+    CALENDAR_CSP = {
+      // The HTML is fully self-contained. Tool calls travel over the host bridge,
+      // not fetch/XHR, so the secure default is no network or remote resources.
+      connectDomains: [],
+      resourceDomains: [],
+      frameDomains: []
+    };
     RecentPostOutputSchema = z31.object({
       id: z31.string(),
       platform: z31.string(),
@@ -15238,8 +16097,257 @@ var init_content_calendar = __esm({
   }
 });
 
-// src/tools/connections.ts
+// src/apps/analytics-pulse.ts
+import {
+  registerAppResource as registerAppResource2,
+  registerAppTool as registerAppTool2,
+  RESOURCE_MIME_TYPE as RESOURCE_MIME_TYPE2
+} from "@modelcontextprotocol/ext-apps/server";
 import { z as z32 } from "zod";
+import fs2 from "node:fs/promises";
+import path2 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function finiteMetric(value) {
+  const parsed = Number(value ?? 0);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+}
+function publicAnalyticsPost(value) {
+  if (!value || typeof value !== "object") return null;
+  const row = value;
+  const post = row.posts && typeof row.posts === "object" ? row.posts : {};
+  const platform3 = typeof row.platform === "string" ? row.platform : typeof post.platform === "string" ? post.platform : null;
+  const capturedAt = typeof row.captured_at === "string" ? row.captured_at : null;
+  if (!platform3 || !capturedAt) return null;
+  const views = finiteMetric(row.views);
+  const likes = finiteMetric(row.likes);
+  const comments = finiteMetric(row.comments);
+  const shares = finiteMetric(row.shares);
+  const engagement = likes + comments + shares;
+  return {
+    platform: platform3,
+    title: typeof post.title === "string" ? post.title : null,
+    views,
+    likes,
+    comments,
+    shares,
+    engagement_rate: views > 0 ? Number((engagement / views * 100).toFixed(2)) : 0,
+    captured_at: capturedAt,
+    published_at: typeof post.published_at === "string" ? post.published_at : null
+  };
+}
+function latestAnalyticsRows(values) {
+  const rows = values.filter((value) => Boolean(value) && typeof value === "object").sort((a, b) => String(b.captured_at ?? "").localeCompare(String(a.captured_at ?? "")));
+  const seen = /* @__PURE__ */ new Set();
+  const latest = [];
+  for (const row of rows) {
+    if (typeof row.post_id !== "string" || typeof row.platform !== "string") continue;
+    const key = `${row.post_id}:${row.platform.toLowerCase()}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    latest.push(row);
+  }
+  return latest;
+}
+function analyticsHtmlCandidates() {
+  const moduleDir = path2.dirname(fileURLToPath2(import.meta.url));
+  return [
+    path2.join(moduleDir, "apps/analytics-pulse/mcp-app.html"),
+    path2.resolve(moduleDir, "../../dist/apps/analytics-pulse/mcp-app.html"),
+    path2.resolve(process.cwd(), "dist/apps/analytics-pulse/mcp-app.html")
+  ];
+}
+async function readAnalyticsHtml() {
+  for (const candidate of analyticsHtmlCandidates()) {
+    try {
+      return await fs2.readFile(candidate, "utf-8");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  throw new Error("analytics_bundle_missing");
+}
+function registerAnalyticsPulseApp(server) {
+  registerAppTool2(
+    server,
+    "open_analytics_pulse",
+    {
+      title: "Analytics Pulse",
+      description: "Open a project-scoped performance dashboard with views, engagement, platform mix, and top-post metrics. Use it to review results visually before planning the next content cycle.",
+      inputSchema: {
+        project_id: z32.string().uuid().optional().describe("Brand/project ID. Defaults to the authenticated key's project or account default."),
+        platform: z32.enum(PLATFORM_VALUES).optional().describe("Optional platform filter."),
+        days: z32.number().int().min(1).max(365).optional().describe("Lookback window. Defaults to 30 days.")
+      },
+      outputSchema: {
+        project_id: z32.string(),
+        platform: z32.string().nullable(),
+        days: z32.number(),
+        summary: z32.object({
+          views: z32.number(),
+          engagement: z32.number(),
+          engagement_rate: z32.number(),
+          posts: z32.number()
+        }),
+        platform_totals: z32.array(
+          z32.object({
+            platform: z32.string(),
+            views: z32.number(),
+            engagement: z32.number(),
+            posts: z32.number()
+          })
+        ),
+        posts: z32.array(AnalyticsPostOutputSchema)
+      },
+      _meta: { ui: { resourceUri: ANALYTICS_URI } }
+    },
+    async ({ project_id, platform: platform3, days }) => {
+      const resolvedProjectId = project_id ?? await getDefaultProjectId();
+      if (!resolvedProjectId) {
+        return {
+          content: [{ type: "text", text: "No project_id was provided and no default project is configured." }],
+          isError: true
+        };
+      }
+      const lookbackDays = days ?? 30;
+      const { data: result, error } = await callEdgeFunction(
+        "mcp-data",
+        {
+          action: "analytics",
+          projectId: resolvedProjectId,
+          project_id: resolvedProjectId,
+          days: lookbackDays,
+          // The table stores cumulative snapshots. Request a wider window and
+          // deduplicate below so refresh frequency cannot inflate the totals.
