@socialneuron/mcp-server 1.8.2 → 1.9.0

package/dist/http.js

@@ -46,6 +46,209 @@ var init_request_context = __esm({
   }
 });
 
+// src/lib/edge-function.ts
+var edge_function_exports = {};
+__export(edge_function_exports, {
+  callEdgeFunction: () => callEdgeFunction
+});
+function safeGatewayError(responseText, status) {
+  try {
+    const parsed = JSON.parse(responseText);
+    const nested = parsed.error && typeof parsed.error === "object" ? parsed.error : null;
+    const candidates = [
+      nested?.error_type,
+      nested?.code,
+      parsed.error_type,
+      parsed.error_code,
+      parsed.code,
+      typeof parsed.error === "string" ? parsed.error : null
+    ];
+    for (const value of candidates) {
+      if (typeof value !== "string") continue;
+      const normalized = value.trim().toLowerCase();
+      if (SAFE_GATEWAY_ERROR_CODES.has(normalized)) return normalized;
+      const embedded = [...SAFE_GATEWAY_ERROR_CODES].find((code) => normalized.includes(code));
+      if (embedded) return embedded;
+    }
+  } catch {
+  }
+  return `Backend request failed (HTTP ${status}).`;
+}
+function safeFailureData(responseText) {
+  try {
+    const parsed = JSON.parse(responseText);
+    const metric = (name) => {
+      const value = parsed[name];
+      return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+    };
+    const billingStatus = typeof parsed.billing_status === "string" && SAFE_BILLING_STATUSES.has(parsed.billing_status) ? parsed.billing_status : void 0;
+    const failureReason = parsed.failure_reason === "generation_failed" || parsed.failure_reason === "authentication_failed" || parsed.failure_reason === "cancelled_by_user" ? parsed.failure_reason : void 0;
+    const jobStatus = typeof parsed.status === "string" && SAFE_JOB_STATUSES.has(parsed.status) ? parsed.status : void 0;
+    const safe = {
+      ...jobStatus ? { status: jobStatus } : {},
+      ...metric("credits_reserved") !== void 0 ? { credits_reserved: metric("credits_reserved") } : {},
+      ...metric("credits_charged") !== void 0 ? { credits_charged: metric("credits_charged") } : {},
+      ...metric("credits_refunded") !== void 0 ? { credits_refunded: metric("credits_refunded") } : {},
+      ...billingStatus ? { billing_status: billingStatus } : {},
+      ...failureReason ? { failure_reason: failureReason } : {}
+    };
+    return Object.keys(safe).length > 0 ? safe : null;
+  } catch {
+    return null;
+  }
+}
+function getApiKeyOrNull() {
+  const envKey = process.env.SOCIALNEURON_API_KEY;
+  if (envKey && envKey.trim().length) return envKey.trim();
+  const requestToken = getRequestToken();
+  if (requestToken) return requestToken;
+  return getAuthenticatedApiKey();
+}
+async function callEdgeFunction(functionName, body, options) {
+  const supabaseUrl = getSupabaseUrl();
+  const apiKey = getApiKeyOrNull();
+  const controller = new AbortController();
+  const timeoutMs = options?.timeoutMs ?? 6e4;
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const enrichedBody = { ...body };
+  if (!enrichedBody.userId && !enrichedBody.user_id) {
+    try {
+      const defaultId = await getDefaultUserId();
+      enrichedBody.userId = defaultId;
+      enrichedBody.user_id = defaultId;
+    } catch {
+    }
+  } else {
+    if (enrichedBody.userId && !enrichedBody.user_id) enrichedBody.user_id = enrichedBody.userId;
+    if (enrichedBody.user_id && !enrichedBody.userId) enrichedBody.userId = enrichedBody.user_id;
+  }
+  if (!enrichedBody.projectId && !enrichedBody.project_id) {
+    try {
+      const { getDefaultProjectId: getDefaultProjectId2 } = await Promise.resolve().then(() => (init_supabase(), supabase_exports));
+      const defaultProjectId = await getDefaultProjectId2();
+      if (defaultProjectId) {
+        enrichedBody.projectId = defaultProjectId;
+        enrichedBody.project_id = defaultProjectId;
+      }
+    } catch {
+    }
+  }
+  let url;
+  let method = options?.method ?? "POST";
+  let headers;
+  let requestBody;
+  if (!apiKey) {
+    clearTimeout(timer);
+    return {
+      data: null,
+      error: "Not authenticated. Run: npx @socialneuron/mcp-server login \u2014 Requires a paid plan (Starter+). See https://socialneuron.com/pricing"
+    };
+  }
+  url = new URL(`${supabaseUrl}/functions/v1/mcp-gateway`);
+  headers = {
+    Authorization: `Bearer ${apiKey}`,
+    "Content-Type": "application/json"
+  };
+  requestBody = {
+    functionName,
+    body: enrichedBody,
+    query: options?.query,
+    method: method.toUpperCase(),
+    timeoutMs
+  };
+  method = "POST";
+  try {
+    const response = await fetch(url.toString(), {
+      method,
+      headers,
+      body: method === "GET" ? void 0 : JSON.stringify(requestBody),
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    const responseText = await response.text();
+    if (!response.ok) {
+      const errorCode = safeGatewayError(responseText, response.status);
+      const failureData = safeFailureData(responseText);
+      if (response.status === 401) {
+        return {
+          data: failureData,
+          error: `Authentication failed (HTTP 401). Run 'npx @socialneuron/mcp-server login' to re-authenticate.`
+        };
+      }
+      if (response.status === 403) {
+        return {
+          data: failureData,
+          error: `Forbidden (HTTP 403): ${errorCode}. This action isn't permitted for your account, plan, or scope \u2014 your connection is still valid.`
+        };
+      }
+      if (response.status === 429) {
+        const retryAfter = response.headers.get("retry-after") || "60";
+        return {
+          data: failureData,
+          error: `Rate limit exceeded (HTTP 429). Wait ${retryAfter}s before retrying. Reduce request frequency or upgrade your plan.`
+        };
+      }
+      return { data: failureData, error: errorCode };
+    }
+    try {
+      const data = JSON.parse(responseText);
+      return { data, error: null };
+    } catch {
+      return { data: { text: responseText }, error: null };
+    }
+  } catch (err) {
+    clearTimeout(timer);
+    if (err instanceof Error && err.name === "AbortError") {
+      return {
+        data: null,
+        error: `Edge Function '${functionName}' timed out after ${timeoutMs}ms`
+      };
+    }
+    return { data: null, error: "Network request failed. Please retry." };
+  }
+}
+var SAFE_GATEWAY_ERROR_CODES, SAFE_BILLING_STATUSES, SAFE_JOB_STATUSES;
+var init_edge_function = __esm({
+  "src/lib/edge-function.ts"() {
+    "use strict";
+    init_supabase();
+    init_request_context();
+    SAFE_GATEWAY_ERROR_CODES = /* @__PURE__ */ new Set([
+      "daily_limit_reached",
+      "insufficient_credits",
+      "project_scope_mismatch",
+      "schedule_conflict",
+      "post_not_found",
+      "post_not_reschedulable",
+      "post_in_progress",
+      "not_cancellable",
+      "publishing_in_progress",
+      "plan_upgrade_required",
+      "rate_limited",
+      "validation_error",
+      "permission_denied",
+      "not_found"
+    ]);
+    SAFE_BILLING_STATUSES = /* @__PURE__ */ new Set([
+      "reserved",
+      "charged",
+      "refunded",
+      "failed_no_charge",
+      "refund_pending",
+      "not_charged"
+    ]);
+    SAFE_JOB_STATUSES = /* @__PURE__ */ new Set([
+      "queued",
+      "pending",
+      "processing",
+      "completed",
+      "failed",
+      "cancelled",
+      "canceled"
+    ]);
+  }
+});
+
 // src/cli/credentials.ts
 var credentials_exports = {};
 __export(credentials_exports, {
@@ -72,6 +275,10 @@ import {
 } from "node:fs";
 import { homedir, platform } from "node:os";
 import { join } from "node:path";
+function loadNativeKeyring() {
+  nativeKeyringModule ??= import("@napi-rs/keyring").catch(() => null);
+  return nativeKeyringModule;
+}
 function assertSafeCredentialPaths() {
   if (platform() === "win32") return;
   const uid = process.getuid?.();
@@ -191,49 +398,90 @@ function writeCredentialsFile(data) {
   }
   hardenCredentialPermissions();
 }
-function macKeychainRead(service) {
+function isMacKeychainItemMissing(error) {
+  const commandError = error;
+  if (commandError?.status === 44) return true;
+  const detail = `${commandError?.stderr ?? ""}
+${commandError?.message ?? ""}`;
+  return /\berrsecitemnotfound\b/i.test(detail) || /(?:^|:\s*)the specified item could not be found in the keychain\.\s*$/i.test(detail.trim());
+}
+async function inspectMacKeychain(service) {
+  const native = await loadNativeKeyring();
+  if (native) {
+    try {
+      const value = new native.Entry(service, KEYCHAIN_ACCOUNT).getPassword();
+      if (value) return { status: "found", value };
+    } catch {
+    }
+  }
   try {
     const result = execFileSync(
       "security",
       ["find-generic-password", "-a", KEYCHAIN_ACCOUNT, "-s", service, "-w"],
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     );
-    return result.trim() || null;
-  } catch {
-    return null;
+    const value = result.trim();
+    return value ? { status: "found", value } : { status: "missing" };
+  } catch (error) {
+    return isMacKeychainItemMissing(error) ? { status: "missing" } : { status: "unavailable" };
   }
 }
-function macKeychainWrite(service, value) {
+async function macKeychainRead(service) {
+  const result = await inspectMacKeychain(service);
+  return result.status === "found" ? result.value : null;
+}
+async function macKeychainWrite(service, value) {
+  const native = await loadNativeKeyring();
+  if (!native) return false;
   try {
-    execFileSync(
-      "security",
-      [
-        "add-generic-password",
-        "-a",
-        KEYCHAIN_ACCOUNT,
-        "-s",
-        service,
-        "-w",
-        value,
-        "-U"
-        // update if exists
-      ],
-      { stdio: ["pipe", "pipe", "pipe"] }
-    );
+    new native.Entry(service, KEYCHAIN_ACCOUNT).setPassword(value);
     return true;
   } catch {
     return false;
   }
 }
-function macKeychainDelete(service) {
+async function macKeychainDelete(service) {
+  const native = await loadNativeKeyring();
+  let nativeDeleted = false;
+  if (native) {
+    try {
+      nativeDeleted = new native.Entry(service, KEYCHAIN_ACCOUNT).deletePassword();
+    } catch {
+    }
+  }
   try {
     execFileSync("security", ["delete-generic-password", "-a", KEYCHAIN_ACCOUNT, "-s", service], {
       stdio: ["pipe", "pipe", "pipe"]
     });
-    return true;
-  } catch {
-    return false;
+    return "deleted";
+  } catch (error) {
+    if (isMacKeychainItemMissing(error)) return nativeDeleted ? "deleted" : "missing";
+    return "unavailable";
+  }
+}
+async function clearMacKeychain(service) {
+  for (let attempt = 0; attempt < 4; attempt += 1) {
+    const deleted = await macKeychainDelete(service);
+    if (deleted === "unavailable") break;
+    const remaining = await inspectMacKeychain(service);
+    if (remaining.status === "missing") return;
+    if (remaining.status === "unavailable") break;
+  }
+  throw new Error(
+    "Unable to verify removal of the existing Social Neuron Keychain credential. Unlock Keychain Access, remove the item, and retry."
+  );
+}
+async function verifyMacFileFallback(service) {
+  const existing = await inspectMacKeychain(service);
+  if (existing.status === "missing") return;
+  if (existing.status === "found") {
+    throw new Error(
+      "An existing Social Neuron Keychain credential could not be replaced. The existing value was retained; unlock or remove it in Keychain Access and retry."
+    );
   }
+  throw new Error(
+    "Unable to verify absence of an existing Social Neuron Keychain credential. Unlock Keychain Access and retry."
+  );
 }
 function linuxSecretRead(key) {
   try {
@@ -274,7 +522,7 @@ async function loadApiKey() {
   if (envKey) return envKey;
   const os = platform();
   if (os === "darwin") {
-    const key = macKeychainRead(KEYCHAIN_SERVICE_API);
+    const key = await macKeychainRead(KEYCHAIN_SERVICE_API);
     if (key) return key;
   } else if (os === "linux") {
     const key = linuxSecretRead("api-key");
@@ -291,13 +539,18 @@ async function loadApiKey() {
 async function saveApiKey(key) {
   const os = platform();
   let saved = false;
+  let fallbackCredentials;
   if (os === "darwin") {
-    saved = macKeychainWrite(KEYCHAIN_SERVICE_API, key);
+    saved = await macKeychainWrite(KEYCHAIN_SERVICE_API, key);
+    if (!saved) {
+      fallbackCredentials = readCredentialsFile();
+      await verifyMacFileFallback(KEYCHAIN_SERVICE_API);
+    }
   } else if (os === "linux") {
     saved = linuxSecretWrite("api-key", key);
   }
   if (!saved) {
-    const creds = readCredentialsFile();
+    const creds = fallbackCredentials ?? readCredentialsFile();
     creds.apiKey = key;
     writeCredentialsFile(creds);
     if (os === "win32") {
@@ -320,8 +573,13 @@ async function saveApiKey(key) {
 }
 async function deleteApiKey() {
   const os = platform();
+  let keychainError;
   if (os === "darwin") {
-    macKeychainDelete(KEYCHAIN_SERVICE_API);
+    try {
+      await clearMacKeychain(KEYCHAIN_SERVICE_API);
+    } catch (error) {
+      keychainError = error;
+    }
   } else if (os === "linux") {
     linuxSecretDelete("api-key");
   }
@@ -337,13 +595,14 @@ async function deleteApiKey() {
       writeCredentialsFile(creds);
     }
   }
+  if (keychainError) throw keychainError;
 }
 async function loadSupabaseUrl() {
   const envUrl = process.env.SOCIALNEURON_SUPABASE_URL || process.env.SUPABASE_URL;
   if (envUrl) return envUrl;
   const os = platform();
   if (os === "darwin") {
-    const url = macKeychainRead(KEYCHAIN_SERVICE_URL);
+    const url = await macKeychainRead(KEYCHAIN_SERVICE_URL);
     if (url) return url;
   } else if (os === "linux") {
     const url = linuxSecretRead("supabase-url");
@@ -355,18 +614,23 @@ async function loadSupabaseUrl() {
 async function saveSupabaseUrl(url) {
   const os = platform();
   let saved = false;
+  let fallbackCredentials;
   if (os === "darwin") {
-    saved = macKeychainWrite(KEYCHAIN_SERVICE_URL, url);
+    saved = await macKeychainWrite(KEYCHAIN_SERVICE_URL, url);
+    if (!saved) {
+      fallbackCredentials = readCredentialsFile();
+      await verifyMacFileFallback(KEYCHAIN_SERVICE_URL);
+    }
   } else if (os === "linux") {
     saved = linuxSecretWrite("supabase-url", url);
   }
   if (!saved) {
-    const creds = readCredentialsFile();
+    const creds = fallbackCredentials ?? readCredentialsFile();
     creds.supabaseUrl = url;
     writeCredentialsFile(creds);
   }
 }
-var KEYCHAIN_ACCOUNT, KEYCHAIN_SERVICE_API, KEYCHAIN_SERVICE_URL, CONFIG_DIR, CREDENTIALS_FILE;
+var KEYCHAIN_ACCOUNT, KEYCHAIN_SERVICE_API, KEYCHAIN_SERVICE_URL, CONFIG_DIR, CREDENTIALS_FILE, nativeKeyringModule;
 var init_credentials = __esm({
   "src/cli/credentials.ts"() {
     "use strict";
@@ -519,7 +783,10 @@ __export(supabase_exports, {
   getSupabaseUrl: () => getSupabaseUrl,
   initializeAuth: () => initializeAuth,
   isTelemetryDisabled: () => isTelemetryDisabled,
-  logMcpToolInvocation: () => logMcpToolInvocation
+  listAccessibleProjectsWithAccountStatus: () => listAccessibleProjectsWithAccountStatus,
+  logMcpToolInvocation: () => logMcpToolInvocation,
+  resolveProjectForConnectedAccountTool: () => resolveProjectForConnectedAccountTool,
+  resolveProjectStrict: () => resolveProjectStrict
 });
 import { createClient } from "@supabase/supabase-js";
 import { randomUUID } from "node:crypto";
@@ -558,20 +825,17 @@ async function getDefaultUserId() {
   if (authenticatedUserId) return authenticatedUserId;
   const envUserId = process.env.SOCIALNEURON_USER_ID;
   if (envUserId) return envUserId;
-  throw new Error("No user ID available. Set SOCIALNEURON_USER_ID or authenticate via API key.");
+  throw new Error(
+    "No user ID available. Set SOCIALNEURON_USER_ID or authenticate via API key."
+  );
 }
 async function getDefaultProjectId() {
   const requestProjectId = getRequestProjectId();
   if (requestProjectId) return requestProjectId;
   if (authenticatedProjectId) return authenticatedProjectId;
   const userId = await getDefaultUserId().catch(() => null);
-  if (userId) {
-    const cached3 = projectIdCache.get(userId);
-    if (cached3) return cached3;
-  }
   const envProjectId = process.env.SOCIALNEURON_PROJECT_ID;
   if (envProjectId) {
-    if (userId) projectIdCache.set(userId, envProjectId);
     return envProjectId;
   }
   if (!userId) return null;
@@ -580,15 +844,126 @@ async function getDefaultProjectId() {
     const { data: memberships } = await supabase.from("organization_members").select("organization_id").eq("user_id", userId);
     const orgIds = (memberships ?? []).map((m) => m.organization_id);
     if (orgIds.length === 0) return null;
-    const { data } = await supabase.from("projects").select("id").in("organization_id", orgIds).order("created_at", { ascending: false }).limit(1).maybeSingle();
-    if (data?.id) {
-      projectIdCache.set(userId, data.id);
-      return data.id;
-    }
+    const { data } = await supabase.from("projects").select("id").in("organization_id", orgIds).order("created_at", { ascending: false }).limit(2);
+    if (data?.length === 1) return data[0].id;
   } catch {
   }
   return null;
 }
+function normalizePlatformFilter(platform2) {
+  if (!platform2) return null;
+  const values = Array.isArray(platform2) ? platform2 : [platform2];
+  const set = new Set(values.filter(Boolean).map((p) => p.toLowerCase()));
+  return set.size > 0 ? set : null;
+}
+async function listAccessibleProjectsWithAccountStatusDirect(userId, platform2) {
+  try {
+    const supabase = getSupabaseClient();
+    const { data: memberships } = await supabase.from("organization_members").select("organization_id").eq("user_id", userId);
+    const orgIds = (memberships ?? []).map((m) => m.organization_id);
+    if (orgIds.length === 0) return [];
+    const { data: projects } = await supabase.from("projects").select("id, name").in("organization_id", orgIds).order("created_at", { ascending: false });
+    const projectRows = projects ?? [];
+    if (projectRows.length === 0) return [];
+    const projectIds = projectRows.map((p) => p.id);
+    const { data: accounts } = await supabase.from("connected_accounts").select("project_id, status, platform").eq("user_id", userId).in("project_id", projectIds);
+    const anyAccountByProject = /* @__PURE__ */ new Set();
+    const platformsByProject = /* @__PURE__ */ new Map();
+    for (const row of accounts ?? []) {
+      if (row.status !== "active" && row.status !== "expires_soon") continue;
+      if (!row.project_id) continue;
+      anyAccountByProject.add(row.project_id);
+      if (row.platform) {
+        const set = platformsByProject.get(row.project_id) ?? /* @__PURE__ */ new Set();
+        set.add(row.platform.toLowerCase());
+        platformsByProject.set(row.project_id, set);
+      }
+    }
+    const requestedPlatforms = normalizePlatformFilter(platform2);
+    return projectRows.map((p) => {
+      const platforms = Array.from(platformsByProject.get(p.id) ?? []);
+      const hasConnectedAccounts = requestedPlatforms ? platforms.some((pl) => requestedPlatforms.has(pl)) : anyAccountByProject.has(p.id);
+      return { id: p.id, name: p.name, hasConnectedAccounts, platforms };
+    });
+  } catch {
+    return [];
+  }
+}
+async function listAccessibleProjectsWithAccountStatusViaEdgeFunction(userId, platform2) {
+  try {
+    const { callEdgeFunction: callEdgeFunction2 } = await Promise.resolve().then(() => (init_edge_function(), edge_function_exports));
+    const { data, error } = await callEdgeFunction2(
+      "mcp-data",
+      { action: "projects", userId, user_id: userId },
+      { timeoutMs: 1e4 }
+    );
+    if (error || !data?.success || !Array.isArray(data.projects)) return [];
+    const requestedPlatforms = normalizePlatformFilter(platform2);
+    return data.projects.map((p) => {
+      const platforms = (p.platforms ?? []).map((pl) => pl.toLowerCase());
+      const hasConnectedAccounts = requestedPlatforms ? platforms.some((pl) => requestedPlatforms.has(pl)) : Boolean(p.hasConnectedAccounts);
+      return { id: p.id, name: p.name, hasConnectedAccounts, platforms };
+    });
+  } catch {
+    return [];
+  }
+}
+async function listAccessibleProjectsWithAccountStatus(userId, platform2) {
+  if (getServiceKeyOrNull()) {
+    return listAccessibleProjectsWithAccountStatusDirect(userId, platform2);
+  }
+  return listAccessibleProjectsWithAccountStatusViaEdgeFunction(
+    userId,
+    platform2
+  );
+}
+async function resolveProjectForConnectedAccountTool(explicitProjectId, platform2) {
+  if (explicitProjectId) return { projectId: explicitProjectId };
+  const defaultProjectId = await getDefaultProjectId();
+  if (defaultProjectId) return { projectId: defaultProjectId };
+  const genericError = "project_id is required. Configure an explicit project or use an API key scoped to exactly one project.";
+  const userId = await getDefaultUserId().catch(() => null);
+  if (!userId) return { error: genericError };
+  const projects = await listAccessibleProjectsWithAccountStatus(
+    userId,
+    platform2
+  );
+  if (projects.length === 0) return { error: genericError };
+  const withAccounts = projects.filter((p) => p.hasConnectedAccounts);
+  if (withAccounts.length === 1) {
+    const chosen = withAccounts[0];
+    const platformNote = platform2 ? ` for ${Array.isArray(platform2) ? platform2.join("/") : platform2}` : "";
+    return {
+      projectId: chosen.id,
+      autoResolvedNote: `project_id was not provided; auto-resolved to "${chosen.name}" (${chosen.id}) \u2014 the only one of your ${projects.length} project(s) with an active connected account${platformNote}.`,
+      projects
+    };
+  }
+  const projectList = projects.map(
+    (p) => `${p.name} (${p.id}${p.hasConnectedAccounts ? ", has connected accounts" : ""})`
+  ).join("; ");
+  return {
+    error: `project_id is required \u2014 your account has ${projects.length} projects and the target could not be auto-resolved. Pass the exact project_id from this list: ${projectList}.`,
+    projects
+  };
+}
+async function resolveProjectStrict(explicitProjectId) {
+  if (explicitProjectId) return { projectId: explicitProjectId };
+  const defaultProjectId = await getDefaultProjectId();
+  if (defaultProjectId) return { projectId: defaultProjectId };
+  const genericError = "project_id is required. Configure an explicit project or use an API key scoped to exactly one project.";
+  const userId = await getDefaultUserId().catch(() => null);
+  if (!userId) return { error: genericError };
+  const projects = await listAccessibleProjectsWithAccountStatus(userId);
+  if (projects.length === 0) return { error: genericError };
+  const projectList = projects.map(
+    (p) => `${p.name} (${p.id}${p.hasConnectedAccounts ? ", has connected accounts" : ""})`
+  ).join("; ");
+  return {
+    error: `project_id is required \u2014 your account has ${projects.length} projects. Pass the exact project_id from this list: ${projectList}.`,
+    projects
+  };
+}
 async function initializeAuth() {
   const { loadApiKey: loadApiKey2 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));
   const apiKey = await loadApiKey2();
@@ -614,8 +989,11 @@ async function initializeAuth() {
       }
       if (authenticatedExpiresAt) {
         const expiresMs = new Date(authenticatedExpiresAt).getTime();
-        const daysLeft = Math.ceil((expiresMs - Date.now()) / (1e3 * 60 * 60 * 24));
-        if (!_quietAuth) console.error("[MCP] Key expires: " + authenticatedExpiresAt);
+        const daysLeft = Math.ceil(
+          (expiresMs - Date.now()) / (1e3 * 60 * 60 * 24)
+        );
+        if (!_quietAuth)
+          console.error("[MCP] Key expires: " + authenticatedExpiresAt);
         if (daysLeft <= 7) {
           console.error(
             `[MCP] Warning: API key expires in ${daysLeft} day(s). Run: npx @socialneuron/mcp-server login`
@@ -694,7 +1072,7 @@ async function logMcpToolInvocation(args) {
   Promise.resolve().then(() => (init_posthog(), posthog_exports)).then(({ captureToolEvent: captureToolEvent2 }) => captureToolEvent2(args)).catch(() => {
   });
 }
-var SUPABASE_URL, SUPABASE_SERVICE_KEY, client2, _authMode, authenticatedUserId, authenticatedScopes, authenticatedEmail, authenticatedExpiresAt, authenticatedApiKey, authenticatedProjectId, MCP_RUN_ID, CLOUD_SUPABASE_URL, CLOUD_SUPABASE_ANON_KEY, projectIdCache;
+var SUPABASE_URL, SUPABASE_SERVICE_KEY, client2, _authMode, authenticatedUserId, authenticatedScopes, authenticatedEmail, authenticatedExpiresAt, authenticatedApiKey, authenticatedProjectId, MCP_RUN_ID, CLOUD_SUPABASE_URL, CLOUD_SUPABASE_ANON_KEY;
 var init_supabase = __esm({
   "src/lib/supabase.ts"() {
     "use strict";
@@ -712,7 +1090,6 @@ var init_supabase = __esm({
     MCP_RUN_ID = randomUUID();
     CLOUD_SUPABASE_URL = "https://rhukkjscgzauutioyeei.supabase.co";
     CLOUD_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InJodWtranNjZ3phdXV0aW95ZWVpIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjQ4NjM4ODYsImV4cCI6MjA4MDQzOTg4Nn0.JVtrviGvN0HaSh0JFS5KNl5FAB5ffG5Y1IMZsQFUrNQ";
-    projectIdCache = /* @__PURE__ */ new Map();
   }
 });
 