+          limit: 100,
+          latestOnly: true,
+          ...platform3 ? { platform: platform3 } : {}
+        },
+        { timeoutMs: 15e3 }
+      );
+      if (error || !result?.success) {
+        return {
+          content: [{ type: "text", text: "The analytics dashboard could not load data. Please retry." }],
+          isError: true
+        };
+      }
+      const posts = latestAnalyticsRows(result.rows ?? []).map(publicAnalyticsPost).filter((post) => post !== null).sort((a, b) => b.views - a.views);
+      const totals = /* @__PURE__ */ new Map();
+      let totalViews = 0;
+      let totalEngagement = 0;
+      for (const post of posts) {
+        const engagement = post.likes + post.comments + post.shares;
+        totalViews += post.views;
+        totalEngagement += engagement;
+        const aggregate = totals.get(post.platform) ?? {
+          platform: post.platform,
+          views: 0,
+          engagement: 0,
+          posts: 0
+        };
+        aggregate.views += post.views;
+        aggregate.engagement += engagement;
+        aggregate.posts += 1;
+        totals.set(post.platform, aggregate);
+      }
+      const structuredContent = {
+        project_id: resolvedProjectId,
+        platform: platform3 ?? null,
+        days: lookbackDays,
+        summary: {
+          views: totalViews,
+          engagement: totalEngagement,
+          engagement_rate: totalViews > 0 ? Number((totalEngagement / totalViews * 100).toFixed(2)) : 0,
+          posts: posts.length
+        },
+        platform_totals: [...totals.values()].sort((a, b) => b.views - a.views),
+        posts
+      };
+      return {
+        structuredContent,
+        content: [
+          {
+            type: "text",
+            text: `Loaded ${posts.length} analytics record${posts.length === 1 ? "" : "s"} for the last ${lookbackDays} days.`
+          }
+        ]
+      };
+    }
+  );
+  registerAppResource2(
+    server,
+    ANALYTICS_URI,
+    ANALYTICS_URI,
+    {
+      mimeType: RESOURCE_MIME_TYPE2,
+      description: "Self-contained Social Neuron project analytics dashboard.",
+      _meta: { ui: { csp: ANALYTICS_CSP } }
+    },
+    async () => {
+      try {
+        const html = await readAnalyticsHtml();
+        return {
+          contents: [
+            {
+              uri: ANALYTICS_URI,
+              mimeType: RESOURCE_MIME_TYPE2,
+              text: html,
+              _meta: { ui: { csp: ANALYTICS_CSP } }
+            }
+          ]
+        };
+      } catch {
+        return {
+          contents: [
+            {
+              uri: ANALYTICS_URI,
+              mimeType: RESOURCE_MIME_TYPE2,
+              text: "<!doctype html><html><body><h2>Analytics Pulse unavailable</h2><p>The interactive bundle is unavailable on this deployment. Please contact Social Neuron support.</p></body></html>",
+              _meta: { ui: { csp: ANALYTICS_CSP } }
+            }
+          ]
+        };
+      }
+    }
+  );
+}
+var ANALYTICS_URI, ANALYTICS_CSP, PLATFORM_VALUES, AnalyticsPostOutputSchema;
+var init_analytics_pulse = __esm({
+  "src/apps/analytics-pulse.ts"() {
+    "use strict";
+    init_edge_function();
+    init_supabase();
+    ANALYTICS_URI = "ui://analytics-pulse/v1/mcp-app.html";
+    ANALYTICS_CSP = {
+      connectDomains: [],
+      resourceDomains: [],
+      frameDomains: []
+    };
+    PLATFORM_VALUES = [
+      "youtube",
+      "tiktok",
+      "instagram",
+      "twitter",
+      "linkedin",
+      "facebook",
+      "threads",
+      "bluesky"
+    ];
+    AnalyticsPostOutputSchema = z32.object({
+      platform: z32.string(),
+      title: z32.string().nullable(),
+      views: z32.number(),
+      likes: z32.number(),
+      comments: z32.number(),
+      shares: z32.number(),
+      engagement_rate: z32.number(),
+      captured_at: z32.string(),
+      published_at: z32.string().nullable()
+    });
+  }
+});
+
+// src/tools/connections.ts
+import { z as z33 } from "zod";
 function findActiveAccount(accounts, platform3) {
   const target = platform3.toLowerCase();
   return accounts.find((a) => {
@@ -15252,16 +16360,16 @@ function registerConnectionTools(server) {
     "start_platform_connection",
     "Begin connecting a social platform (Instagram, TikTok, YouTube, etc.). Returns a single-use deep link the user opens in a browser to complete the one-time OAuth handshake on socialneuron.com. This is NOT another OAuth in Claude \u2014 platform connections require a browser session because the social platforms (Meta, Google, TikTok) only accept callbacks on socialneuron.com. After the user clicks the link and approves on the platform, call `wait_for_connection` to detect completion. Link expires in 2 minutes; mint a new one if needed. Use `list_connected_accounts` first to check whether the platform is already connected before calling this.",
     {
-      platform: z32.enum(PLATFORM_ENUM4).describe("Platform to connect. Lower-case: instagram, tiktok, youtube, etc."),
-      project_id: z32.string().optional().describe(
+      platform: z33.enum(PLATFORM_ENUM4).describe("Platform to connect. Lower-case: instagram, tiktok, youtube, etc."),
+      project_id: z33.string().optional().describe(
         "Brand/project ID to bind the new social account to. Use this when connecting a brand-specific account."
       ),
-      response_format: z32.enum(["text", "json"]).optional().describe("Response format. Default: text.")
+      response_format: z33.enum(["text", "json"]).optional().describe("Response format. Default: text.")
     },
     async ({ platform: platform3, project_id, response_format }) => {
       const format = response_format ?? "text";
       const userId = await getDefaultUserId();
-      const rl = checkRateLimit("read", `start_platform_connection:${userId}`);
+      const rl = checkRateLimit("posting", `start_platform_connection:${userId}`);
       if (!rl.allowed) {
         return {
           content: [
@@ -15341,13 +16449,13 @@ function registerConnectionTools(server) {
     "wait_for_connection",
     "Poll until a platform connection becomes active. Use after `start_platform_connection` while the user completes the browser OAuth flow. Returns when the account row appears with status=active, or when the timeout elapses. Default timeout 120s, max 600s.",
     {
-      platform: z32.enum(PLATFORM_ENUM4).describe("Platform to wait for."),
-      project_id: z32.string().optional().describe(
+      platform: z33.enum(PLATFORM_ENUM4).describe("Platform to wait for."),
+      project_id: z33.string().optional().describe(
         "Brand/project ID to scope the connection poll. Use the same project_id passed to start_platform_connection."
       ),
-      timeout_s: z32.number().min(5).max(600).optional().describe("How long to wait, in seconds. Default 120."),
-      poll_interval_s: z32.number().min(2).max(30).optional().describe("Poll interval in seconds. Default 5."),
-      response_format: z32.enum(["text", "json"]).optional().describe("Response format. Default: text.")
+      timeout_s: z33.number().min(5).max(600).optional().describe("How long to wait, in seconds. Default 120."),
+      poll_interval_s: z33.number().min(2).max(30).optional().describe("Poll interval in seconds. Default 5."),
+      response_format: z33.enum(["text", "json"]).optional().describe("Response format. Default: text.")
     },
     async ({ platform: platform3, project_id, timeout_s, poll_interval_s, response_format }) => {
       const format = response_format ?? "text";
@@ -15503,7 +16611,7 @@ var init_connections = __esm({
 });
 
 // src/tools/harness.ts
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 function registerHarnessTools(server, _ctx) {
   server.tool(
     "write_agent_reflection",
@@ -15608,38 +16716,38 @@ var init_harness = __esm({
       "engager"
     ];
     writeReflectionSchema = {
-      reflection_text: z33.string().min(1).max(4e3).describe("The verbal reflection text produced by the agent. 1\u20134000 characters."),
-      generated_by_agent: z33.enum(ALLOWED_AGENTS).describe(
+      reflection_text: z34.string().min(1).max(4e3).describe("The verbal reflection text produced by the agent. 1\u20134000 characters."),
+      generated_by_agent: z34.enum(ALLOWED_AGENTS).describe(
         "Which agent produced this reflection. Must be one of: conductor, brand-brain, drafter, publisher, analyst, engager."
       ),
-      provenance: z33.object({
-        content_history_id: z33.string().optional().describe("Related content_history row UUID."),
-        outcome_event_id: z33.string().optional().describe("Related outcome event UUID."),
-        prm_score_ids: z33.array(z33.string()).optional().describe("PRM score IDs that informed this reflection."),
-        handoff_ids: z33.array(z33.string()).optional().describe("Handoff event IDs that triggered this reflection.")
+      provenance: z34.object({
+        content_history_id: z34.string().optional().describe("Related content_history row UUID."),
+        outcome_event_id: z34.string().optional().describe("Related outcome event UUID."),
+        prm_score_ids: z34.array(z34.string()).optional().describe("PRM score IDs that informed this reflection."),
+        handoff_ids: z34.array(z34.string()).optional().describe("Handoff event IDs that triggered this reflection.")
       }).strict().describe(
         "Source evidence for this reflection. Only these four keys are accepted \u2014 unknown keys are rejected to prevent spurious provenance claims."
       ),
-      brand_id: z33.string().describe("Brand profile UUID this reflection belongs to."),
-      pipeline_id: z33.string().optional().describe("Optional: pipeline run UUID."),
-      post_id: z33.string().optional().describe("Optional: post UUID if reflection targets a post.")
+      brand_id: z34.string().describe("Brand profile UUID this reflection belongs to."),
+      pipeline_id: z34.string().optional().describe("Optional: pipeline run UUID."),
+      post_id: z34.string().optional().describe("Optional: post UUID if reflection targets a post.")
     };
     readReflectionSchema = {
-      brand_id: z33.string().describe("Brand profile UUID to read reflections for."),
-      generated_by_agent: z33.enum(ALLOWED_AGENTS).optional().describe(
+      brand_id: z34.string().describe("Brand profile UUID to read reflections for."),
+      generated_by_agent: z34.enum(ALLOWED_AGENTS).optional().describe(
         "Optional filter: only return reflections produced by this agent. One of: conductor, brand-brain, drafter, publisher, analyst, engager."
       ),
-      limit: z33.number().int().min(1).max(100).optional().describe(
+      limit: z34.number().int().min(1).max(100).optional().describe(
         "Maximum number of reflections to return. Clamped to [1, 100]. Default: 50. Results are ordered by created_at DESC, then id ASC (deterministic tiebreak)."
       )
     };
     recordOutcomeSchema = {
-      decision_event_id: z33.string().describe("UUID of the decision_events row to record an outcome for."),
-      horizon: z33.enum(["1h", "6h", "24h"]).describe(
+      decision_event_id: z34.string().describe("UUID of the decision_events row to record an outcome for."),
+      horizon: z34.enum(["1h", "6h", "24h"]).describe(
         "Observation horizon. Only horizon=24h with a non-null reward triggers a learning-loop update; 1h/6h are stored but inert for learning."
       ),
-      reward: z33.number().min(0).max(1).describe("Normalised reward signal in [0, 1]. Higher = better outcome."),
-      outcome_metrics: z33.record(z33.string(), z33.number()).optional().describe(
+      reward: z34.number().min(0).max(1).describe("Normalised reward signal in [0, 1]. Higher = better outcome."),
+      outcome_metrics: z34.record(z34.string(), z34.number()).optional().describe(
         'Optional map of raw metric name \u2192 value (e.g. {"likes": 42, "reach": 1200}). Stored verbatim; not used for learning directly.'
       )
     };
@@ -15647,7 +16755,7 @@ var init_harness = __esm({
 });
 
 // src/tools/hermes.ts
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 function asEnvelope25(data) {
   return {
     _meta: {
@@ -15663,12 +16771,12 @@ function registerHermesTools(server) {
     "Save a draft post to the SN content library. Use when an autonomous agent wants to persist a draft for review before publishing. Lands in the content library with status='draft'. The draft can then be approved/edited in the SN UI.",
     {
       platform: PLATFORM.describe("Target platform for the draft."),
-      copy: z34.string().min(1).max(8e3).describe("The draft post body."),
-      project_id: z34.string().optional().describe("SN project UUID. Optional but recommended."),
-      media_url: z34.string().url().optional().describe("Optional cover/media URL (R2 signed URL)."),
-      hermes_run_id: z34.string().optional().describe("Agent run id, for traceability."),
-      source_intel_ids: z34.array(z34.string()).optional().describe("Optional list of intel_signals.id rows that informed this draft."),
-      response_format: z34.enum(["text", "json"]).optional()
+      copy: z35.string().min(1).max(8e3).describe("The draft post body."),
+      project_id: z35.string().optional().describe("SN project UUID. Optional but recommended."),
+      media_url: z35.string().url().optional().describe("Optional cover/media URL (R2 signed URL)."),
+      hermes_run_id: z35.string().optional().describe("Agent run id, for traceability."),
+      source_intel_ids: z35.array(z35.string()).optional().describe("Optional list of intel_signals.id rows that informed this draft."),
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ platform: platform3, copy, project_id, media_url, hermes_run_id, response_format }) => {
       const { data, error } = await callEdgeFunction(
@@ -15706,15 +16814,15 @@ function registerHermesTools(server) {
     "record_voice_lesson",
     'Persist a learned voice lesson to brand_profiles.platform_voice.voice_lessons. Use after weekly reflection identifies a hook/format/CTA pattern that beats median engagement by \u226530%. Appears in SN Brand > BrandBrainPreview > "Voice lessons (auto)".',
     {
-      project_id: z34.string().describe("SN project UUID."),
-      lesson: z34.string().min(1).max(500).describe('One-sentence rule (e.g. "lowercase IG hooks beat title-case").'),
-      evidence: z34.object({
-        engagement_lift_pct: z34.number().describe("Engagement lift vs baseline, in percentage points."),
-        sample_size: z34.number().int().min(1).describe("Number of posts behind this lesson."),
-        top_examples: z34.array(z34.string()).optional().describe("Up to 3 hook examples from the top quartile.")
+      project_id: z35.string().describe("SN project UUID."),
+      lesson: z35.string().min(1).max(500).describe('One-sentence rule (e.g. "lowercase IG hooks beat title-case").'),
+      evidence: z35.object({
+        engagement_lift_pct: z35.number().describe("Engagement lift vs baseline, in percentage points."),
+        sample_size: z35.number().int().min(1).describe("Number of posts behind this lesson."),
+        top_examples: z35.array(z35.string()).optional().describe("Up to 3 hook examples from the top quartile.")