@@ -1959,255 +2336,63 @@ function scrubPii(text, _role) {
     const matched = re.test(out);
     re.lastIndex = 0;
     if (matched) {
-      out = out.replace(re, `[REDACTED:${name}]`);
-      hits.push(name);
-    }
-  }
-  return { text: out, redacted: hits.length > 0, patterns: hits };
-}
-
-// src/lib/agent-harness/scanner.ts
-function scan(text, options) {
-  const flagged = /* @__PURE__ */ new Set();
-  let risk = 0;
-  const maxLength = options.source === "mcp_tool_output" ? CONSTANTS.MAX_OUTPUT_LENGTH : CONSTANTS.MAX_LENGTH;
-  if (text.length > maxLength) {
-    return {
-      passed: false,
-      risk_score: 1,
-      flagged_patterns: ["excessive_length"],
-      pii_redacted: false
-    };
-  }
-  const zw = detectZeroWidth(text);
-  if (zw.found) {
-    flagged.add(zw.pattern);
-    risk = Math.max(risk, 0.95);
-  }
-  const ipRaw = detectInstructionPhrase(text);
-  if (ipRaw.found) {
-    flagged.add(ipRaw.pattern);
-    risk = Math.max(risk, 0.9);
-  }
-  const normalized = normalize(text);
-  const ipNorm = detectInstructionPhrase(normalized);
-  if (ipNorm.found) {
-    flagged.add(ipNorm.pattern);
-    risk = Math.max(risk, 0.9);
-  }
-  const flaggedArr = Array.from(flagged);
-  if ((options.mode === "block" || options.mode === "sanitize") && flaggedArr.length > 0) {
-    return { passed: false, risk_score: risk, flagged_patterns: flaggedArr, pii_redacted: false };
-  }
-  const pii = scrubPii(normalized, options.source);
-  if (pii.redacted) {
-    return {
-      passed: true,
-      risk_score: Math.max(risk, 0.3),
-      flagged_patterns: [...flaggedArr, ...pii.patterns.map((p) => `pii_${p}`)],
-      sanitized_text: pii.text,
-      pii_redacted: true
-    };
-  }
-  return { passed: true, risk_score: risk, flagged_patterns: flaggedArr, pii_redacted: false };
-}
-
-// src/tools/ideation.ts
-import { z } from "zod";
-
-// src/lib/edge-function.ts
-init_supabase();
-init_request_context();
-var SAFE_GATEWAY_ERROR_CODES = /* @__PURE__ */ new Set([
-  "daily_limit_reached",
-  "insufficient_credits",
-  "project_scope_mismatch",
-  "schedule_conflict",
-  "post_not_found",
-  "post_not_reschedulable",
-  "post_in_progress",
-  "not_cancellable",
-  "publishing_in_progress",
-  "plan_upgrade_required",
-  "rate_limited",
-  "validation_error",
-  "permission_denied",
-  "not_found"
-]);
-function safeGatewayError(responseText, status) {
-  try {
-    const parsed = JSON.parse(responseText);
-    const nested = parsed.error && typeof parsed.error === "object" ? parsed.error : null;
-    const candidates = [
-      nested?.error_type,
-      nested?.code,
-      parsed.error_type,
-      parsed.error_code,
-      parsed.code,
-      typeof parsed.error === "string" ? parsed.error : null
-    ];
-    for (const value of candidates) {
-      if (typeof value !== "string") continue;
-      const normalized = value.trim().toLowerCase();
-      if (SAFE_GATEWAY_ERROR_CODES.has(normalized)) return normalized;
-      const embedded = [...SAFE_GATEWAY_ERROR_CODES].find((code) => normalized.includes(code));
-      if (embedded) return embedded;
-    }
-  } catch {
-  }
-  return `Backend request failed (HTTP ${status}).`;
-}
-var SAFE_BILLING_STATUSES = /* @__PURE__ */ new Set([
-  "reserved",
-  "charged",
-  "refunded",
-  "failed_no_charge",
-  "refund_pending",
-  "not_charged"
-]);
-var SAFE_JOB_STATUSES = /* @__PURE__ */ new Set([
-  "queued",
-  "pending",
-  "processing",
-  "completed",
-  "failed",
-  "cancelled",
-  "canceled"
-]);
-function safeFailureData(responseText) {
-  try {
-    const parsed = JSON.parse(responseText);
-    const metric = (name) => {
-      const value = parsed[name];
-      return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
-    };
-    const billingStatus = typeof parsed.billing_status === "string" && SAFE_BILLING_STATUSES.has(parsed.billing_status) ? parsed.billing_status : void 0;
-    const failureReason = parsed.failure_reason === "generation_failed" || parsed.failure_reason === "authentication_failed" || parsed.failure_reason === "cancelled_by_user" ? parsed.failure_reason : void 0;
-    const jobStatus = typeof parsed.status === "string" && SAFE_JOB_STATUSES.has(parsed.status) ? parsed.status : void 0;
-    const safe = {
-      ...jobStatus ? { status: jobStatus } : {},
-      ...metric("credits_reserved") !== void 0 ? { credits_reserved: metric("credits_reserved") } : {},
-      ...metric("credits_charged") !== void 0 ? { credits_charged: metric("credits_charged") } : {},
-      ...metric("credits_refunded") !== void 0 ? { credits_refunded: metric("credits_refunded") } : {},
-      ...billingStatus ? { billing_status: billingStatus } : {},
-      ...failureReason ? { failure_reason: failureReason } : {}
-    };
-    return Object.keys(safe).length > 0 ? safe : null;
-  } catch {
-    return null;
-  }
-}
-function getApiKeyOrNull() {
-  const envKey = process.env.SOCIALNEURON_API_KEY;
-  if (envKey && envKey.trim().length) return envKey.trim();
-  const requestToken = getRequestToken();
-  if (requestToken) return requestToken;
-  return getAuthenticatedApiKey();
-}
-async function callEdgeFunction(functionName, body, options) {
-  const supabaseUrl = getSupabaseUrl();
-  const apiKey = getApiKeyOrNull();
-  const controller = new AbortController();
-  const timeoutMs = options?.timeoutMs ?? 6e4;
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const enrichedBody = { ...body };
-  if (!enrichedBody.userId && !enrichedBody.user_id) {
-    try {
-      const defaultId = await getDefaultUserId();
-      enrichedBody.userId = defaultId;
-      enrichedBody.user_id = defaultId;
-    } catch {
-    }
-  } else {
-    if (enrichedBody.userId && !enrichedBody.user_id) enrichedBody.user_id = enrichedBody.userId;
-    if (enrichedBody.user_id && !enrichedBody.userId) enrichedBody.userId = enrichedBody.user_id;
-  }
-  if (!enrichedBody.projectId && !enrichedBody.project_id) {
-    try {
-      const { getDefaultProjectId: getDefaultProjectId2 } = await Promise.resolve().then(() => (init_supabase(), supabase_exports));
-      const defaultProjectId = await getDefaultProjectId2();
-      if (defaultProjectId) {
-        enrichedBody.projectId = defaultProjectId;
-        enrichedBody.project_id = defaultProjectId;
-      }
-    } catch {
-    }
-  }
-  let url;
-  let method = options?.method ?? "POST";
-  let headers;
-  let requestBody;
-  if (!apiKey) {
-    clearTimeout(timer);
-    return {
-      data: null,
-      error: "Not authenticated. Run: npx @socialneuron/mcp-server login \u2014 Requires a paid plan (Starter+). See https://socialneuron.com/pricing"
-    };
-  }
-  url = new URL(`${supabaseUrl}/functions/v1/mcp-gateway`);
-  headers = {
-    Authorization: `Bearer ${apiKey}`,
-    "Content-Type": "application/json"
-  };
-  requestBody = {
-    functionName,
-    body: enrichedBody,
-    query: options?.query,
-    method: method.toUpperCase(),
-    timeoutMs
-  };
-  method = "POST";
-  try {
-    const response = await fetch(url.toString(), {
-      method,
-      headers,
-      body: method === "GET" ? void 0 : JSON.stringify(requestBody),
-      signal: controller.signal
-    });
-    clearTimeout(timer);
-    const responseText = await response.text();
-    if (!response.ok) {
-      const errorCode = safeGatewayError(responseText, response.status);
-      const failureData = safeFailureData(responseText);
-      if (response.status === 401) {
-        return {
-          data: failureData,
-          error: `Authentication failed (HTTP 401). Run 'npx @socialneuron/mcp-server login' to re-authenticate.`
-        };
-      }
-      if (response.status === 403) {
-        return {
-          data: failureData,
-          error: `Forbidden (HTTP 403): ${errorCode}. This action isn't permitted for your account, plan, or scope \u2014 your connection is still valid.`
-        };
-      }
-      if (response.status === 429) {
-        const retryAfter = response.headers.get("retry-after") || "60";
-        return {
-          data: failureData,
-          error: `Rate limit exceeded (HTTP 429). Wait ${retryAfter}s before retrying. Reduce request frequency or upgrade your plan.`
-        };
-      }
-      return { data: failureData, error: errorCode };
-    }
-    try {
-      const data = JSON.parse(responseText);
-      return { data, error: null };
-    } catch {
-      return { data: { text: responseText }, error: null };
-    }
-  } catch (err) {
-    clearTimeout(timer);
-    if (err instanceof Error && err.name === "AbortError") {
-      return {
-        data: null,
-        error: `Edge Function '${functionName}' timed out after ${timeoutMs}ms`
-      };
+      out = out.replace(re, `[REDACTED:${name}]`);
+      hits.push(name);
     }
-    return { data: null, error: "Network request failed. Please retry." };
   }
+  return { text: out, redacted: hits.length > 0, patterns: hits };
+}
+
+// src/lib/agent-harness/scanner.ts
+function scan(text, options) {
+  const flagged = /* @__PURE__ */ new Set();
+  let risk = 0;
+  const maxLength = options.source === "mcp_tool_output" ? CONSTANTS.MAX_OUTPUT_LENGTH : CONSTANTS.MAX_LENGTH;
+  if (text.length > maxLength) {
+    return {
+      passed: false,
+      risk_score: 1,
+      flagged_patterns: ["excessive_length"],
+      pii_redacted: false
+    };
+  }
+  const zw = detectZeroWidth(text);
+  if (zw.found) {
+    flagged.add(zw.pattern);
+    risk = Math.max(risk, 0.95);
+  }
+  const ipRaw = detectInstructionPhrase(text);
+  if (ipRaw.found) {
+    flagged.add(ipRaw.pattern);
+    risk = Math.max(risk, 0.9);
+  }
+  const normalized = normalize(text);
+  const ipNorm = detectInstructionPhrase(normalized);
+  if (ipNorm.found) {
+    flagged.add(ipNorm.pattern);
+    risk = Math.max(risk, 0.9);
+  }
+  const flaggedArr = Array.from(flagged);
+  if ((options.mode === "block" || options.mode === "sanitize") && flaggedArr.length > 0) {
+    return { passed: false, risk_score: risk, flagged_patterns: flaggedArr, pii_redacted: false };
+  }
+  const pii = scrubPii(normalized, options.source);
+  if (pii.redacted) {
+    return {
+      passed: true,
+      risk_score: Math.max(risk, 0.3),
+      flagged_patterns: [...flaggedArr, ...pii.patterns.map((p) => `pii_${p}`)],
+      sanitized_text: pii.text,
+      pii_redacted: true
+    };
+  }
+  return { passed: true, risk_score: risk, flagged_patterns: flaggedArr, pii_redacted: false };
 }
 