       }).describe("Quantitative evidence backing the lesson."),
-      applies_to: z34.array(PLATFORM).min(1).describe("Platforms this lesson applies to."),
-      response_format: z34.enum(["text", "json"]).optional()
+      applies_to: z35.array(PLATFORM).min(1).describe("Platforms this lesson applies to."),
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ project_id, lesson, evidence, applies_to, response_format }) => {
       const { data, error } = await callEdgeFunction("mcp-data", {
@@ -15750,10 +16858,10 @@ function registerHermesTools(server) {
     "record_observation",
     'Record an agent observation (e.g. "topic X engagement up 23% this week"). Surfaces in the analytics Playbook. Use for weekly reflection digests and mid-campaign pulse summaries.',
     {
-      summary: z34.string().min(1).max(2e3).describe("One-paragraph summary, shown to the account owner."),
-      deltas: z34.record(z34.string(), z34.union([z34.number(), z34.string(), z34.boolean()])).optional().describe("Optional structured key/value payload (e.g. {topic_x_er_pct: 23})."),
-      run_id: z34.string().optional().describe("Agent run id for traceability."),
-      response_format: z34.enum(["text", "json"]).optional()
+      summary: z35.string().min(1).max(2e3).describe("One-paragraph summary, shown to the account owner."),
+      deltas: z35.record(z35.string(), z35.union([z35.number(), z35.string(), z35.boolean()])).optional().describe("Optional structured key/value payload (e.g. {topic_x_er_pct: 23})."),
+      run_id: z35.string().optional().describe("Agent run id for traceability."),
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ summary, deltas, run_id, response_format }) => {
       const { data, error } = await callEdgeFunction("mcp-data", { action: "record-observation", summary, deltas, run_id });
@@ -15780,13 +16888,13 @@ function registerHermesTools(server) {
     "record_intel_signal",
     "Record a research/trend signal (news, HN post, competitor change, arxiv paper). Surfaces in SN Brand > Niche Intelligence. Dedupes by URL per user \u2014 safe to call multiple times for the same source.",
     {
-      source: z34.string().min(1).max(100).describe('Watcher name (e.g. "news-watch", "hackernews-watch").'),
-      url: z34.string().url().max(2e3).describe("Canonical URL of the source. Used for dedupe."),
-      topic: z34.string().max(200).optional().describe("Best-fit topic key."),
-      title: z34.string().max(500).optional(),
-      summary: z34.string().max(4e3).optional().describe("One-paragraph summary of the signal."),
-      score: z34.number().optional().describe("Relevance score from the watcher (0\u201310 typical)."),
-      response_format: z34.enum(["text", "json"]).optional()
+      source: z35.string().min(1).max(100).describe('Watcher name (e.g. "news-watch", "hackernews-watch").'),
+      url: z35.string().url().max(2e3).describe("Canonical URL of the source. Used for dedupe."),
+      topic: z35.string().max(200).optional().describe("Best-fit topic key."),
+      title: z35.string().max(500).optional(),
+      summary: z35.string().max(4e3).optional().describe("One-paragraph summary of the signal."),
+      score: z35.number().optional().describe("Relevance score from the watcher (0\u201310 typical)."),
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ source, url, topic, title, summary, score, response_format }) => {
       const { data, error } = await callEdgeFunction("mcp-data", {
@@ -15824,16 +16932,16 @@ function registerHermesTools(server) {
     "record_campaign_spend",
     "Log a campaign cost line. Use when an autonomous agent incurs spend that should be attributed to a campaign \u2014 drafts, renders, paid amp. Read aggregate via get_active_campaigns.",
     {
-      campaign_id: z34.string().min(1).max(200).describe("Campaign identifier (slug)."),
-      category: z34.enum([
+      campaign_id: z35.string().min(1).max(200).describe("Campaign identifier (slug)."),
+      category: z35.enum([
         "hermes_drafts",
         "carousel_renders",
         "analytics_pulls",
         "paid_amplification",
         "other"
       ]).describe("Cost category."),
-      amount_usd: z34.number().min(0).describe("Amount in USD; supports 4 decimal places."),
-      response_format: z34.enum(["text", "json"]).optional()
+      amount_usd: z35.number().min(0).describe("Amount in USD; supports 4 decimal places."),
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ campaign_id, category, amount_usd, response_format }) => {
       const { data, error } = await callEdgeFunction("mcp-data", {
@@ -15868,7 +16976,7 @@ function registerHermesTools(server) {
     "get_active_campaigns",
     "List currently-running campaigns with thesis, budget, hero format, and current spend. Use to bias drafts toward active campaign themes.",
     {
-      response_format: z34.enum(["text", "json"]).optional()
+      response_format: z35.enum(["text", "json"]).optional()
     },
     async ({ response_format }) => {
       const { data, error } = await callEdgeFunction("mcp-data", { action: "get-active-campaigns" });
@@ -15917,7 +17025,7 @@ var init_hermes = __esm({
     "use strict";
     init_edge_function();
     init_version();
-    PLATFORM = z34.enum([
+    PLATFORM = z35.enum([
       "instagram",
       "twitter",
       "linkedin",
@@ -15963,7 +17071,20 @@ var init_skills_manifest = __esm({
 });
 
 // src/tools/skills.ts
-import { z as z35 } from "zod";
+import { z as z36 } from "zod";
+function renderCatalogRow(row) {
+  const lines = [];
+  const platform3 = row.platform ? ` \xB7 ${row.platform}` : "";
+  lines.push(`${row.slug} (${row.kind}${platform3})`);
+  const desc = row.frontmatter && typeof row.frontmatter.description === "string" ? row.frontmatter.description : null;
+  if (desc) lines.push(`  ${desc}`);
+  const lock = row.locked ? ` \u{1F512} (upgrade to unlock)` : "";
+  lines.push(`  Tier: ${row.tier_minimum}${lock}`);
+  lines.push(
+    `  Model: ${row.model_id ?? "n/a"} \xB7 ${row.body_chars} chars` + (row.updated_at ? ` \xB7 updated ${row.updated_at}` : "")
+  );
+  return lines.join("\n");
+}
 function asEnvelope26(data) {
   return {
     _meta: {
@@ -15991,19 +17112,88 @@ function registerSkillsTools(server) {
     "list_skills",
     'List Social Neuron content workflow skills available to the authenticated user. A skill is a brand-locked multi-step pipeline (research \u2192 hook \u2192 script \u2192 visuals \u2192 voice \u2192 captions \u2192 assembly \u2192 quality gate \u2192 schedule) inspired by documented viral patterns (MrBeast 3-second hook, Hormozi pattern interrupt, etc.). Use this tool when the user asks "what can SN do", "what skills are available", "show me viral templates", or before calling run_skill so you can pick the right one.',
     {
-      studio: z35.enum(STUDIO_VALUES).optional().describe("Filter to one studio (video, avatar, carousel, voice, caption, edit)."),
-      featured_only: z35.boolean().optional().describe("Return only featured (recommended) skills. Defaults to false."),
-      response_format: z35.enum(["text", "json"]).optional().describe("Response format. Defaults to text \u2014 human-readable summary.")
+      studio: z36.enum(STUDIO_VALUES).optional().describe(
+        "Filter to one studio (video, avatar, carousel, voice, caption, edit)."
+      ),
+      featured_only: z36.boolean().optional().describe(
+        "Return only featured (recommended) skills. Defaults to false."
+      ),
+      response_format: z36.enum(["text", "json"]).optional().describe(
+        "Response format. Defaults to text \u2014 human-readable summary."
+      )
     },
     async ({ studio, featured_only, response_format }) => {
-      const skills = listSkills({ studio, featuredOnly: featured_only });
       const format = response_format ?? "text";
+      const { data: efData, error: efError } = await callEdgeFunction("mcp-data", { action: "get-skills" });
+      const catalogRows = efData?.skills;
+      if (!efError && Array.isArray(catalogRows) && catalogRows.length > 0) {
+        const workflows = listSkills({ studio, featuredOnly: featured_only });
+        const filteredGuideRows = catalogRows.filter(
+          (row) => !studio && (!featured_only || row.frontmatter?.featured === true)
+        );
+        const guides = filteredGuideRows.map((row) => ({
+          ...row,
+          use_with: "get_skill"
+        }));
+        const total = guides.length + workflows.length;
+        if (format === "json") {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(
+                  asEnvelope26({
+                    count: total,
+                    guides,
+                    workflows: workflows.map((w) => ({
+                      ...w,
+                      use_with: "run_skill"
+                    }))
+                  }),
+                  null,
+                  2
+                )
+              }
+            ]
+          };
+        }
+        const guideBlocks = filteredGuideRows.map(
+          (row) => `${renderCatalogRow(row)}
+\u2192 Read it: get_skill(slug: "${row.slug}")`
+        ).join("\n\n");
+        const workflowBlocks = workflows.map(renderSkillSummary).join("\n\n");
+        const header2 = `${total} skill${total === 1 ? "" : "s"} available (${guides.length} guide${guides.length === 1 ? "" : "s"} \xB7 ${workflows.length} workflow${workflows.length === 1 ? "" : "s"})
+${"=".repeat(40)}`;
+        const sections = [
+          guides.length > 0 ? `GUIDES \u2014 living how-to documents. Fetch with get_skill(slug).
+
+${guideBlocks}` : "",
+          workflows.length > 0 ? `WORKFLOWS \u2014 executable content pipelines. Launch with run_skill(skill_id).
+
+${workflowBlocks}` : ""
+        ].filter(Boolean);
+        return {
+          content: [
+            {
+              type: "text",
+              text: `${header2}
+
+${sections.join("\n\n")}`
+            }
+          ]
+        };
+      }
+      const skills = listSkills({ studio, featuredOnly: featured_only });
       if (format === "json") {
         return {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope26({ count: skills.length, skills }), null, 2)
+              text: JSON.stringify(
+                asEnvelope26({ count: skills.length, skills }),
+                null,
+                2
+              )
             }
           ]
         };
@@ -16013,7 +17203,9 @@ function registerSkillsTools(server) {
           content: [
             {
               type: "text",
-              text: "No skills match the filter." + (studio ? ` Studio "${studio}" has no skills yet.` : "") + "\n\nAvailable studios with skills: " + Array.from(new Set(SKILLS_MANIFEST.map((s) => s.studio))).join(", ")
+              text: "No skills match the filter." + (studio ? ` Studio "${studio}" has no skills yet.` : "") + "\n\nAvailable studios with skills: " + Array.from(new Set(SKILLS_MANIFEST.map((s) => s.studio))).join(
+                ", "
+              )
             }
           ]
         };
@@ -16032,18 +17224,22 @@ ${blocks}` }]
     "run_skill",
     "Run a Social Neuron workflow skill end-to-end (brand-locked content production). Returns a structured run preview with the exact step plan, credit cost, and a deep-link to launch the run in the SN dashboard. A future release executes in-process so you can stream step-by-step progress back to the user. Call list_skills first to discover available skill ids.",
     {
-      skill_id: z35.string().describe(
+      skill_id: z36.string().describe(
         'The id of the skill to run (e.g. "skill-brand-locked-viral-hook-reel"). Use list_skills to discover available ids.'
       ),
-      topic: z35.string().min(1).describe('What the content is about (e.g. "why we built Social Neuron").'),
-      audience: z35.string().optional().describe(
+      topic: z36.string().min(1).describe(
+        'What the content is about (e.g. "why we built Social Neuron").'
+      ),
+      audience: z36.string().optional().describe(
         'Who the content is for (e.g. "first-time founders"). Defaults to brand persona.'
       ),
-      hook: z35.string().optional().describe(
+      hook: z36.string().optional().describe(
         "Optional explicit hook. If omitted, the skill drafts and scores 3-5 candidates."
       ),
-      cta: z35.string().optional().describe("Optional call-to-action override. Defaults to brand standard CTA."),
-      response_format: z35.enum(["text", "json"]).optional().describe("Response format. Defaults to text.")
+      cta: z36.string().optional().describe(
+        "Optional call-to-action override. Defaults to brand standard CTA."
+      ),
+      response_format: z36.enum(["text", "json"]).optional().describe("Response format. Defaults to text.")
     },
     async ({ skill_id, topic, audience, hook, cta, response_format }) => {
       const skill = getSkill(skill_id);
@@ -16111,19 +17307,96 @@ ${blocks}` }]
       };
     }
   );
+  server.tool(
+    "get_skill",
+    `Fetch the full body of a single Social Neuron skill by slug \u2014 the hand-maintained strategy/specs plus the machine-maintained "what's working now" compiled section. Use this after list_skills when the user wants the actual playbook for a platform (e.g. "show me the TikTok skill"). Returns the skill body, compiled section, tier, and linked recipe slug (if any).`,
+    {
+      slug: z36.string().min(1).max(100).regex(/^[a-z0-9][a-z0-9-]*$/).describe(
+        'The skill slug (e.g. "tiktok-content"). Use list_skills to discover slugs.'
+      ),
+      response_format: z36.enum(["text", "json"]).optional().describe("Response format. Defaults to text.")
+    },
+    async ({ slug, response_format }) => {
+      const format = response_format ?? "text";
+      const { data, error } = await callEdgeFunction("mcp-data", {
+        action: "get-skill",
+        slug
+      });
+      if (error) {
+        return toolError(
+          "upstream_error",
+          "The skill catalogue could not be loaded. Please retry."
+        );
+      }
+      const skill = data?.skill;
+      if (!skill) {
+        return toolError("not_found", `No skill found with slug "${slug}".`, {
+          recover_with: ["Call list_skills to see available skills."]
+        });
+      }
+      if (skill.locked) {
+        return toolError(
+          "permission_denied",
+          "This skill requires a higher plan tier.",
+          {
+            details: { slug: skill.slug, tier_minimum: skill.tier_minimum },
+            recover_with: [
+              "Upgrade the account or choose an unlocked skill from list_skills."