+// src/tools/ideation.ts
+init_edge_function();
+import { z } from "zod";
+
 // src/lib/rate-limit.ts
 var CATEGORY_CONFIGS = {
   posting: { maxTokens: 30, refillRate: 30 / 60 },
@@ -2324,7 +2509,7 @@ function checkRateLimit(category, key) {
 init_supabase();
 
 // src/lib/version.ts
-var MCP_VERSION = "1.8.2";
+var MCP_VERSION = "1.9.0";
 
 // src/tools/ideation.ts
 function asEnvelope(data) {
@@ -2725,6 +2910,7 @@ ${content}`,
 }
 
 // src/tools/content.ts
+init_edge_function();
 import { z as z2 } from "zod";
 init_supabase();
 
@@ -2959,7 +3145,10 @@ function registerContentTools(server) {
           isError: true
         };
       }
-      const rateLimit = checkRateLimit("generation", `generate_video:${userId}`);
+      const rateLimit = checkRateLimit(
+        "generation",
+        `generate_video:${userId}`
+      );
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -3082,7 +3271,14 @@ function registerContentTools(server) {
       project_id: z2.string().optional().describe("Project ID to associate the generated image with."),
       response_format: z2.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ prompt, model, aspect_ratio, image_url, project_id, response_format }) => {
+    async ({
+      prompt,
+      model,
+      aspect_ratio,
+      image_url,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
       const userId = await getDefaultUserId();
       const assetBudget = checkAssetBudget();
@@ -3100,7 +3296,10 @@ function registerContentTools(server) {
           isError: true
         };
       }
-      const rateLimit = checkRateLimit("generation", `generate_image:${userId}`);
+      const rateLimit = checkRateLimit(
+        "generation",
+        `generate_image:${userId}`
+      );
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -3231,6 +3430,15 @@ function registerContentTools(server) {
           isError: true
         };
       }
+      let projectsDisclosure;
+      const ownScopedProjectId = await getDefaultProjectId();
+      if (!ownScopedProjectId) {
+        const ownUserId = await getDefaultUserId().catch(() => null);
+        if (ownUserId) {
+          const list = await listAccessibleProjectsWithAccountStatus(ownUserId);
+          if (list.length > 0) projectsDisclosure = list;
+        }
+      }
       if (job.external_id && (job.status === "pending" || job.status === "processing")) {
         const { data: liveStatus } = await callEdgeFunction(
           "kie-task-status",
@@ -3254,7 +3462,9 @@ function registerContentTools(server) {
           if (livePayload.error) {
             lines2.push(`Error: ${livePayload.error}`);
           }
-          const fallbackDisclosure2 = buildFallbackDisclosureLine(job.result_metadata);
+          const fallbackDisclosure2 = buildFallbackDisclosureLine(
+            job.result_metadata
+          );
           if (fallbackDisclosure2) lines2.push(fallbackDisclosure2);
           lines2.push(`Credits: ${job.credits_cost}`);
           if (job.billing_status) {
@@ -3263,6 +3473,14 @@ function registerContentTools(server) {
             );
           }
           lines2.push(`Created: ${job.created_at}`);
+          if (projectsDisclosure) {
+            lines2.push(
+              "",
+              `Projects (project_id required elsewhere? pick one): ${projectsDisclosure.map(
+                (p) => `${p.name} (${p.id}${p.hasConnectedAccounts ? ", has connected accounts" : ""})`
+              ).join("; ")}`
+            );
+          }
           if (format === "json") {
             return {
               content: [
@@ -3279,7 +3497,8 @@ function registerContentTools(server) {
                     // `job` + `liveStatus`; do not duplicate them here.
                     asEnvelope2({
                       ...liveStatus,
-                      ...livePayload
+                      ...livePayload,
+                      ...projectsDisclosure ? { projects: projectsDisclosure } : {}
                     }),
                     null,
                     2
@@ -3322,7 +3541,9 @@ function registerContentTools(server) {
       if (job.error_message) {
         lines.push(`Error: ${job.error_message}`);
       }
-      const fallbackDisclosure = buildFallbackDisclosureLine(job.result_metadata);
+      const fallbackDisclosure = buildFallbackDisclosureLine(
+        job.result_metadata
+      );
       if (fallbackDisclosure) lines.push(fallbackDisclosure);
       lines.push(`Credits: ${job.credits_cost}`);
       if (job.billing_status) {
@@ -3334,10 +3555,19 @@ function registerContentTools(server) {
       if (job.completed_at) {
         lines.push(`Completed: ${job.completed_at}`);
       }
+      if (projectsDisclosure) {
+        lines.push(
+          "",
+          `Projects (project_id required elsewhere? pick one): ${projectsDisclosure.map(
+            (p) => `${p.name} (${p.id}${p.hasConnectedAccounts ? ", has connected accounts" : ""})`
+          ).join("; ")}`
+        );
+      }
       if (format === "json") {
         const enriched = {
           ...job,
-          ...buildCheckStatusPayload(job)
+          ...buildCheckStatusPayload(job),
+          ...projectsDisclosure ? { projects: projectsDisclosure } : {}
         };
         return {
           content: [
@@ -3827,6 +4057,7 @@ Return ONLY valid JSON in this exact format:
 }
 
 // src/tools/distribution.ts
+init_edge_function();
 import { z as z3 } from "zod";
 import { createHash } from "node:crypto";
 