+            ]
+          }
+        );
+      }
+      if (format === "json") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope26(skill), null, 2)
+            }
+          ]
+        };
+      }
+      const platform3 = skill.platform ? ` \xB7 ${skill.platform}` : "";
+      const lock = skill.locked ? " \u{1F512} (upgrade to unlock)" : "";
+      const header = [
+        `${skill.slug} (${skill.kind}${platform3})`,
+        "=".repeat(40),
+        `Tier: ${skill.tier_minimum}${lock} \xB7 version ${skill.version}` + (skill.recipe_slug ? ` \xB7 recipe: ${skill.recipe_slug}` : ""),
+        ""
+      ].join("\n");
+      const compiled = skill.compiled_section ? `
+
+--- What's working now ---
+${skill.compiled_section}` : "";
+      return {
+        content: [
+          { type: "text", text: `${header}${skill.body}${compiled}` }
+        ]
+      };
+    }
+  );
 }
 var STUDIO_VALUES;
 var init_skills = __esm({
   "src/tools/skills.ts"() {
     "use strict";
     init_version();
+    init_tool_error();
+    init_edge_function();
     init_skills_manifest();
-    STUDIO_VALUES = ["video", "avatar", "carousel", "voice", "caption", "edit"];
+    STUDIO_VALUES = [
+      "video",
+      "avatar",
+      "carousel",
+      "voice",
+      "caption",
+      "edit"
+    ];
   }
 });
 
 // src/tools/loopPulse.ts
-import { z as z36 } from "zod";
+import { z as z37 } from "zod";
 function asEnvelope27(data) {
   return {
     _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
@@ -16135,7 +17408,7 @@ function registerLoopPulseTools(server) {
     "get_loop_pulse",
     'Read the dynamic loop-health KPIs for the Social Neuron growth loop over the last 7 days. Returns reflection coverage, decision coverage, visual gate pass rate, learning-update application rate, per-platform learning uptake, autopilot lag, and pattern aggregation counts \u2014 each with a status ("ok" / "warn" / "bad") and a why-line explaining what the metric measures. Use this to decide whether the loop is closing or where it is stuck before recommending next moves.',
     {
-      response_format: z36.enum(["text", "json"]).optional().describe("Output format. Defaults to text.")
+      response_format: z37.enum(["text", "json"]).optional().describe("Output format. Defaults to text.")
     },
     async ({ response_format }) => {
       const format = response_format ?? "text";
@@ -16185,7 +17458,7 @@ var init_loopPulse = __esm({
 });
 
 // src/tools/banditState.ts
-import { z as z37 } from "zod";
+import { z as z38 } from "zod";
 function asEnvelope28(data) {
   return {
     _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
@@ -16197,8 +17470,8 @@ function registerBanditStateTools(server) {
     "get_bandit_state",
     "Read the current content learning state for a project. Returns top-K arms per (arm_type, platform) with expected performance and uncertainty. Use this to reason about which hook family / format / timing slot currently performs best on each platform before recommending next moves. Arm types: hook_family, length_bucket (xs/s/m/l/xl by platform), posting_time_bucket (morning/midday/evening/late), content_format (video/carousel/image/caption/text/avatar/storyboard).",
     {
-      project_id: z37.string().uuid().optional().describe("Project UUID. Defaults to the authenticated user default project."),
-      platform: z37.enum([
+      project_id: z38.string().uuid().optional().describe("Project UUID. Defaults to the authenticated user default project."),
+      platform: z38.enum([
         "instagram",
         "tiktok",
         "youtube",
@@ -16210,7 +17483,7 @@ function registerBanditStateTools(server) {
       ]).optional().describe(
         "Lowercase platform name. Omit to return both platform-scoped and legacy platform-agnostic arms."
       ),
-      arm_type: z37.enum([
+      arm_type: z38.enum([
         "hook_family",
         "hook_type",
         "format",
@@ -16224,8 +17497,8 @@ function registerBanditStateTools(server) {
         "posting_time_bucket",
         "content_format"
       ]).optional().describe("Arm dimension. Omit to return all types grouped."),
-      top_k: z37.number().min(1).max(50).optional().describe("Max arms per (arm_type) group. Default 5."),
-      response_format: z37.enum(["text", "json"]).optional().describe("Output format. Defaults to text.")
+      top_k: z38.number().min(1).max(50).optional().describe("Max arms per (arm_type) group. Default 5."),
+      response_format: z38.enum(["text", "json"]).optional().describe("Output format. Defaults to text.")
     },
     async ({ project_id, platform: platform3, arm_type, top_k, response_format }) => {
       const format = response_format ?? "text";
@@ -16288,12 +17561,134 @@ var init_banditState = __esm({
   }
 });
 
+// src/tools/lifecycle.ts
+import { z as z39 } from "zod";
+function envelope(data) {
+  return {
+    _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+    data
+  };
+}
+function lifecycleFailure(error) {
+  if (/not_found|not found/i.test(error)) {
+    return toolError("not_found", "The requested object was not found in this project.");
+  }
+  if (/not_cancellable|publishing_in_progress|schedule_conflict|post_in_progress/i.test(error)) {
+    return toolError("validation_error", "The object can no longer be cancelled in its current state.", {
+      recover_with: ["Refresh its status before deciding the next action."]