@@ -4153,6 +4384,116 @@ function evaluateQuality(input) {
   };
 }
 
+// src/lib/connected-account-routing.ts
+init_edge_function();
+var PLATFORM_CASE_MAP = {
+  youtube: "YouTube",
+  tiktok: "TikTok",
+  instagram: "Instagram",
+  twitter: "Twitter",
+  x: "Twitter",
+  linkedin: "LinkedIn",
+  facebook: "Facebook",
+  threads: "Threads",
+  bluesky: "Bluesky"
+};
+function canonicalPlatform(value) {
+  const normalized = value.trim().toLowerCase();
+  return normalized === "x" ? "twitter" : normalized;
+}
+function providerPlatform(value) {
+  return PLATFORM_CASE_MAP[canonicalPlatform(value)] ?? value;
+}
+function isUsable(account) {
+  const status = account.effective_status ?? account.status;
+  return status === "active" || status === "expires_soon";
+}
+function normalizeRequestedIds(requested) {
+  const ids = /* @__PURE__ */ new Map();
+  for (const [platform2, accountId] of Object.entries(requested ?? {})) {
+    const canonical = canonicalPlatform(platform2);
+    const existing = ids.get(canonical);
+    if (existing && existing !== accountId) {
+      return {
+        error: `Conflicting account IDs were supplied for ${platform2} and its platform alias.`
+      };
+    }
+    ids.set(canonical, accountId);
+  }
+  return { ids };
+}
+async function resolveConnectedAccountRouting(input) {
+  const normalizedRequested = normalizeRequestedIds(input.requestedAccountIds);
+  if (normalizedRequested.error) return { error: normalizedRequested.error };
+  const targetPlatforms = new Set(input.platforms.map(canonicalPlatform));
+  for (const requestedPlatform of normalizedRequested.ids?.keys() ?? []) {
+    if (!targetPlatforms.has(requestedPlatform)) {
+      return {
+        error: `An account ID was supplied for untargeted platform ${requestedPlatform}.`
+      };
+    }
+  }
+  const { data, error } = await callEdgeFunction(
+    "mcp-data",
+    {
+      action: "connected-accounts",
+      projectId: input.projectId,
+      project_id: input.projectId
+    },
+    { timeoutMs: 1e4 }
+  );
+  if (error || !Array.isArray(data?.accounts)) {
+    return {
+      error: `Connected-account verification failed: ${error ?? data?.error ?? "no account inventory returned"}.`
+    };
+  }
+  const connectedAccountIds = {};
+  for (const platform2 of input.platforms) {
+    const canonical = canonicalPlatform(platform2);
+    const displayPlatform = providerPlatform(platform2);
+    const platformAccounts = data.accounts.filter(
+      (account) => canonicalPlatform(account.platform) === canonical && account.project_id === input.projectId && isUsable(account)
+    );
+    const requestedId = normalizedRequested.ids?.get(canonical);
+    let selected;
+    if (requestedId) {
+      selected = data.accounts.find((account) => account.id === requestedId);
+      if (!selected) {
+        return {
+          error: `${displayPlatform}: account ${requestedId} is not available for project_id ${input.projectId}.`
+        };
+      }
+      if (canonicalPlatform(selected.platform) !== canonical) {
+        return {
+          error: `${displayPlatform}: account ${requestedId} belongs to ${selected.platform}.`
+        };
+      }
+      if (selected.project_id !== input.projectId) {
+        return {
+          error: `${displayPlatform}: account ${requestedId} is not bound to project_id ${input.projectId}.`
+        };
+      }
+      if (!isUsable(selected)) {
+        return {
+          error: `${displayPlatform}: account ${requestedId} is ${selected.effective_status ?? selected.status}.`
+        };
+      }
+    } else if (platformAccounts.length === 1) {
+      selected = platformAccounts[0];
+    } else if (platformAccounts.length === 0) {
+      return {
+        error: `${displayPlatform}: no active account is bound to project_id ${input.projectId}.`
+      };
+    } else {
+      return {
+        error: `${displayPlatform}: multiple active accounts are bound to project_id ${input.projectId}; pass the exact account ID returned by list_connected_accounts.`
+      };
+    }
+    connectedAccountIds[displayPlatform] = selected.id;
+  }
+  return { connectedAccountIds };
+}
+
 // src/tools/distribution.ts
 function snakeToCamel(obj) {
   const result = {};
@@ -4170,11 +4511,16 @@ function convertPlatformMetadata(meta) {
   }
   return converted;
 }
-var PLATFORM_CASE_MAP = {
+var PLATFORM_CASE_MAP2 = {
   youtube: "YouTube",
   tiktok: "TikTok",
   instagram: "Instagram",
   twitter: "Twitter",
+  // 'x' is the platform's current branding but connected_account_routing.ts
+  // (and the DB convention) still key on 'Twitter' — keep both aliases
+  // resolving to the same case so schedule_content_plan's platform:'x' posts
+  // don't fall through to an undefined binding (F8, 2026-07-15).
+  x: "Twitter",
   linkedin: "LinkedIn",
   facebook: "Facebook",
   threads: "Threads",
@@ -4296,21 +4642,6 @@ async function validatePublishMediaUrl(url) {
 function accountEffectiveStatus(account) {
   return account.effective_status || account.status;
 }
-function isUsableAccount(account) {
-  const status = accountEffectiveStatus(account);
-  return status === "active" || status === "expires_soon";
-}
-function formatAccountChoice(account) {
-  const name = account.username ? `@${account.username}` : "unnamed";
-  const project = account.project_id ? `project_id=${account.project_id}` : "project_id=unassigned";
-  const refresh = account.has_refresh_token ? "OAuth 2.0 refresh" : "no refresh token";
-  return `${account.id} (${name}, ${project}, ${accountEffectiveStatus(account)}, ${refresh})`;
-}
-function requestedAccountIdForPlatform(accountId, accountIds, platform2) {
-  if (accountId) return accountId;
-  if (!accountIds) return void 0;
-  return accountIds[platform2] || accountIds[platform2.toLowerCase()];
-}
 async function rehostExternalUrl(mediaUrl, projectId) {
   const ssrf = await validateUrlForSSRF(mediaUrl);
   if (!ssrf.isValid) {
@@ -4446,17 +4777,17 @@ function registerDistributionTools(server) {
       schedule_at: z3.string().optional().describe(
         'ISO 8601 UTC datetime for scheduled posting (e.g. "2026-03-20T14:00:00Z"). Omit to post immediately. Must be in the future.'
       ),
-      project_id: z3.string().optional().describe(
+      project_id: z3.string().uuid().optional().describe(
         "Social Neuron brand/project ID to associate this post with. Provide this when the account has multiple brands so brand voice and connected account routing stay scoped to the right brand."
       ),
       response_format: z3.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text."),
       attribution: z3.boolean().optional().describe(
         'If true, appends "Created with Social Neuron" to the caption. Default: false.'
       ),
-      account_id: z3.string().optional().describe(
-        "Connected account ID to post from. Use list_connected_accounts to find the right ID. Required when multiple accounts exist for the same platform. If project_id is provided, the account must belong to that project or be unassigned."
+      account_id: z3.string().uuid().optional().describe(
+        "Connected account ID to post from. Optional when the resolved project has exactly one active account for the target platform \u2014 it is auto-bound. Required (with a clear error listing candidates) when multiple accounts exist for the same platform. Use list_connected_accounts to find the right ID. The account must be active and bound to the exact project_id."
       ),
-      account_ids: z3.record(z3.string(), z3.string()).optional().describe(
+      account_ids: z3.record(z3.string(), z3.string().uuid()).optional().describe(
         'Per-platform account IDs when posting to multiple platforms. Example: {"twitter": "abc123", "instagram": "def456"}. Use list_connected_accounts with the same project_id to find IDs.'
       ),
       auto_rehost: z3.boolean().optional().describe(
@@ -4500,6 +4831,45 @@ function registerDistributionTools(server) {
           isError: true
         };
       }
+      const projectResolution = await resolveProjectForConnectedAccountTool(
+        project_id,
+        platforms
+      );
+      if (!projectResolution.projectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: projectResolution.error ?? "A project_id is required for publishing. Configure an explicit project or use an API key that is scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolvedProjectId = projectResolution.projectId;
+      const projectAutoResolvedNote = projectResolution.autoResolvedNote;
+      if (account_id && account_ids) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "Pass either account_id or account_ids, not both."
+            }
+          ],
+          isError: true
+        };
+      }
+      if (account_id && platforms.length !== 1) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "account_id is valid only for a single target platform. Use account_ids for multi-platform publishing."
+            }
+          ],
+          isError: true
+        };
+      }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("posting", `schedule_post:${userId}`);
       if (!rateLimit.allowed) {
@@ -4604,11 +4974,16 @@ function registerDistributionTools(server) {
           }
           const resolvedJobs = resolved;
           resolvedMediaUrls = resolvedJobs.map((item) => item.url);
-          resolvedMediaUrlsAreTrustedR2 = resolvedJobs.map((item) => item.trustedR2);
+          resolvedMediaUrlsAreTrustedR2 = resolvedJobs.map(
+            (item) => item.trustedR2
+          );
         }
         const shouldRehost = auto_rehost !== false;
         if (shouldRehost && resolvedMediaUrl && !resolvedMediaUrlIsTrustedR2) {
-          const rehost = await rehostExternalUrl(resolvedMediaUrl, project_id);
+          const rehost = await rehostExternalUrl(
+            resolvedMediaUrl,
+            resolvedProjectId
+          );
           if ("error" in rehost) {
             return {
               content: [
@@ -4626,7 +5001,7 @@ function registerDistributionTools(server) {
         if (shouldRehost && resolvedMediaUrls && resolvedMediaUrls.length > 0) {
           const rehosted = await Promise.all(
             resolvedMediaUrls.map(
-              (u, index) => resolvedMediaUrlsAreTrustedR2[index] ? Promise.resolve({ signedUrl: u, r2Key: "" }) : rehostExternalUrl(u, project_id)
+              (u, index) => resolvedMediaUrlsAreTrustedR2[index] ? Promise.resolve({ signedUrl: u, r2Key: "" }) : rehostExternalUrl(u, resolvedProjectId)
             )
           );
           const failIdx = rehosted.findIndex((r) => "error" in r);
@@ -4693,7 +5068,7 @@ function registerDistributionTools(server) {
         }
       }
       const normalizedPlatforms = platforms.map(
-        (p) => PLATFORM_CASE_MAP[p.toLowerCase()] || p
+        (p) => PLATFORM_CASE_MAP2[p.toLowerCase()] || p
       );
       const blockedPlatforms = normalizedPlatforms.filter(
         (p) => MCP_NOT_LIVE_FOR_POSTING.has(p)
@@ -4709,92 +5084,27 @@ function registerDistributionTools(server) {
           isError: true
         };
       }
-      const { data: accountsData } = await callEdgeFunction(
-        "mcp-data",
-        {
-          action: "connected-accounts",
-          ...project_id ? { projectId: project_id, project_id } : {}
-        },
-        { timeoutMs: 1e4 }
-      );
-      if (accountsData?.accounts) {
-        const accounts = accountsData.accounts;
-        const issues = [];
-        for (const platform2 of normalizedPlatforms) {
-          const platformAccounts = accounts.filter(
-            (a) => a.platform.toLowerCase() === platform2.toLowerCase() && isUsableAccount(a)
-          );
-          const requestedAccountId = requestedAccountIdForPlatform(
-            account_id,
-            account_ids,
-            platform2
-          );
-          if (requestedAccountId) {
-            const selected = accounts.find((a) => a.id === requestedAccountId);
-            if (!selected) {
-              issues.push(
-                `${platform2}: Account "${requestedAccountId}" is not available${project_id ? ` for project_id ${project_id}` : ""}. Call \`list_connected_accounts\`${project_id ? " with the same project_id" : ""} and choose one of the returned IDs.`
-              );
-            } else if (selected.platform.toLowerCase() !== platform2.toLowerCase()) {
-              issues.push(
-                `${platform2}: Account "${requestedAccountId}" belongs to ${selected.platform}, not ${platform2}.`
-              );
-            } else if (!isUsableAccount(selected)) {
-              issues.push(
-                `${platform2}: Account "${selected.username || selected.id}" is ${accountEffectiveStatus(selected)}. Reconnect at socialneuron.com/settings/connections.`
-              );
-            } else if (project_id && selected.project_id && selected.project_id !== project_id) {
-              issues.push(
-                `${platform2}: Account "${selected.username || selected.id}" is bound to project_id ${selected.project_id}, not ${project_id}. Use the selected brand's account or reconnect/assign it in Settings > Integrations.`
-              );
-            }
-            continue;
-          }
-          if (platformAccounts.length === 0) {
-            issues.push(
-              `${platform2}: not connected yet. This is a one-time browser setup on socialneuron.com \u2014 NOT another OAuth in Claude. Call \`start_platform_connection\` with platform="${platform2.toLowerCase()}"${project_id ? ` and project_id="${project_id}"` : ""} to get a deep link, ask the user to open it in their browser and approve on the platform, then call \`wait_for_connection\` before retrying schedule_post.`
-            );
-          } else if (platformAccounts.length > 1) {
-            const accountList = platformAccounts.map((a) => `  - ${formatAccountChoice(a)}`).join("\n");
-            issues.push(
-              `${platform2}: Multiple accounts found. Specify account_id or account_ids to choose:
-${accountList}`
-            );
-          } else if (platformAccounts.length === 1) {
-            const acct = platformAccounts[0];
-            if (acct.expires_at && new Date(acct.expires_at) < /* @__PURE__ */ new Date() && !acct.has_refresh_token) {
-              issues.push(
-                `${platform2}: Account "${acct.username || acct.id}" has expired OAuth and no refresh token. Reconnect at socialneuron.com/settings/connections.`
-              );
-            }
-          }
-        }
-        if (issues.length > 0) {
-          return {
-            content: [
-              {
-                type: "text",
-                text: `Cannot post \u2014 account issues found:
-
-${issues.join("\n\n")}`
-              }
-            ],
-            isError: true
-          };
-        }
-      }
-      let connectedAccountIds;
+      let requestedAccountIds;
       if (account_id) {
-        connectedAccountIds = {};
-        for (const p of normalizedPlatforms) {
-          connectedAccountIds[p] = account_id;
-        }
+        requestedAccountIds = { [normalizedPlatforms[0]]: account_id };
       } else if (account_ids) {
-        connectedAccountIds = {};
-        for (const [key, val] of Object.entries(account_ids)) {
-          const normalizedKey = PLATFORM_CASE_MAP[key.toLowerCase()] || key;
-          connectedAccountIds[normalizedKey] = val;
-        }
+        requestedAccountIds = account_ids;
+      }
+      const routing = await resolveConnectedAccountRouting({
+        projectId: resolvedProjectId,
+        platforms: normalizedPlatforms,
+        requestedAccountIds
+      });
+      if (routing.error || !routing.connectedAccountIds) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Cannot post \u2014 ${routing.error ?? "exact connected-account routing could not be established."}`
+            }
+          ],
+          isError: true
+        };
       }
       let finalCaption = caption;
       if (attribution && finalCaption) {
@@ -4848,8 +5158,9 @@ Created with Social Neuron`;
           title,
           hashtags,
           scheduledAt: schedule_at,
-          projectId: project_id,
-          ...connectedAccountIds ? { connectedAccountIds } : {},
+          projectId: resolvedProjectId,
+          project_id: resolvedProjectId,
+          connectedAccountIds: routing.connectedAccountIds,
           ...normalizedPlatformMetadata ? {
             platformMetadata: convertPlatformMetadata(
               normalizedPlatformMetadata
@@ -4884,10 +5195,14 @@ Created with Social Neuron`;
           isError: true
         };
       }
+      const responseData = projectAutoResolvedNote ? { ...data, project_auto_resolved: projectAutoResolvedNote } : data;
       const lines = [
         data.success ? "Post scheduled successfully." : "Post scheduling had errors.",
         `Scheduled for: ${data.scheduledAt}`
       ];
+      if (projectAutoResolvedNote) {
+        lines.push("", `Note: ${projectAutoResolvedNote}`);
+      }
       if (tiktokAutoInboxApplied) {
         lines.push(
           "",
@@ -4905,7 +5220,7 @@ Created with Social Neuron`;
         }
       }
       if (format === "json") {
-        const structuredContent = asEnvelope3(data);
+        const structuredContent = asEnvelope3(responseData);
         return {
           structuredContent,
           content: [
@@ -4918,7 +5233,7 @@ Created with Social Neuron`;
         };
       }
       return {
-        structuredContent: asEnvelope3(data),
+        structuredContent: asEnvelope3(responseData),
         content: [{ type: "text", text: lines.join("\n") }],
         isError: !data.success
       };
@@ -4932,7 +5247,9 @@ Created with Social Neuron`;
       project_id: z3.string().uuid().optional().describe(
         "Brand/project ID that owns the post. Defaults to the authenticated key's project or the account default."
       ),
-      scheduled_at: z3.string().datetime({ offset: true }).describe("New future publish time as an ISO 8601 datetime with timezone."),
+      scheduled_at: z3.string().datetime({ offset: true }).describe(
+        "New future publish time as an ISO 8601 datetime with timezone."
+      ),
       expected_scheduled_at: z3.string().datetime({ offset: true }).optional().describe(
         "Optional current schedule timestamp. If it changed since you read it, the update is rejected instead of silently overwriting it."
       ),
@@ -4988,7 +5305,11 @@ Created with Social Neuron`;
         projectId: resolvedProjectId,
         project_id: resolvedProjectId,
         scheduled_at: next.toISOString(),
-        ...expected_scheduled_at ? { expected_scheduled_at: new Date(expected_scheduled_at).toISOString() } : {}
+        ...expected_scheduled_at ? {
+          expected_scheduled_at: new Date(
+            expected_scheduled_at
+          ).toISOString()
+        } : {}
       });
       if (error || !result?.success) {
         const code = result?.error ?? error ?? "reschedule_failed";
@@ -5021,17 +5342,34 @@ Created with Social Neuron`;
     "list_connected_accounts",
     "Check which social platforms have active OAuth connections for posting. Call this before schedule_post to verify credentials. Pass project_id to list the accounts for a specific brand/project, then pass the returned account id as account_id/account_ids when posting. If a platform is missing or expired, the user needs to reconnect at socialneuron.com/settings/connections.",
     {
-      project_id: z3.string().optional().describe(
+      project_id: z3.string().uuid().optional().describe(
         "Brand/project ID to scope connected accounts. Use the same project_id when calling schedule_post."
       ),
-      include_all: z3.boolean().optional().describe("If true, include expired or inactive accounts as well as usable accounts."),
+      include_all: z3.boolean().optional().describe(
+        "If true, include expired or inactive accounts as well as usable accounts."
+      ),
       response_format: z3.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
     async ({ project_id, include_all, response_format }) => {
       const format = response_format ?? "text";
+      const projectResolution = await resolveProjectForConnectedAccountTool(project_id);
+      if (!projectResolution.projectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: projectResolution.error ?? "A project_id is required to list connected accounts. Configure an explicit project or use an API key scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolvedProjectId = projectResolution.projectId;
+      const projectAutoResolvedNote = projectResolution.autoResolvedNote;
       const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
         action: "connected-accounts",
-        ...project_id ? { projectId: project_id, project_id } : {},
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId,
         ...include_all ? { includeAll: true } : {}
       });
       if (efError || !result?.success) {
@@ -5045,10 +5383,27 @@ Created with Social Neuron`;
           isError: true
         };
       }
-      const accounts = (result.accounts ?? []).map(publicConnectedAccount).filter((account) => account !== null);
+      const parsedAccounts = (result.accounts ?? []).map(publicConnectedAccount).filter((account) => account !== null);
+      if (parsedAccounts.some(
+        (account) => account.project_id !== resolvedProjectId
+      )) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "Connected-account project attestation failed. No account inventory was returned."
+            }
+          ],
+          isError: true
+        };
+      }
+      const accounts = parsedAccounts;
       if (accounts.length === 0) {
         if (format === "json") {
-          const structuredContent = asEnvelope3({ accounts: [] });
+          const structuredContent = asEnvelope3({
+            accounts: [],
+            ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
+          });
           return {
             structuredContent,
             content: [
@@ -5063,13 +5418,15 @@ Created with Social Neuron`;
           content: [
             {
               type: "text",
-              text: "No connected social media accounts found. Connect platforms in Social Neuron Settings > Connections."
+              text: "No connected social media accounts found. Connect platforms in Social Neuron Settings > Connections." + (projectAutoResolvedNote ? `
+
+Note: ${projectAutoResolvedNote}` : "")
             }
           ]
         };
       }
       const lines = [
-        `${accounts.length} connected account(s)${project_id ? ` for project ${project_id}` : ""}:`,
+        `${accounts.length} connected account(s) for project ${resolvedProjectId}:`,
         ""
       ];
       for (const account of accounts) {
@@ -5081,8 +5438,14 @@ Created with Social Neuron`;
           `  ${platformLower}: ${name} | id=${account.id} | ${project} | status=${status} (connected ${account.created_at.split("T")[0]})`
         );
       }
+      if (projectAutoResolvedNote) {
+        lines.push("", `Note: ${projectAutoResolvedNote}`);
+      }
       if (format === "json") {
-        const structuredContent = asEnvelope3({ accounts });
+        const structuredContent = asEnvelope3({
+          accounts,
+          ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
+        });
         return {
           structuredContent,
           content: [
@@ -5277,7 +5640,10 @@ Created with Social Neuron`;
         if (!Number.isFinite(startDate.getTime())) {
           return {
             content: [
-              { type: "text", text: "start_after must be a valid ISO datetime." }
+              {
+                type: "text",
+                text: "start_after must be a valid ISO datetime."
+              }
             ],
             isError: true
           };
@@ -5378,11 +5744,14 @@ Created with Social Neuron`;
     "Schedule all posts in a content plan. Optionally auto-assigns time slots and runs quality checks before scheduling. Supports dry-run mode.",
     {
       plan: z3.object({
+        project_id: z3.string().uuid().optional(),
+        account_ids: z3.record(z3.string(), z3.string().uuid()).optional().describe("Exact connected-account ID per platform."),
         posts: z3.array(
           z3.object({
             id: z3.string(),
             caption: z3.string(),
             platform: z3.string(),
+            connected_account_id: z3.string().uuid().optional(),
             title: z3.string().optional(),
             media_url: z3.string().optional(),
             schedule_at: z3.string().optional(),
@@ -5390,6 +5759,12 @@ Created with Social Neuron`;
           })
         )
       }).passthrough().optional(),
+      project_id: z3.string().uuid().optional().describe(
+        "Exact brand/project ID. Defaults only when the authenticated user has one project."
+      ),
+      account_ids: z3.record(z3.string(), z3.string().uuid()).optional().describe(
+        "Exact connected-account ID per platform for every post in the plan."
+      ),
       plan_id: z3.string().uuid().optional().describe("Persisted content plan ID from content_plans table"),
       auto_slot: z3.boolean().default(true).describe("Auto-assign time slots for posts without schedule_at"),
       dry_run: z3.boolean().default(false).describe("Preview without actually scheduling"),
@@ -5406,6 +5781,8 @@ Created with Social Neuron`;
     async ({
       plan,
       plan_id,
+      project_id,
+      account_ids,
       auto_slot,
       dry_run,
       response_format,
@@ -5415,9 +5792,11 @@ Created with Social Neuron`;
       idempotency_seed
     }) => {
       try {
+        const effectiveBatchSize = batch_size ?? 4;
         let workingPlan = plan;
         let effectivePlanId = plan_id;
-        let effectiveProjectId;
+        let effectiveProjectId = project_id;
+        let projectAutoResolvedNote;
         let approvalSummary;
         if (!workingPlan && plan_id) {
           const { data: planResult, error: planError } = await callEdgeFunction("mcp-data", { action: "get-content-plan", plan_id });
@@ -5464,7 +5843,18 @@ Created with Social Neuron`;
             posts: postsFromPayload
           };
           effectivePlanId = stored.id;
-          effectiveProjectId = stored.project_id ?? void 0;
+          if (effectiveProjectId && stored.project_id && effectiveProjectId !== stored.project_id) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `project_id ${effectiveProjectId} does not own plan ${plan_id}.`
+                }
+              ],
+              isError: true
+            };
+          }
+          effectiveProjectId = stored.project_id ?? effectiveProjectId;
         }
         if (!workingPlan) {
           return {
@@ -5477,10 +5867,35 @@ Created with Social Neuron`;
             isError: true
           };
         }
+        const planProjectId = workingPlan.project_id;
+        if (effectiveProjectId && typeof planProjectId === "string" && planProjectId.length > 0 && effectiveProjectId !== planProjectId) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Conflicting project_id values were supplied for the plan (${planProjectId}) and request (${effectiveProjectId}).`
+              }
+            ],
+            isError: true
+          };
+        }
+        if (!effectiveProjectId && typeof planProjectId === "string" && planProjectId.length > 0) {
+          effectiveProjectId = planProjectId;
+        }
         if (!effectiveProjectId) {
-          const planProjectId = workingPlan.project_id;
-          if (typeof planProjectId === "string" && planProjectId.length > 0) {
-            effectiveProjectId = planProjectId;
+          const projectResolution = await resolveProjectForConnectedAccountTool();
+          effectiveProjectId = projectResolution.projectId;
+          projectAutoResolvedNote = projectResolution.autoResolvedNote;
+          if (!effectiveProjectId) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: projectResolution.error ?? "A project_id is required to schedule a content plan. Configure an explicit project or use an API key scoped to exactly one project."
+                }
+              ],
+              isError: true
+            };
           }
         }
         if (effectivePlanId) {
@@ -5699,6 +6114,61 @@ Created with Social Neuron`;
             isError: false
           };
         }
+        const embeddedAccountIds = workingPlan.account_ids ?? {};
+        for (const [platform2, accountId] of Object.entries(account_ids ?? {})) {
+          if (embeddedAccountIds[platform2] && embeddedAccountIds[platform2] !== accountId) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `Conflicting account_ids values were supplied for ${platform2}.`
+                }
+              ],
+              isError: true
+            };
+          }
+        }
+        const requestedPlanAccountIds = {
+          ...embeddedAccountIds,
+          ...account_ids ?? {}
+        };
+        for (const post of workingPlan.posts) {
+          if (!post.connected_account_id) continue;
+          const key = post.platform.toLowerCase() === "x" ? "twitter" : post.platform.toLowerCase();
+          const existing = requestedPlanAccountIds[key];
+          if (existing && existing !== post.connected_account_id) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `Plan contains conflicting connected_account_id values for ${post.platform}. Use separate plans when scheduling the same platform through different accounts.`
+                }
+              ],
+              isError: true
+            };
+          }
+          requestedPlanAccountIds[key] = post.connected_account_id;
+        }
+        const planPlatforms = Array.from(
+          new Set(workingPlan.posts.map((post) => post.platform))
+        );
+        const planRouting = await resolveConnectedAccountRouting({
+          projectId: effectiveProjectId,
+          platforms: planPlatforms,
+          requestedAccountIds: requestedPlanAccountIds
+        });
+        if (planRouting.error || !planRouting.connectedAccountIds) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Cannot schedule plan \u2014 ${planRouting.error ?? "exact connected-account routing could not be established."}`
+              }
+            ],
+            isError: true
+          };
+        }
+        const verifiedPlanAccountIds = planRouting.connectedAccountIds;
         let scheduled = 0;
         let failed = 0;
         const results = [];
@@ -5727,7 +6197,7 @@ Created with Social Neuron`;
               retryable: false
             };
           }
-          const normalizedPlatform = PLATFORM_CASE_MAP[post.platform.toLowerCase()] ?? post.platform;
+          const normalizedPlatform = PLATFORM_CASE_MAP2[post.platform.toLowerCase()] ?? post.platform;
           const idempotencyKey = buildIdempotencyKey(post);
           const { data, error } = await callEdgeFunction(
             "schedule-post",
@@ -5738,6 +6208,13 @@ Created with Social Neuron`;
               mediaUrl: post.media_url,
               scheduledAt: post.schedule_at,
               hashtags: post.hashtags,
+              ...effectiveProjectId ? {
+                projectId: effectiveProjectId,
+                project_id: effectiveProjectId
+              } : {},
+              connectedAccountIds: {
+                [normalizedPlatform]: verifiedPlanAccountIds[normalizedPlatform]
+              },
               ...effectivePlanId ? { planId: effectivePlanId } : {},
               idempotencyKey
             },
@@ -5796,7 +6273,7 @@ Created with Social Neuron`;
         const platformBatches = Array.from(grouped.entries()).map(
           async ([platform2, platformPosts]) => {
             const platformResults = [];
-            const batches = chunk(platformPosts, batch_size);
+            const batches = chunk(platformPosts, effectiveBatchSize);
             for (const batch of batches) {
               const settled = await Promise.allSettled(
                 batch.map((post) => scheduleOne(post))
@@ -5857,7 +6334,8 @@ Created with Social Neuron`;
                       total_posts: workingPlan.posts.length,
                       scheduled,
                       failed
-                    }
+                    },
+                    ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
                   }),
                   null,
                   2
@@ -5881,6 +6359,9 @@ Created with Social Neuron`;
         lines.push(
           `Scheduled: ${scheduled}/${workingPlan.posts.length} | Failed: ${failed}/${workingPlan.posts.length}`
         );
+        if (projectAutoResolvedNote) {
+          lines.push("", `Note: ${projectAutoResolvedNote}`);
+        }
         return {
           content: [{ type: "text", text: lines.join("\n") }],
           isError: failed > 0
@@ -5902,6 +6383,7 @@ Created with Social Neuron`;
 }
 
 // src/tools/media.ts
+init_edge_function();
 import { z as z4 } from "zod";
 import { readFile } from "node:fs/promises";
 import { basename, extname } from "node:path";
@@ -6371,6 +6853,7 @@ function registerMediaTools(server) {
 
 // src/tools/analytics.ts
 init_supabase();
+init_edge_function();
 import { z as z5 } from "zod";
 function asEnvelope4(data) {
   return {
@@ -6402,15 +6885,35 @@ function registerAnalyticsTools(server) {
       content_id: z5.string().uuid().optional().describe(
         "Filter to a specific content_history ID to see performance of one piece of content."
       ),
-      project_id: z5.string().optional().describe("Project ID. Defaults to the active project context."),
+      project_id: z5.string().uuid().optional().describe("Project ID. Defaults to the active project context."),
       limit: z5.number().min(1).max(100).optional().describe("Maximum number of posts to return. Defaults to 20."),
       response_format: z5.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ platform: platform2, days, content_id, project_id, limit, response_format }) => {
+    async ({
+      platform: platform2,
+      days,
+      content_id,
+      project_id,
+      limit,
+      response_format
+    }) => {
       const format = response_format ?? "text";
       const lookbackDays = days ?? 30;
       const maxPosts = limit ?? 20;
-      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      const projectResolution = await resolveProjectStrict(project_id);
+      if (!projectResolution.projectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: projectResolution.error ?? "A project_id is required to fetch analytics. Configure an explicit project or use an API key scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolvedProjectId = projectResolution.projectId;
+      const projectAutoResolvedNote = projectResolution.autoResolvedNote;
       const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
         action: "analytics",
         platform: platform2,
@@ -6421,11 +6924,17 @@ function registerAnalyticsTools(server) {
         limit: Math.min(maxPosts * 5, 100),
         latestOnly: true,
         contentId: content_id,
-        ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId
       });
       if (efError) {
         return {
-          content: [{ type: "text", text: `Failed to fetch analytics: ${efError}` }],
+          content: [
+            {
+              type: "text",
+              text: `Failed to fetch analytics: ${efError}`
+            }
+          ],
           isError: true
         };
       }
@@ -6445,7 +6954,8 @@ function registerAnalyticsTools(server) {
             totalViews: 0,
             totalEngagement: 0,
             postCount: 0,
-            posts: []
+            posts: [],
+            ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
           });
           return {
             structuredContent,
@@ -6461,7 +6971,9 @@ function registerAnalyticsTools(server) {
           content: [
             {
               type: "text",
-              text: `No analytics data found for the last ${lookbackDays} days${platform2 ? ` on ${platform2}` : ""}.`
+              text: `No analytics data found for the last ${lookbackDays} days${platform2 ? ` on ${platform2}` : ""}.` + (projectAutoResolvedNote ? `
+
+Note: ${projectAutoResolvedNote}` : "")
             }
           ]
         };
@@ -6493,20 +7005,27 @@ function registerAnalyticsTools(server) {
         postCount: posts.length,
         posts
       };
-      return formatAnalytics(summary, lookbackDays, format);
+      return formatAnalytics(
+        summary,
+        lookbackDays,
+        format,
+        projectAutoResolvedNote
+      );
     }
   );
   server.tool(
     "refresh_platform_analytics",
     "Queue analytics refresh jobs for posts from the last 7 days in one project across its connected platforms. Call this before fetch_analytics if you need fresh data. Returns immediately \u2014 data updates asynchronously over the next 1-5 minutes.",
     {
-      project_id: z5.string().optional().describe("Project ID. Defaults to the active project context."),
+      project_id: z5.string().uuid().optional().describe("Project ID. Defaults to the active project context."),
       response_format: z5.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
     async ({ project_id, response_format }) => {
       const format = response_format ?? "text";
       const userId = await getDefaultUserId();
-      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      const projectResolution = await resolveProjectStrict(project_id);
+      const resolvedProjectId = projectResolution.projectId;
+      const projectAutoResolvedNote = projectResolution.autoResolvedNote;
       const rateLimit = checkRateLimit(
         "posting",
         `refresh_platform_analytics:${userId}:${resolvedProjectId ?? "default"}`
@@ -6522,25 +7041,48 @@ function registerAnalyticsTools(server) {
           isError: true
         };
       }
+      if (!resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: projectResolution.error ?? "A project_id is required to refresh analytics. Configure an explicit project or use an API key scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
       const { data, error } = await callEdgeFunction("fetch-analytics", {
         userId,
-        ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error refreshing analytics: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Error refreshing analytics: ${error}`
+            }
+          ],
           isError: true
         };
       }
       const result = data;
       if (!result.success) {
         return {
-          content: [{ type: "text", text: "Analytics refresh failed." }],
+          content: [
+            { type: "text", text: "Analytics refresh failed." }
+          ],
           isError: true
         };
       }
-      const queued = (result.results ?? []).filter((r) => r.status === "queued").length;
-      const errored = (result.results ?? []).filter((r) => r.status === "error").length;
+      const queued = (result.results ?? []).filter(
+        (r) => r.status === "queued"
+      ).length;
+      const errored = (result.results ?? []).filter(
+        (r) => r.status === "error"
+      ).length;
       const lines = [
         `Analytics refresh triggered successfully.`,
         `  Posts processed: ${result.postsProcessed}`,
@@ -6549,13 +7091,17 @@ function registerAnalyticsTools(server) {
       if (errored > 0) {
         lines.push(`  Errors: ${errored}`);
       }
+      if (projectAutoResolvedNote) {
+        lines.push("", `Note: ${projectAutoResolvedNote}`);
+      }
       if (format === "json") {
         const structuredContent = asEnvelope4({
           success: true,
           postsProcessed: result.postsProcessed,
           queued,
           errored,
-          projectId: resolvedProjectId ?? null
+          projectId: resolvedProjectId ?? null,
+          ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
         });
         return {
           structuredContent,
@@ -6571,12 +7117,21 @@ function registerAnalyticsTools(server) {
     }
   );
 }
-function formatAnalytics(summary, days, format) {
-  const structuredContent = asEnvelope4({ ...summary, days });
+function formatAnalytics(summary, days, format, projectAutoResolvedNote) {
+  const structuredContent = asEnvelope4({
+    ...summary,
+    days,
+    ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
+  });
   if (format === "json") {
     return {
       structuredContent,
-      content: [{ type: "text", text: JSON.stringify(structuredContent, null, 2) }]
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(structuredContent, null, 2)
+        }
+      ]
     };
   }
   const lines = [
@@ -6600,6 +7155,9 @@ function formatAnalytics(summary, days, format) {
       lines.push(line);
     }
   }
+  if (projectAutoResolvedNote) {
+    lines.push("", `Note: ${projectAutoResolvedNote}`);
+  }
   return {
     structuredContent,
     content: [{ type: "text", text: lines.join("\n") }]
@@ -6607,8 +7165,9 @@ function formatAnalytics(summary, days, format) {
 }
 
 // src/tools/brand.ts
-import { z as z6 } from "zod";
+init_edge_function();
 init_supabase();
+import { z as z6 } from "zod";
 
 // src/lib/brandUrlInput.ts
 var PLATFORM_ALIASES = {
@@ -7348,6 +7907,7 @@ import { z as z8 } from "zod";
 import { resolve as resolve2 } from "node:path";
 import { mkdir as mkdir2 } from "node:fs/promises";
 init_supabase();
+init_edge_function();
 var COMPOSITIONS = [
   {
     id: "CaptionedClip",
@@ -7699,8 +8259,9 @@ function registerRemotionTools(server) {
 }
 
 // src/tools/insights.ts
-import { z as z9 } from "zod";
+init_edge_function();
 init_supabase();
+import { z as z9 } from "zod";
 var MAX_INSIGHT_AGE_DAYS = 30;
 var PLATFORM_ENUM = [
   "youtube",
@@ -7956,6 +8517,8 @@ function registerInsightsTools(server) {
 }
 