+    });
+  }
+  return toolError("upstream_error", "The lifecycle operation could not be completed. Please retry.");
+}
+async function projectContext(projectId) {
+  return projectId ?? await getDefaultProjectId();
+}
+async function invokeLifecycle(action, projectId, identifiers) {
+  const resolvedProjectId = await projectContext(projectId);
+  if (!resolvedProjectId) {
+    return toolError("validation_error", "A project_id is required because no default project is configured.");
+  }
+  const { data, error } = await callEdgeFunction("mcp-data", {
+    action,
+    projectId: resolvedProjectId,
+    project_id: resolvedProjectId,
+    ...identifiers
+  });
+  if (error) return lifecycleFailure(error);
+  if (!data?.success) return toolError("upstream_error", "The lifecycle operation returned no result.");
+  const result = envelope(data);
+  return {
+    structuredContent: result,
+    content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+  };
+}
+function registerLifecycleTools(server) {
+  server.tool(
+    "cancel_async_job",
+    "Cancel an owned pending async generation/render job before a worker starts it. If credits were already debited, the backend attempts an idempotent refund and reports the result. Processing or terminal jobs are not cancellable.",
+    {
+      job_id: z39.string().uuid().describe("Owned async_jobs ID returned by a generation tool."),
+      project_id: PROJECT_ID,
+      confirm: CONFIRM
+    },
+    async ({ job_id, project_id }) => invokeLifecycle("cancel-async-job", project_id, { job_id })
+  );
+  server.tool(
+    "cancel_scheduled_post",
+    "Cancel an owned draft, pending, or scheduled post before publishing starts. This closes its pending schedule job first; it refuses once a worker has claimed the publication.",
+    {
+      post_id: z39.string().uuid().describe("Owned scheduled post ID."),
+      project_id: PROJECT_ID,
+      confirm: CONFIRM
+    },
+    async ({ post_id, project_id }) => invokeLifecycle("cancel-scheduled-post", project_id, { post_id })
+  );
+  server.tool(
+    "delete_carousel",
+    "Delete an owned carousel content-history record from one project. Stored media is retained until the normal retention cleanup; this does not delete already-published platform posts.",
+    {
+      content_id: z39.string().uuid().describe("Owned carousel content_history ID."),
+      project_id: PROJECT_ID,
+      confirm: CONFIRM
+    },
+    async ({ content_id, project_id }) => invokeLifecycle("delete-carousel", project_id, { content_id })
+  );
+  server.tool(
+    "delete_content_plan",
+    "Permanently delete an owned content plan in one project. This does not cancel posts that were already scheduled from the plan.",
+    {
+      plan_id: z39.string().uuid().describe("Owned content plan ID."),
+      project_id: PROJECT_ID,
+      confirm: CONFIRM
+    },
+    async ({ plan_id, project_id }) => invokeLifecycle("delete-content-plan", project_id, { plan_id })
+  );
+  server.tool(
+    "delete_autopilot_config",
+    "Permanently delete an owned autopilot configuration in one project. Historical runs and already-published posts are retained.",
+    {
+      config_id: z39.string().uuid().describe("Owned autopilot configuration ID."),
+      project_id: PROJECT_ID,
+      confirm: CONFIRM
+    },
+    async ({ config_id, project_id }) => invokeLifecycle("delete-autopilot-config", project_id, { config_id })
+  );
+}
+var PROJECT_ID, CONFIRM;
+var init_lifecycle = __esm({
+  "src/tools/lifecycle.ts"() {
+    "use strict";
+    init_edge_function();
+    init_supabase();
+    init_tool_error();
+    init_version();
+    PROJECT_ID = z39.string().uuid().optional().describe("Brand/project ID. Defaults to the authenticated key's project or account default.");
+    CONFIRM = z39.literal(true).describe("Must be true only after the user explicitly confirms this destructive action.");
+  }
+});
+
 // src/lib/register-tools.ts
+function redactBase64Payloads(args) {
+  if (typeof args !== "object" || args === null || Array.isArray(args)) return args;
+  let changed = false;
+  const out = { ...args };
+  for (const key of BASE64_PAYLOAD_KEYS) {
+    const value = out[key];
+    if (typeof value !== "string" || value.length < 64) continue;
+    const body = value.replace(DATA_URI_PREFIX2, "");
+    if (STRICT_BASE64.test(body)) {
+      out[key] = `[base64:${body.length} chars omitted from prose scan]`;
+      changed = true;
+    }
+  }
+  return changed ? out : args;
+}
 function wrapToolWithScanner(toolName, handler) {
   return async function scannerWrappedHandler(...handlerArgs) {
     const args = handlerArgs[0];
     const ctx = handlerArgs[1];
-    const inputText = args === void 0 ? "{}" : typeof args === "string" ? args : JSON.stringify(args);
+    const scanArgs = redactBase64Payloads(args);
+    const inputText = scanArgs === void 0 ? "{}" : typeof scanArgs === "string" ? scanArgs : JSON.stringify(scanArgs);
     const inputScan = scan(inputText, {
       mode: "block",
       source: "mcp_tool_input",
@@ -16321,6 +17716,16 @@ function wrapToolWithScanner(toolName, handler) {
       source: "mcp_tool_output",
       user_id: ctx?.userId
     });
+    if (!outputScan.passed) {
+      try {
+        ctx?.logScan?.(toolName, "output", outputScan);
+      } catch {
+      }
+      return toolError(
+        "server_error",
+        "The response exceeded the safe output limit and was not returned."
+      );
+    }
     if (outputScan.sanitized_text !== void 0) {
       try {
         ctx?.logScan?.(toolName, "output", outputScan);
@@ -16329,7 +17734,10 @@ function wrapToolWithScanner(toolName, handler) {
       try {
         return JSON.parse(outputScan.sanitized_text);
       } catch {
-        return result;
+        return toolError(
+          "server_error",
+          "The response could not be returned safely. Please retry or contact support."
+        );
       }
     }
     return result;
@@ -16379,8 +17787,7 @@ function applyScopeEnforcement(server, scopeResolver) {
             details: {
               source: "wrapper",
               // A thrown exception escaped the handler — an unclassified fault.
-              error_type: "server_error",
-              exception: err instanceof Error ? err.message.slice(0, 200) : "unknown"
+              error_type: "server_error"
             }
           });
           throw err;
@@ -16512,12 +17919,14 @@ function registerAllTools(server, options) {
   registerSkillsTools(server);
   registerLoopPulseTools(server);
   registerBanditStateTools(server);
+  registerLifecycleTools(server);
   if (!options?.skipApps) {
     registerContentCalendarApp(server);
+    registerAnalyticsPulseApp(server);
   }
   applyAnnotations(server);
 }
-var RESPONSE_CHAR_LIMIT;
+var BASE64_PAYLOAD_KEYS, DATA_URI_PREFIX2, STRICT_BASE64, RESPONSE_CHAR_LIMIT;
 var init_register_tools = __esm({
   "src/lib/register-tools.ts"() {
     "use strict";
@@ -16559,12 +17968,17 @@ var init_register_tools = __esm({
     init_niche_research();
     init_hyperframes();
     init_content_calendar();
+    init_analytics_pulse();
     init_connections();
     init_harness();
     init_hermes();
     init_skills();
     init_loopPulse();
     init_banditState();
+    init_lifecycle();
+    BASE64_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["file_data", "fileData"]);
+    DATA_URI_PREFIX2 = /^data:[\w.+-]+\/[\w.+-]+;base64,/;
+    STRICT_BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
     RESPONSE_CHAR_LIMIT = 1e5;
   }
 });
@@ -16586,7 +18000,11 @@ function getCallHandler() {
   return cachedCallHandler;
 }
 function restToolNames() {
-  return new Set(TOOL_CATALOG.filter((t) => !t.localOnly && !t.internal).map((t) => t.name));
+  return new Set(
+    TOOL_CATALOG.filter((t) => !t.localOnly && !t.internal && !t.hiddenFromPublicCount).map(
+      (t) => t.name
+    )
+  );