 // src/tools/youtube-analytics.ts
+init_edge_function();
+init_supabase();
 import { z as z10 } from "zod";
 function asEnvelope7(data) {
   return {
@@ -7977,15 +8540,64 @@ function registerYouTubeAnalyticsTools(server) {
       start_date: z10.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("Start date in YYYY-MM-DD format."),
       end_date: z10.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("End date in YYYY-MM-DD format."),
       video_id: z10.string().optional().describe('YouTube video ID. Required when action is "video".'),
-      max_results: z10.number().min(1).max(50).optional().describe('Max videos to return for "topVideos" action. Defaults to 10.'),
+      max_results: z10.number().min(1).max(50).optional().describe(
+        'Max videos to return for "topVideos" action. Defaults to 10.'
+      ),
+      connected_account_id: z10.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: z10.string().uuid().optional().describe(
+        "Exact brand/project ID. Defaults only when the authenticated user has one project."
+      ),
       response_format: z10.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ action, start_date, end_date, video_id, max_results, response_format }) => {
+    async ({
+      action,
+      start_date,
+      end_date,
+      video_id,
+      max_results,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
       if (action === "video" && !video_id) {
         return {
           content: [
-            { type: "text", text: 'Error: video_id is required when action is "video".' }
+            {
+              type: "text",
+              text: 'Error: video_id is required when action is "video".'
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      if (!resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "project_id is required. Configure an explicit project or use an API key scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
+      const routing = await resolveConnectedAccountRouting({
+        projectId: resolvedProjectId,
+        platforms: ["youtube"],
+        requestedAccountIds: connected_account_id ? { youtube: connected_account_id } : void 0
+      });
+      const resolvedAccountId = routing.connectedAccountIds?.YouTube;
+      if (routing.error || !resolvedAccountId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: routing.error ?? "YouTube: exact connected-account routing could not be established."
+            }
           ],
           isError: true
         };
@@ -7995,11 +8607,19 @@ function registerYouTubeAnalyticsTools(server) {
         startDate: start_date,
         endDate: end_date,
         videoId: video_id,
-        maxResults: max_results ?? 10
+        maxResults: max_results ?? 10,
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId,
+        connectedAccountId: resolvedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `YouTube Analytics error: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `YouTube Analytics error: ${error}`
+            }
+          ],
           isError: true
         };
       }
@@ -8012,7 +8632,12 @@ function registerYouTubeAnalyticsTools(server) {
               {
                 type: "text",
                 text: JSON.stringify(
-                  asEnvelope7({ action, startDate: start_date, endDate: end_date, analytics: a }),
+                  asEnvelope7({
+                    action,
+                    startDate: start_date,
+                    endDate: end_date,
+                    analytics: a
+                  }),
                   null,
                   2
                 )
@@ -8039,7 +8664,10 @@ function registerYouTubeAnalyticsTools(server) {
         if (days.length === 0) {
           return {
             content: [
-              { type: "text", text: "No daily analytics data found for this period." }
+              {
+                type: "text",
+                text: "No daily analytics data found for this period."
+              }
             ]
           };
         }
@@ -8062,7 +8690,10 @@ function registerYouTubeAnalyticsTools(server) {
             ]
           };
         }
-        const lines = [`YouTube Daily Analytics (${start_date} to ${end_date}):`, ""];
+        const lines = [
+          `YouTube Daily Analytics (${start_date} to ${end_date}):`,
+          ""
+        ];
         for (const d of days) {
           lines.push(
             `  ${d.date}: ${d.views.toLocaleString()} views, ${d.watchTimeMinutes.toLocaleString()} min watch, +${d.subscribersGained} subs, ${d.likes} likes, ${d.comments} comments`
@@ -8109,7 +8740,12 @@ function registerYouTubeAnalyticsTools(server) {
         const videos = result.topVideos ?? [];
         if (videos.length === 0) {
           return {
-            content: [{ type: "text", text: "No top videos found for this period." }]
+            content: [
+              {
+                type: "text",
+                text: "No top videos found for this period."
+              }
+            ]
           };
         }
         if (format === "json") {
@@ -8131,7 +8767,10 @@ function registerYouTubeAnalyticsTools(server) {
             ]
           };
         }
-        const lines = [`Top ${videos.length} YouTube Videos (${start_date} to ${end_date}):`, ""];
+        const lines = [
+          `Top ${videos.length} YouTube Videos (${start_date} to ${end_date}):`,
+          ""
+        ];
         for (let i = 0; i < videos.length; i++) {
           const v = videos[i];
           lines.push(
@@ -8144,17 +8783,25 @@ function registerYouTubeAnalyticsTools(server) {
       }
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope7(result), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope7(result), null, 2)
+            }
+          ]
         };
       }
       return {
-        content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        content: [
+          { type: "text", text: JSON.stringify(result, null, 2) }
+        ]
       };
     }
   );
 }
 
 // src/tools/comments.ts
+init_edge_function();
 import { z as z11 } from "zod";
 init_supabase();
 function asEnvelope8(data) {
@@ -8166,6 +8813,32 @@ function asEnvelope8(data) {
     data
   };
 }
+async function exactYouTubeRoute(projectId, connectedAccountId) {
+  const resolvedProjectId = projectId ?? await getDefaultProjectId() ?? void 0;
+  if (!resolvedProjectId) {
+    return {
+      error: "project_id is required. Configure an explicit project or use an API key scoped to exactly one project."
+    };
+  }
+  const routing = await resolveConnectedAccountRouting({
+    projectId: resolvedProjectId,
+    platforms: ["youtube"],
+    requestedAccountIds: connectedAccountId ? { youtube: connectedAccountId } : void 0
+  });
+  const resolvedAccountId = routing.connectedAccountIds?.YouTube;
+  if (routing.error || !resolvedAccountId) {
+    return {
+      error: routing.error ?? "YouTube: exact connected-account routing could not be established."
+    };
+  }
+  return {
+    projectId: resolvedProjectId,
+    connectedAccountId: resolvedAccountId
+  };
+}
+var PROJECT_ID_SCHEMA = z11.string().uuid().optional().describe(
+  "Exact brand/project ID. Defaults only when the authenticated user has one project."
+);
 function registerCommentsTools(server) {
   server.tool(
     "list_comments",
@@ -8178,19 +8851,42 @@ function registerCommentsTools(server) {
       page_token: z11.string().optional().describe(
         "Pagination cursor from previous list_comments response nextPageToken field. Omit for first page of results."
       ),
+      connected_account_id: z11.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: PROJECT_ID_SCHEMA,
       response_format: z11.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ video_id, max_results, page_token, response_format }) => {
+    async ({
+      video_id,
+      max_results,
+      page_token,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
+      const route = await exactYouTubeRoute(project_id, connected_account_id);
+      if ("error" in route) {
+        return {
+          content: [{ type: "text", text: route.error }],
+          isError: true
+        };
+      }
       const { data, error } = await callEdgeFunction("youtube-comments", {
         action: "list",
         videoId: video_id,
         maxResults: max_results ?? 50,
-        pageToken: page_token
+        pageToken: page_token,
+        projectId: route.projectId,
+        project_id: route.projectId,
+        connectedAccountId: route.connectedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error listing comments: ${error}` }],
+          content: [
+            { type: "text", text: `Error listing comments: ${error}` }
+          ],
           isError: true
         };
       }
@@ -8202,7 +8898,10 @@ function registerCommentsTools(server) {
             {
               type: "text",
               text: JSON.stringify(
-                asEnvelope8({ comments, nextPageToken: result.nextPageToken ?? null }),
+                asEnvelope8({
+                  comments,
+                  nextPageToken: result.nextPageToken ?? null
+                }),
                 null,
                 2
               )
@@ -8239,12 +8938,31 @@ function registerCommentsTools(server) {
     "reply_to_comment",
     "Reply to a YouTube comment. Get the parent_id from list_comments results. Reply appears as the authenticated channel. Use for community engagement after checking list_comments for questions or feedback.",
     {
-      parent_id: z11.string().describe("The ID of the parent comment to reply to (from list_comments)."),
+      parent_id: z11.string().describe(
+        "The ID of the parent comment to reply to (from list_comments)."
+      ),
       text: z11.string().min(1).describe("The reply text."),
+      connected_account_id: z11.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: PROJECT_ID_SCHEMA,
       response_format: z11.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ parent_id, text, response_format }) => {
+    async ({
+      parent_id,
+      text,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
+      const route = await exactYouTubeRoute(project_id, connected_account_id);
+      if ("error" in route) {
+        return {
+          content: [{ type: "text", text: route.error }],
+          isError: true
+        };
+      }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("posting", `reply_to_comment:${userId}`);
       if (!rateLimit.allowed) {
@@ -8261,18 +8979,31 @@ function registerCommentsTools(server) {
       const { data, error } = await callEdgeFunction("youtube-comments", {
         action: "reply",
         parentId: parent_id,
-        text
+        text,
+        projectId: route.projectId,
+        project_id: route.projectId,
+        connectedAccountId: route.connectedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error replying to comment: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Error replying to comment: ${error}`
+            }
+          ],
           isError: true
         };
       }
       const result = data;
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope8(result), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope8(result), null, 2)
+            }
+          ]
         };
       }
       return {
@@ -8293,10 +9024,27 @@ function registerCommentsTools(server) {
     {
       video_id: z11.string().describe("The YouTube video ID to comment on."),
       text: z11.string().min(1).describe("The comment text."),
+      connected_account_id: z11.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: PROJECT_ID_SCHEMA,
       response_format: z11.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ video_id, text, response_format }) => {
+    async ({
+      video_id,
+      text,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
+      const route = await exactYouTubeRoute(project_id, connected_account_id);
+      if ("error" in route) {
+        return {
+          content: [{ type: "text", text: route.error }],
+          isError: true
+        };
+      }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("posting", `post_comment:${userId}`);
       if (!rateLimit.allowed) {
@@ -8313,18 +9061,28 @@ function registerCommentsTools(server) {
       const { data, error } = await callEdgeFunction("youtube-comments", {
         action: "post",
         videoId: video_id,
-        text
+        text,
+        projectId: route.projectId,
+        project_id: route.projectId,
+        connectedAccountId: route.connectedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error posting comment: ${error}` }],
+          content: [
+            { type: "text", text: `Error posting comment: ${error}` }
+          ],
           isError: true
         };
       }
       const result = data;
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope8(result), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope8(result), null, 2)
+            }
+          ]
         };
       }
       return {
@@ -8345,10 +9103,27 @@ function registerCommentsTools(server) {
     {
       comment_id: z11.string().describe("The comment ID to moderate."),
       moderation_status: z11.enum(["published", "rejected"]).describe('"published" to approve, "rejected" to hide.'),
+      connected_account_id: z11.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: PROJECT_ID_SCHEMA,
       response_format: z11.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ comment_id, moderation_status, response_format }) => {
+    async ({
+      comment_id,
+      moderation_status,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
+      const route = await exactYouTubeRoute(project_id, connected_account_id);
+      if ("error" in route) {
+        return {
+          content: [{ type: "text", text: route.error }],
+          isError: true
+        };
+      }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("posting", `moderate_comment:${userId}`);
       if (!rateLimit.allowed) {
@@ -8365,11 +9140,19 @@ function registerCommentsTools(server) {
       const { error } = await callEdgeFunction("youtube-comments", {
         action: "moderate",
         commentId: comment_id,
-        moderationStatus: moderation_status
+        moderationStatus: moderation_status,
+        projectId: route.projectId,
+        project_id: route.projectId,
+        connectedAccountId: route.connectedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error moderating comment: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Error moderating comment: ${error}`
+            }
+          ],
           isError: true
         };
       }
@@ -8406,10 +9189,26 @@ function registerCommentsTools(server) {
     "Delete a YouTube comment. Only works for comments owned by the authenticated channel.",
     {
       comment_id: z11.string().describe("The comment ID to delete."),
+      connected_account_id: z11.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: PROJECT_ID_SCHEMA,
       response_format: z11.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ comment_id, response_format }) => {
+    async ({
+      comment_id,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
+      const route = await exactYouTubeRoute(project_id, connected_account_id);
+      if ("error" in route) {
+        return {
+          content: [{ type: "text", text: route.error }],
+          isError: true
+        };
+      }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("posting", `delete_comment:${userId}`);
       if (!rateLimit.allowed) {
@@ -8425,11 +9224,16 @@ function registerCommentsTools(server) {
       }
       const { error } = await callEdgeFunction("youtube-comments", {
         action: "delete",
-        commentId: comment_id
+        commentId: comment_id,
+        projectId: route.projectId,
+        project_id: route.projectId,
+        connectedAccountId: route.connectedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error deleting comment: ${error}` }],
+          content: [
+            { type: "text", text: `Error deleting comment: ${error}` }
+          ],
           isError: true
         };
       }
@@ -8438,13 +9242,22 @@ function registerCommentsTools(server) {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope8({ success: true, commentId: comment_id }), null, 2)
+              text: JSON.stringify(
+                asEnvelope8({ success: true, commentId: comment_id }),
+                null,
+                2
+              )
             }
           ]
         };
       }
       return {
-        content: [{ type: "text", text: `Comment ${comment_id} deleted successfully.` }]
+        content: [
+          {
+            type: "text",
+            text: `Comment ${comment_id} deleted successfully.`
+          }
+        ]
       };
     }
   );
@@ -8452,6 +9265,7 @@ function registerCommentsTools(server) {
 
 // src/tools/ideation-context.ts
 init_supabase();
+init_edge_function();
 import { z as z12 } from "zod";
 function asEnvelope9(data) {
   return {
@@ -8524,6 +9338,7 @@ function registerIdeationContextTools(server) {
 }
 
 // src/tools/credits.ts
+init_edge_function();
 import { z as z13 } from "zod";
 function asEnvelope10(data) {
   return {
@@ -8619,6 +9434,7 @@ Assets remaining: ${payload.remainingAssets ?? "unlimited"}`
 
 // src/tools/loop-summary.ts
 init_supabase();
+init_edge_function();
 import { z as z14 } from "zod";
 function asEnvelope11(data) {
   return {
@@ -8692,6 +9508,7 @@ Next Action: ${payload.recommendedNextAction}`
 }
 
 // src/tools/usage.ts
+init_edge_function();
 import { z as z15 } from "zod";
 function asEnvelope12(data) {
   return {
@@ -8764,6 +9581,7 @@ ${"=".repeat(40)}
 }
 
 // src/tools/autopilot.ts
+init_edge_function();
 import { z as z16 } from "zod";
 function asEnvelope13(data) {
   return {
@@ -9062,6 +9880,7 @@ Active: ${is_active}`
 }
 
 // src/tools/recipes.ts
+init_edge_function();
 import { z as z17 } from "zod";
 function asEnvelope14(data) {
   return {
@@ -9331,6 +10150,7 @@ ${JSON.stringify(run.outputs, null, 2)}
 import { z as z18 } from "zod";
 
 // src/lib/urlExtraction.ts
+init_edge_function();
 function classifyYouTubeUrl(url) {
   if (/youtube\.com\/watch|youtu\.be\//.test(url)) return "video";
   if (/youtube\.com\/@/.test(url)) return "channel";
@@ -10194,6 +11014,7 @@ function registerVisualQualityTools(server) {
 }
 
 // src/tools/planning.ts
+init_edge_function();
 import { z as z21 } from "zod";
 import { randomUUID as randomUUID2 } from "node:crypto";
 init_supabase();
@@ -10835,8 +11656,9 @@ ${rawText.slice(0, 1e3)}`
 }
 
 // src/tools/plan-approvals.ts
-import { z as z22 } from "zod";
+init_edge_function();
 init_supabase();
+import { z as z22 } from "zod";
 function asEnvelope19(data) {
   return {
     _meta: {
@@ -11332,11 +12154,15 @@ function registerDiscoveryTools(server) {
 }
 