 }
 async function invokeToolRest(name, args) {
   const handler = getCallHandler();
@@ -17152,7 +18570,7 @@ function printSnUsage() {
   console.error("");
   console.error("Discovery:");
   console.error("  tools [--scope <scope>] [--module <module>] [--json]");
-  console.error("  info [--json]");
+  console.error("  info [--offline] [--json]");
   console.error("");
   console.error("Content:");
   console.error(
@@ -17285,10 +18703,11 @@ var setup_exports = {};
 __export(setup_exports, {
   generatePKCE: () => generatePKCE,
   getAppBaseUrl: () => getAppBaseUrl,
+  isValidSetupApiKey: () => isValidSetupApiKey,
   runLogout: () => runLogout,
   runSetup: () => runSetup
 });
-import { createHash as createHash4, randomBytes, randomUUID as randomUUID4 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes2, randomUUID as randomUUID4 } from "node:crypto";
 import { createServer } from "node:http";
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { homedir as homedir3, platform as platform2 } from "node:os";
@@ -17297,12 +18716,15 @@ function base64url(buffer) {
   return buffer.toString("base64url");
 }
 function generatePKCE() {
-  const verifierBytes = randomBytes(32);
+  const verifierBytes = randomBytes2(32);
   const codeVerifier = base64url(verifierBytes);
-  const challengeHash = createHash4("sha256").update(codeVerifier).digest();
+  const challengeHash = createHash3("sha256").update(codeVerifier).digest();
   const codeChallenge = base64url(challengeHash);
   return { codeVerifier, codeChallenge };
 }
+function isValidSetupApiKey(value) {
+  return typeof value === "string" && value.length >= 32 && value.length <= 512 && /^snk_live_[A-Za-z0-9_-]+$/.test(value);
+}
 function getAppBaseUrl() {
   return process.env.SOCIALNEURON_APP_URL || "https://www.socialneuron.com";
 }
@@ -17364,11 +18786,24 @@ function configureMcpClient(configPath) {
     return false;
   }
 }
-function readBody(req) {
+function readBody(req, maxBytes = 16 * 1024) {
   return new Promise((resolve3, reject) => {
     const chunks = [];
-    req.on("data", (chunk) => chunks.push(chunk));
-    req.on("end", () => resolve3(Buffer.concat(chunks).toString("utf-8")));
+    let total = 0;
+    let tooLarge = false;
+    req.on("data", (chunk) => {
+      if (tooLarge) return;
+      total += chunk.length;
+      if (total > maxBytes) {
+        tooLarge = true;
+        reject(new Error("request_too_large"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      if (!tooLarge) resolve3(Buffer.concat(chunks).toString("utf-8"));
+    });
     req.on("error", reject);
   });
 }
@@ -17381,14 +18816,13 @@ async function completePkceExchange(codeVerifier, state) {
       body: JSON.stringify({ code_verifier: codeVerifier, state })
     });
     if (!response.ok) {
-      const text = await response.text();
-      console.error(`  PKCE exchange failed: ${text}`);
+      console.error(`  PKCE exchange failed (HTTP ${response.status}).`);
       return false;
     }
     const data = await response.json();
     return data.success === true;
-  } catch (err) {
-    console.error(`  PKCE exchange error: ${err instanceof Error ? err.message : String(err)}`);
+  } catch {
+    console.error("  PKCE exchange failed because the authentication service was unavailable.");
     return false;
   }
 }
@@ -17399,7 +18833,8 @@ async function runSetup() {
   console.error("");
   console.error("  Privacy Notice:");
   console.error("  - Your API key is stored locally in your OS keychain");
-  console.error("  - Tool invocations are logged for usage metering (no content stored)");
+  console.error("  - CLI telemetry records tool name, status, and duration \u2014 not tool input/output");
+  console.error("  - Service-side content processing follows https://socialneuron.com/privacy");
   console.error("  - Set DO_NOT_TRACK=1 to disable telemetry");
   console.error("  - Data export/delete: https://www.socialneuron.com/settings");
   console.error("");
@@ -17423,7 +18858,6 @@ async function runSetup() {
     const open = (await import("open")).default;
     await open(authorizeUrl.toString());
     console.error("  Opening browser for authorization...");
-    console.error(`  URL: ${authorizeUrl.toString()}`);
     console.error("");
     console.error("  Waiting for authorization (timeout: 120s)...");
   } catch {
@@ -17435,12 +18869,20 @@ async function runSetup() {
     console.error("  Waiting for authorization (timeout: 120s)...");
   }
   const result = await new Promise((resolve3) => {
+    const callbackOrigin = new URL(baseUrl).origin;
     const timeout = setTimeout(() => {
       server.close();
       resolve3({ error: "Authorization timed out after 120 seconds." });
     }, 12e4);
     server.on("request", async (req, res) => {
-      res.setHeader("Access-Control-Allow-Origin", "*");
+      const requestOrigin = req.headers.origin;
+      if (requestOrigin !== callbackOrigin) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Origin not allowed" }));
+        return;
+      }
+      res.setHeader("Access-Control-Allow-Origin", callbackOrigin);
+      res.setHeader("Vary", "Origin");
       res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
       res.setHeader("Access-Control-Allow-Headers", "Content-Type");
       res.setHeader("Access-Control-Allow-Private-Network", "true");
@@ -17458,9 +18900,9 @@ async function runSetup() {
             res.end(JSON.stringify({ error: "State mismatch" }));
             return;
           }
-          if (!data.api_key) {
+          if (!isValidSetupApiKey(data.api_key)) {
             res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: "Missing api_key" }));
+            res.end(JSON.stringify({ error: "Invalid api_key" }));
             return;
           }
           res.writeHead(200, { "Content-Type": "application/json" });
@@ -17502,9 +18944,9 @@ async function runSetup() {
   console.error(`  Key prefix: ${apiKey.substring(0, 12)}...`);
   const configPaths = getConfigPaths();
   let configured = false;
-  for (const { path: path2, name } of configPaths) {
-    if (configureMcpClient(path2)) {
-      console.error(`  Configured ${name}: ${path2}`);
+  for (const { path: path3, name } of configPaths) {
+    if (configureMcpClient(path3)) {
+      console.error(`  Configured ${name}: ${path3}`);
       configured = true;
     }
   }
@@ -17543,12 +18985,12 @@ __export(validation_cache_exports, {
   readValidationCache: () => readValidationCache,
   writeValidationCache: () => writeValidationCache
 });
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, chmodSync } from "node:fs";
 import { join as join4 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 function keyFingerprint(apiKey) {
-  return `sha256:${createHash5("sha256").update(apiKey, "utf8").digest("hex")}`;
+  return `sha256:${createHash4("sha256").update(apiKey, "utf8").digest("hex")}`;
 }
 function readValidationCache(apiKey) {
   try {
@@ -17689,8 +19131,7 @@ async function runLoginDevice() {
     body: JSON.stringify({})
   });
   if (!response.ok) {
-    const text = await response.text();
-    console.error(`  Error: Failed to create device code. ${text}`);
+    console.error(`  Error: Failed to create device code (HTTP ${response.status}).`);
     process.exit(1);
   }
   const data = await response.json();
@@ -17940,7 +19381,7 @@ async function runHealthCheck(options) {
       checks.push({
         name: "Connectivity",
         ok: false,
-        detail: err instanceof Error ? err.message : "Failed to reach server"
+        detail: "Failed to reach the authentication service."
       });
     }
   }
@@ -17964,7 +19405,7 @@ async function runHealthCheck(options) {
     checks.push({
       name: "Connectivity",
       ok: false,
-      detail: err instanceof Error ? err.message : "Network error"
+      detail: "Network request failed."
     });
   }
   if (apiKey) {