 // src/tools/pipeline.ts
+init_edge_function();
 import { z as z24 } from "zod";
 import { randomUUID as randomUUID3 } from "node:crypto";
 init_supabase();
 function asEnvelope20(data) {
-  return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
+  return {
+    _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+    data
+  };
 }
 var PLATFORM_ENUM2 = z24.enum([
   "youtube",
@@ -11372,7 +12198,10 @@ function registerPipelineTools(server) {
             action: "pipeline-readiness",
             platforms,
             estimated_posts,
-            ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+            ...resolvedProjectId ? {
+              projectId: resolvedProjectId,
+              project_id: resolvedProjectId
+            } : {}
           },
           { timeoutMs: 15e3 }
         );
@@ -11390,16 +12219,24 @@ function registerPipelineTools(server) {
         const blockers = [];
         const warnings = [];
         if (!isUnlimited && credits < estimatedCost) {
-          blockers.push(`Insufficient credits: ${credits} available, ~${estimatedCost} needed`);
+          blockers.push(
+            `Insufficient credits: ${credits} available, ~${estimatedCost} needed`
+          );
         }
         if (missingPlatforms.length > 0) {
-          blockers.push(`Missing connected accounts: ${missingPlatforms.join(", ")}`);
+          blockers.push(
+            `Missing connected accounts: ${missingPlatforms.join(", ")}`
+          );
         }
         if (!hasBrand) {
-          warnings.push("No brand profile found. Content will use generic voice.");
+          warnings.push(
+            "No brand profile found. Content will use generic voice."
+          );
         }
         if (pendingApprovals > 0) {
-          warnings.push(`${pendingApprovals} pending approval(s) from previous runs.`);
+          warnings.push(
+            `${pendingApprovals} pending approval(s) from previous runs.`
+          );
         }
         if (!insightsFresh) {
           warnings.push(
@@ -11414,7 +12251,10 @@ function registerPipelineTools(server) {
               estimated_cost: estimatedCost,
               sufficient: credits >= estimatedCost
             },
-            connected_accounts: { platforms: connectedPlatforms, missing: missingPlatforms },
+            connected_accounts: {
+              platforms: connectedPlatforms,
+              missing: missingPlatforms
+            },
             brand_profile: { exists: hasBrand },
             pending_approvals: { count: pendingApprovals },
             insights_available: {
@@ -11428,11 +12268,18 @@ function registerPipelineTools(server) {
         };
         if (format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope20(result), null, 2) }]
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(asEnvelope20(result), null, 2)
+              }
+            ]
           };
         }
         const lines = [];
-        lines.push(`Pipeline Readiness: ${result.ready ? "READY" : "NOT READY"}`);
+        lines.push(
+          `Pipeline Readiness: ${result.ready ? "READY" : "NOT READY"}`
+        );
         lines.push("=".repeat(40));
         lines.push(
           `Credits: ${credits} available, ~${estimatedCost} needed \u2014 ${credits >= estimatedCost ? "OK" : "BLOCKED"}`
@@ -11440,7 +12287,9 @@ function registerPipelineTools(server) {
         lines.push(
           `Accounts: ${connectedPlatforms.length} connected${missingPlatforms.length > 0 ? ` (missing: ${missingPlatforms.join(", ")})` : " \u2014 OK"}`
         );
-        lines.push(`Brand: ${hasBrand ? "OK" : "Missing (will use generic voice)"}`);
+        lines.push(
+          `Brand: ${hasBrand ? "OK" : "Missing (will use generic voice)"}`
+        );
         lines.push(`Pending Approvals: ${pendingApprovals}`);
         lines.push(
           `Insights: ${insightsFresh ? "Fresh" : insightAge === null ? "None available" : `${insightAge} days old`}`
@@ -11459,7 +12308,12 @@ function registerPipelineTools(server) {
       } catch (err) {
         const message = sanitizeError(err);
         return {
-          content: [{ type: "text", text: `Readiness check failed: ${message}` }],
+          content: [
+            {
+              type: "text",
+              text: `Readiness check failed: ${message}`
+            }
+          ],
           isError: true
         };
       }
@@ -11473,6 +12327,9 @@ function registerPipelineTools(server) {
       topic: z24.string().optional().describe("Content topic (required if no source_url)"),
       source_url: z24.string().optional().describe("URL to extract content from"),
       platforms: z24.array(PLATFORM_ENUM2).min(1).describe("Target platforms"),
+      account_ids: z24.record(z24.string(), z24.string().uuid()).optional().describe(
+        "Exact connected-account ID per target platform. Required when a project has multiple accounts on one platform."
+      ),
       days: z24.number().min(1).max(7).default(5).describe("Days to plan"),
       posts_per_day: z24.number().min(1).max(3).default(1).describe("Posts per platform per day"),
       approval_mode: z24.enum(["auto", "review_all", "review_low_confidence"]).default("review_low_confidence").describe(
@@ -11494,6 +12351,7 @@ function registerPipelineTools(server) {
       topic,
       source_url,
       platforms,
+      account_ids,
       days,
       posts_per_day,
       approval_mode,
@@ -11511,7 +12369,12 @@ function registerPipelineTools(server) {
       let creditsUsed = 0;
       if (!topic && !source_url) {
         return {
-          content: [{ type: "text", text: "Either topic or source_url is required." }],
+          content: [
+            {
+              type: "text",
+              text: "Either topic or source_url is required."
+            }
+          ],
           isError: true
         };
       }
@@ -11541,6 +12404,35 @@ function registerPipelineTools(server) {
       }
       try {
         const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+        if (schedulingRequested && !resolvedProjectId) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: "A project_id is required to schedule pipeline output. Configure an explicit project or use an API key scoped to exactly one project."
+              }
+            ],
+            isError: true
+          };
+        }
+        if (schedulingRequested) {
+          const preflightRouting = await resolveConnectedAccountRouting({
+            projectId: resolvedProjectId,
+            platforms,
+            requestedAccountIds: account_ids
+          });
+          if (preflightRouting.error || !preflightRouting.connectedAccountIds) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `Cannot run publishing pipeline \u2014 ${preflightRouting.error ?? "exact connected-account routing could not be established."} (checked before any credits were spent.)`
+                }
+              ],
+              isError: true
+            };
+          }
+        }
         const estimatedCost = BASE_PLAN_CREDITS + (source_url ? SOURCE_EXTRACTION_CREDITS : 0);
         const { data: budgetData } = await callEdgeFunction(
           "mcp-data",
@@ -11594,7 +12486,13 @@ function registerPipelineTools(server) {
           "social-neuron-ai",
           {
             type: "generation",
-            prompt: buildPlanPrompt(resolvedTopic, platforms, days, posts_per_day, source_url),
+            prompt: buildPlanPrompt(
+              resolvedTopic,
+              platforms,
+              days,
+              posts_per_day,
+              source_url
+            ),
             model: "gemini-2.5-flash",
             responseFormat: "json",
             ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
@@ -11602,7 +12500,10 @@ function registerPipelineTools(server) {
           { timeoutMs: 6e4 }
         );
         if (planError || !planData) {
-          errors.push({ stage: "planning", message: planError ?? "No AI response" });
+          errors.push({
+            stage: "planning",
+            message: planError ?? "No AI response"
+          });
           await callEdgeFunction(
             "mcp-data",
             {
@@ -11619,7 +12520,10 @@ function registerPipelineTools(server) {
           );
           return {
             content: [
-              { type: "text", text: `Planning failed: ${planError ?? "No AI response"}` }
+              {
+                type: "text",
+                text: `Planning failed: ${planError ?? "No AI response"}`
+              }
             ],
             isError: true
           };
@@ -11649,20 +12553,22 @@ function registerPipelineTools(server) {
         const postsArray = extractJsonArray(rawText);
         const requestedPlatformSet = new Set(platforms);
         const maxPosts = platforms.length * days * posts_per_day;
-        const parsedPosts = (postsArray ?? []).map((p) => ({
-          id: String(p.id ?? randomUUID3().slice(0, 8)),
-          day: Number(p.day ?? 1),
-          date: String(p.date ?? ""),
-          platform: String(p.platform ?? ""),
-          content_type: p.content_type ?? "caption",
-          caption: String(p.caption ?? ""),
-          title: p.title ? String(p.title) : void 0,
-          hashtags: Array.isArray(p.hashtags) ? p.hashtags.map(String) : void 0,
-          hook: String(p.hook ?? ""),
-          angle: String(p.angle ?? ""),
-          visual_direction: p.visual_direction ? String(p.visual_direction) : void 0,
-          media_type: p.media_type ? String(p.media_type) : void 0
-        }));
+        const parsedPosts = (postsArray ?? []).map(
+          (p) => ({
+            id: String(p.id ?? randomUUID3().slice(0, 8)),
+            day: Number(p.day ?? 1),
+            date: String(p.date ?? ""),
+            platform: String(p.platform ?? ""),
+            content_type: p.content_type ?? "caption",
+            caption: String(p.caption ?? ""),
+            title: p.title ? String(p.title) : void 0,
+            hashtags: Array.isArray(p.hashtags) ? p.hashtags.map(String) : void 0,
+            hook: String(p.hook ?? ""),
+            angle: String(p.angle ?? ""),
+            visual_direction: p.visual_direction ? String(p.visual_direction) : void 0,
+            media_type: p.media_type ? String(p.media_type) : void 0
+          })
+        );
         const platformFilteredPosts = parsedPosts.filter(
           (post) => requestedPlatformSet.has(post.platform)
         );
@@ -11745,7 +12651,10 @@ function registerPipelineTools(server) {
                 estimated_credits: estimatedCost,
                 generated_at: (/* @__PURE__ */ new Date()).toISOString()
               },
-              ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+              ...resolvedProjectId ? {
+                projectId: resolvedProjectId,
+                project_id: resolvedProjectId
+              } : {}
             },
             { timeoutMs: 1e4 }
           );
@@ -11798,6 +12707,22 @@ function registerPipelineTools(server) {
           }
         }
         let postsScheduled = 0;
+        const pipelineRouting = schedulingRequested && postsApproved > 0 ? await resolveConnectedAccountRouting({
+          projectId: resolvedProjectId,
+          platforms,
+          requestedAccountIds: account_ids
+        }) : void 0;
+        if (pipelineRouting?.error || schedulingRequested && postsApproved > 0 && !pipelineRouting?.connectedAccountIds) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Cannot run publishing pipeline \u2014 ${pipelineRouting?.error ?? "exact connected-account routing could not be established."}`
+              }
+            ],
+            isError: true
+          };
+        }
         if (!dry_run && !skipSet.has("schedule") && postsApproved > 0) {
           const approvedPosts = posts.filter((p) => p.status === "approved");
           const scheduleBase = /* @__PURE__ */ new Date();
@@ -11805,10 +12730,27 @@ function registerPipelineTools(server) {
           const scheduleBaseMs = scheduleBase.getTime();
           for (const post of approvedPosts) {
             if (creditsUsed >= creditLimit) {
-              errors.push({ stage: "schedule", message: "Credit limit reached" });
+              errors.push({
+                stage: "schedule",
+                message: "Credit limit reached"
+              });
               break;
             }
-            const scheduledAt = post.schedule_at ?? new Date(scheduleBaseMs + (Math.max(1, post.day) - 1) * 864e5).toISOString();
+            const scheduledAt = post.schedule_at ?? new Date(
+              scheduleBaseMs + (Math.max(1, post.day) - 1) * 864e5
+            ).toISOString();
+            const route = Object.entries(
+              pipelineRouting.connectedAccountIds
+            ).find(
+              ([platform2]) => platform2.toLowerCase() === post.platform.toLowerCase()
+            );
+            if (!route) {
+              errors.push({
+                stage: "schedule",
+                message: `No verified connected account route for ${post.platform}`
+              });
+              continue;
+            }
             try {
               const { error: schedError } = await callEdgeFunction(
                 "schedule-post",
@@ -11821,7 +12763,11 @@ function registerPipelineTools(server) {
                   scheduledAt,
                   planId,
                   idempotencyKey: `pipeline-${planId}-${post.id}`,
-                  ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+                  ...resolvedProjectId ? {
+                    projectId: resolvedProjectId,
+                    project_id: resolvedProjectId
+                  } : {},
+                  connectedAccountIds: { [route[0]]: route[1] }
                 },
                 { timeoutMs: 15e3 }
               );
@@ -11887,12 +12833,17 @@ function registerPipelineTools(server) {
         if (response_format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope20(resultPayload), null, 2) }
+              {
+                type: "text",
+                text: JSON.stringify(asEnvelope20(resultPayload), null, 2)
+              }
             ]
           };
         }
         const lines = [];
-        lines.push(`Pipeline ${pipelineId.slice(0, 8)}... ${finalStatus.toUpperCase()}`);
+        lines.push(
+          `Pipeline ${pipelineId.slice(0, 8)}... ${finalStatus.toUpperCase()}`
+        );
         lines.push("=".repeat(40));
         lines.push(`Posts generated: ${posts.length}`);
         lines.push(`Posts approved: ${postsApproved}`);
@@ -11931,7 +12882,9 @@ function registerPipelineTools(server) {
         } catch {
         }
         return {
-          content: [{ type: "text", text: `Pipeline failed: ${message}` }],
+          content: [
+            { type: "text", text: `Pipeline failed: ${message}` }
+          ],
           isError: true
         };
       }
@@ -11968,7 +12921,12 @@ function registerPipelineTools(server) {
       }
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope20(data), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope20(data), null, 2)
+            }
+          ]
         };
       }
       const lines = [];
@@ -12008,10 +12966,19 @@ function registerPipelineTools(server) {
     },
     async ({ plan_id, quality_threshold, response_format }) => {
       try {
-        const { data: loadResult, error: loadError } = await callEdgeFunction("mcp-data", { action: "auto-approve-plan", plan_id }, { timeoutMs: 1e4 });
+        const { data: loadResult, error: loadError } = await callEdgeFunction(
+          "mcp-data",
+          { action: "auto-approve-plan", plan_id },
+          { timeoutMs: 1e4 }
+        );
         if (loadError) {
           return {
-            content: [{ type: "text", text: `Failed to load plan: ${loadError}` }],
+            content: [
+              {
+                type: "text",
+                text: `Failed to load plan: ${loadError}`
+              }
+            ],
             isError: true
           };
         }
@@ -12019,7 +12986,10 @@ function registerPipelineTools(server) {
         if (!stored?.plan_payload) {
           return {
             content: [
-              { type: "text", text: `No content plan found for plan_id=${plan_id}` }
+              {
+                type: "text",
+                text: `No content plan found for plan_id=${plan_id}`
+              }
             ],
             isError: true
           };
@@ -12046,7 +13016,11 @@ function registerPipelineTools(server) {
               blockers: []
             };
             autoApproved++;
-            details.push({ post_id: post.id, action: "approved", score: quality.total });
+            details.push({
+              post_id: post.id,
+              action: "approved",
+              score: quality.total
+            });
           } else if (quality.total >= quality_threshold - 5) {
             post.status = "needs_edit";
             post.quality = {
@@ -12056,7 +13030,11 @@ function registerPipelineTools(server) {
               blockers: quality.blockers
             };
             flagged++;
-            details.push({ post_id: post.id, action: "flagged", score: quality.total });
+            details.push({
+              post_id: post.id,
+              action: "flagged",
+              score: quality.total
+            });
           } else {
             post.status = "rejected";
             post.quality = {
@@ -12066,7 +13044,11 @@ function registerPipelineTools(server) {
               blockers: quality.blockers
             };
             rejected++;
-            details.push({ post_id: post.id, action: "rejected", score: quality.total });
+            details.push({
+              post_id: post.id,
+              action: "rejected",
+              score: quality.total
+            });
           }
         }
         const newStatus = flagged === 0 && rejected === 0 ? "approved" : "in_review";
@@ -12102,7 +13084,10 @@ function registerPipelineTools(server) {
         if (response_format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope20(resultPayload), null, 2) }
+              {
+                type: "text",
+                text: JSON.stringify(asEnvelope20(resultPayload), null, 2)
+              }
             ]
           };
         }
@@ -12123,7 +13108,9 @@ function registerPipelineTools(server) {
       } catch (err) {
         const message = sanitizeError(err);
         return {
-          content: [{ type: "text", text: `Auto-approve failed: ${message}` }],
+          content: [
+            { type: "text", text: `Auto-approve failed: ${message}` }
+          ],
           isError: true
         };
       }
@@ -12149,6 +13136,7 @@ function buildPlanPrompt(topic, platforms, days, postsPerDay, sourceUrl) {
 }
 
 // src/tools/suggest.ts
+init_edge_function();
 import { z as z25 } from "zod";
 function asEnvelope21(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
@@ -12290,6 +13278,7 @@ ${i + 1}. ${s.topic}`);
 }
 
 // src/tools/digest.ts
+init_edge_function();
 import { z as z26 } from "zod";
 
 // src/lib/anomaly-detector.ts
@@ -12695,8 +13684,9 @@ Best: ${best.id.slice(0, 8)}... (${best.platform}) \u2014 ${best.views.toLocaleS
 }
 
 // src/tools/brandRuntime.ts
-import { z as z27 } from "zod";
+init_edge_function();
 init_supabase();
+import { z as z27 } from "zod";
 
 // src/lib/brandScoring.ts
 var WEIGHTS = {
@@ -13553,6 +14543,7 @@ function registerBrandRuntimeTools(server) {
 }
 
 // src/tools/carousel.ts
+init_edge_function();
 import { z as z28 } from "zod";
 init_supabase();
 var IMAGE_CREDIT_ESTIMATES2 = {
@@ -13909,6 +14900,7 @@ function registerCarouselTools(server) {
 }
 
 // src/tools/niche-research.ts
+init_edge_function();
 import { z as z29 } from "zod";
 function asEnvelope24(data) {
   return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
@@ -13995,6 +14987,7 @@ function registerNicheResearchTools(server) {
 // src/tools/hyperframes.ts
 import { z as z30 } from "zod";
 init_supabase();
+init_edge_function();
 var HYPERFRAMES_BLOCKS = [
   // Transitions
   {
@@ -14249,6 +15242,9 @@ function registerHyperframesTools(server) {
 }
 
 // src/apps/content-calendar.ts
+init_edge_function();
+init_request_context();
+init_supabase();
 import {
   registerAppTool,
   registerAppResource,
@@ -14258,8 +15254,6 @@ import { z as z31 } from "zod";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-init_request_context();
-init_supabase();
 var CALENDAR_URI = "ui://content-calendar/v1/mcp-app.html";
 var CALENDAR_CSP = {
   // The HTML is fully self-contained. Tool calls travel over the host bridge,
@@ -14470,6 +15464,8 @@ function registerContentCalendarApp(server) {
 }
 
 // src/apps/analytics-pulse.ts
+init_edge_function();
+init_supabase();
 import {
   registerAppResource as registerAppResource2,
   registerAppTool as registerAppTool2,
@@ -14479,7 +15475,6 @@ import { z as z32 } from "zod";
 import fs2 from "node:fs/promises";
 import path2 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-init_supabase();
 var ANALYTICS_URI = "ui://analytics-pulse/v1/mcp-app.html";
 var ANALYTICS_CSP = {
   connectDomains: [],
@@ -14712,6 +15707,7 @@ function registerAnalyticsPulseApp(server) {
 }
 
 // src/tools/connections.ts
+init_edge_function();
 import { z as z33 } from "zod";
 init_supabase();
 var PLATFORM_ENUM4 = [
@@ -14726,12 +15722,12 @@ var PLATFORM_ENUM4 = [
   "shopify",
   "etsy"
 ];
-function findActiveAccount(accounts, platform2) {
+function findActiveAccounts(accounts, platform2, projectId) {
   const target = platform2.toLowerCase();
-  return accounts.find((a) => {
+  return accounts.filter((a) => {
     const effectiveStatus = a.effective_status || a.status;
-    return a.platform.toLowerCase() === target && (effectiveStatus === "active" || effectiveStatus === "expires_soon");
-  }) ?? null;
+    return a.platform.toLowerCase() === target && a.project_id === projectId && (effectiveStatus === "active" || effectiveStatus === "expires_soon");
+  });
 }
 var MAX_CONCURRENT_WAITS_PER_USER = 3;
 var inFlightWaitsByUser = /* @__PURE__ */ new Map();
@@ -14740,16 +15736,21 @@ function registerConnectionTools(server) {
     "start_platform_connection",
     "Begin connecting a social platform (Instagram, TikTok, YouTube, etc.). Returns a single-use deep link the user opens in a browser to complete the one-time OAuth handshake on socialneuron.com. This is NOT another OAuth in Claude \u2014 platform connections require a browser session because the social platforms (Meta, Google, TikTok) only accept callbacks on socialneuron.com. After the user clicks the link and approves on the platform, call `wait_for_connection` to detect completion. Link expires in 2 minutes; mint a new one if needed. Use `list_connected_accounts` first to check whether the platform is already connected before calling this.",
     {
-      platform: z33.enum(PLATFORM_ENUM4).describe("Platform to connect. Lower-case: instagram, tiktok, youtube, etc."),
-      project_id: z33.string().optional().describe(
-        "Brand/project ID to bind the new social account to. Use this when connecting a brand-specific account."
+      platform: z33.enum(PLATFORM_ENUM4).describe(
+        "Platform to connect. Lower-case: instagram, tiktok, youtube, etc."
+      ),
+      project_id: z33.string().uuid().optional().describe(
+        "Brand/project ID to bind the new social account to. Required when the account has multiple brands."
       ),
       response_format: z33.enum(["text", "json"]).optional().describe("Response format. Default: text.")
     },
     async ({ platform: platform2, project_id, response_format }) => {
       const format = response_format ?? "text";
       const userId = await getDefaultUserId();
-      const rl = checkRateLimit("posting", `start_platform_connection:${userId}`);
+      const rl = checkRateLimit(
+        "posting",
+        `start_platform_connection:${userId}`
+      );
       if (!rl.allowed) {
         return {
           content: [
@@ -14761,12 +15762,27 @@ function registerConnectionTools(server) {
           isError: true
         };
       }
+      const projectResolution = await resolveProjectStrict(project_id);
+      if (!projectResolution.projectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: projectResolution.error ?? "A project_id is required to connect a platform. Configure an explicit project or use an API key scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolvedProjectId = projectResolution.projectId;
+      const projectAutoResolvedNote = projectResolution.autoResolvedNote;
       const { data, error } = await callEdgeFunction(
         "mcp-data",
         {
           action: "mint-connection-nonce",
           platform: platform2,
-          ...project_id ? { projectId: project_id, project_id } : {}
+          projectId: resolvedProjectId,
+          project_id: resolvedProjectId
         },
         { timeoutMs: 1e4 }
       );
@@ -14782,6 +15798,17 @@ function registerConnectionTools(server) {
           isError: true
         };
       }
+      if (data.project_id !== resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "Connection link project attestation failed. No OAuth link was returned."
+            }
+          ],
+          isError: true
+        };
+      }
       if (format === "json") {
         return {
           content: [
@@ -14790,10 +15817,11 @@ function registerConnectionTools(server) {
               text: JSON.stringify(
                 {
                   platform: data.platform,
-                  project_id: project_id ?? null,
+                  project_id: resolvedProjectId,
                   deep_link: data.deep_link,
                   expires_at: data.expires_at,
-                  next_step: "Open deep_link in a browser, approve on the platform, then call wait_for_connection."
+                  next_step: "Open deep_link in a browser, approve on the platform, then call wait_for_connection.",
+                  ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
                 },
                 null,
                 2
@@ -14809,7 +15837,7 @@ function registerConnectionTools(server) {
             type: "text",
             text: [
               `${data.platform} connection ready.`,
-              ...project_id ? [`Brand/project: ${project_id}`] : [],
+              `Brand/project: ${resolvedProjectId}`,
               "",
               'Ask the user to open this link in a browser and click "Connect" on the platform:',
               `  ${data.deep_link}`,
@@ -14817,7 +15845,8 @@ function registerConnectionTools(server) {
               `Link expires at: ${data.expires_at} (~2 minutes).`,
               "",
               "After they approve, call `wait_for_connection` with the same platform to confirm.",
-              "This is a one-time browser setup \u2014 not another OAuth flow inside Claude."
+              "This is a one-time browser setup \u2014 not another OAuth flow inside Claude.",
+              ...projectAutoResolvedNote ? ["", `Note: ${projectAutoResolvedNote}`] : []
             ].join("\n")
           }
         ],
@@ -14830,14 +15859,20 @@ function registerConnectionTools(server) {
     "Poll until a platform connection becomes active. Use after `start_platform_connection` while the user completes the browser OAuth flow. Returns when the account row appears with status=active, or when the timeout elapses. Default timeout 120s, max 600s.",
     {
       platform: z33.enum(PLATFORM_ENUM4).describe("Platform to wait for."),
-      project_id: z33.string().optional().describe(
+      project_id: z33.string().uuid().optional().describe(
         "Brand/project ID to scope the connection poll. Use the same project_id passed to start_platform_connection."
       ),
       timeout_s: z33.number().min(5).max(600).optional().describe("How long to wait, in seconds. Default 120."),
       poll_interval_s: z33.number().min(2).max(30).optional().describe("Poll interval in seconds. Default 5."),
       response_format: z33.enum(["text", "json"]).optional().describe("Response format. Default: text.")
     },
-    async ({ platform: platform2, project_id, timeout_s, poll_interval_s, response_format }) => {
+    async ({
+      platform: platform2,
+      project_id,
+      timeout_s,
+      poll_interval_s,
+      response_format
+    }) => {
       const format = response_format ?? "text";
       const startedAt = Date.now();
       const timeoutMs = (timeout_s ?? 120) * 1e3;
@@ -14856,6 +15891,18 @@ function registerConnectionTools(server) {
           isError: true
         };
       }
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      if (!resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "A project_id is required to wait for a connection. Use the same project_id used to start the OAuth flow."
+            }
+          ],
+          isError: true
+        };
+      }
       const activeWaits = inFlightWaitsByUser.get(userId) ?? 0;
       if (activeWaits >= MAX_CONCURRENT_WAITS_PER_USER) {
         return {
@@ -14877,12 +15924,62 @@ function registerConnectionTools(server) {
             "mcp-data",
             {
               action: "connected-accounts",
-              ...project_id ? { projectId: project_id, project_id } : {}
+              projectId: resolvedProjectId,
+              project_id: resolvedProjectId
             },
             { timeoutMs: 1e4 }
           );
           if (!error && data?.success) {
-            const found = findActiveAccount(data.accounts ?? [], platform2);
+            const foundAccounts = findActiveAccounts(
+              data.accounts ?? [],
+              platform2,
+              resolvedProjectId
+            );
+            if (foundAccounts.length > 1) {
+              if (format === "json") {
+                return {
+                  content: [
+                    {
+                      type: "text",
+                      text: JSON.stringify(
+                        {
+                          connected: true,
+                          platform: platform2,
+                          project_id: resolvedProjectId,
+                          accounts: foundAccounts.map((a) => ({
+                            id: a.id,
+                            username: a.username,
+                            connected_at: a.created_at
+                          })),
+                          attempts,
+                          message: `${platform2} has ${foundAccounts.length} active accounts for this project. Pass the exact account_id to schedule_post.`
+                        },
+                        null,
+                        2
+                      )
+                    }
+                  ],
+                  isError: false
+                };
+              }
+              return {
+                content: [
+                  {
+                    type: "text",
+                    text: [
+                      `${platform2} is connected \u2014 ${foundAccounts.length} active accounts found for project ${resolvedProjectId}:`,
+                      ...foundAccounts.map(
+                        (a) => `  ${a.username || "(unnamed)"} (id=${a.id})`
+                      ),
+                      "",
+                      "Call schedule_post with the exact account_id (or account_ids) for the one you mean."
+                    ].join("\n")
+                  }
+                ],
+                isError: false
+              };
+            }
+            const found = foundAccounts[0];
             if (found) {
               if (format === "json") {
                 return {
@@ -14893,7 +15990,7 @@ function registerConnectionTools(server) {
                         {
                           connected: true,
                           platform: found.platform,
-                          project_id: found.project_id ?? project_id ?? null,
+                          project_id: resolvedProjectId,
                           account_id: found.id,
                           username: found.username,
                           connected_at: found.created_at,
@@ -14913,7 +16010,7 @@ function registerConnectionTools(server) {
                     type: "text",
                     text: [
                       `${found.platform} is connected.`,
-                      ...found.project_id || project_id ? [`Brand/project: ${found.project_id ?? project_id}`] : [],
+                      `Brand/project: ${resolvedProjectId}`,
                       `Account: ${found.username || "(unnamed)"} (id=${found.id})`,
                       `Detected after ${attempts} poll(s) in ${((Date.now() - startedAt) / 1e3).toFixed(1)}s.`,
                       "Ready to call `schedule_post`."
@@ -14926,7 +16023,9 @@ function registerConnectionTools(server) {
           }
           const remaining = deadline - Date.now();
           if (remaining <= 0) break;
-          await new Promise((resolve3) => setTimeout(resolve3, Math.min(intervalMs, remaining)));
+          await new Promise(
+            (resolve3) => setTimeout(resolve3, Math.min(intervalMs, remaining))
+          );
         }
         const message = `${platform2} did not connect within ${timeout_s ?? 120}s (${attempts} polls). The user may not have completed the browser OAuth yet, or the link expired. Mint a new link with \`start_platform_connection\` and try again, or have the user go directly to socialneuron.com/settings/connections.`;
         if (format === "json") {
@@ -14938,7 +16037,7 @@ function registerConnectionTools(server) {
                   {
                     connected: false,
                     platform: platform2,
-                    project_id: project_id ?? null,
+                    project_id: resolvedProjectId,
                     attempts,
                     timed_out: true,
                     message
@@ -14968,6 +16067,7 @@ function registerConnectionTools(server) {
 }
 
 // src/tools/harness.ts
+init_edge_function();
 import { z as z34 } from "zod";
 var ALLOWED_AGENTS = [
   "conductor",
@@ -15105,6 +16205,7 @@ function registerHarnessTools(server, _ctx) {
 }
 
 // src/tools/hermes.ts
+init_edge_function();
 import { z as z35 } from "zod";
 function asEnvelope25(data) {
   return {
@@ -15382,6 +16483,7 @@ ${"=".repeat(40)}
 
 // src/tools/skills.ts
 import { z as z36 } from "zod";
+init_edge_function();
 
 // src/lib/skills-manifest.ts
 var SKILLS_MANIFEST = [
@@ -15724,6 +16826,7 @@ ${skill.compiled_section}` : "";
 }
 
 // src/tools/loopPulse.ts
+init_edge_function();
 import { z as z37 } from "zod";
 function asEnvelope27(data) {
   return {
@@ -15779,8 +16882,9 @@ function registerLoopPulseTools(server) {
 }
 
 // src/tools/banditState.ts
-import { z as z38 } from "zod";
+init_edge_function();
 init_supabase();
+import { z as z38 } from "zod";
 function asEnvelope28(data) {
   return {
     _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
@@ -15876,8 +16980,9 @@ function registerBanditStateTools(server) {
 }
 
 // src/tools/lifecycle.ts
-import { z as z39 } from "zod";
+init_edge_function();
 init_supabase();
+import { z as z39 } from "zod";
 function envelope(data) {
   return {
     _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
@@ -16440,6 +17545,7 @@ Deliver a report covering:
 }
 
 // src/resources.ts
+init_edge_function();
 function registerResources(server) {
   server.resource(
     "brand-profile",
@@ -17341,6 +18447,7 @@ var MAX_METADATA_BYTES = 8192;
 var MAX_CACHED_CLIENTS = 1e3;
 var MAX_PERSISTED_CLIENTS = 5e3;
 var OAUTH_CLIENT_RETENTION_DAYS = 90;
+var OAUTH_CLIENT_TOUCH_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 function byteLength(value) {
   return Buffer.byteLength(value, "utf8");
 }
@@ -17363,6 +18470,7 @@ function assertRegistrationWithinBounds(client3) {
   }
 }
 function cacheClient(cache, clientId, client3) {
+  const evictedClientIds = [];
   if (cache.has(clientId)) {
     cache.delete(clientId);
   }
@@ -17371,7 +18479,9 @@ function cacheClient(cache, clientId, client3) {
     const oldestClientId = cache.keys().next().value;
     if (!oldestClientId) break;
     cache.delete(oldestClientId);
+    evictedClientIds.push(oldestClientId);
   }
+  return evictedClientIds;
 }
 function rowToClient(row) {
   return {
@@ -17406,6 +18516,7 @@ function clientToRow(c) {
 }
 function createClientsStore() {
   const cache = /* @__PURE__ */ new Map();
+  const lastClientTouch = /* @__PURE__ */ new Map();
   let supabaseAvailable = true;
   function markUnavailable(reason) {
     if (supabaseAvailable) {
@@ -17415,14 +18526,50 @@ function createClientsStore() {
       supabaseAvailable = false;
     }
   }
+  function clearEvictedClientTouches(evictedClientIds) {
+    for (const evictedClientId of evictedClientIds) {
+      lastClientTouch.delete(evictedClientId);
+    }
+  }
+  function touchClientActivity(clientId) {
+    if (!supabaseAvailable) return;
+    const now = Date.now();
+    const lastTouchedAt = lastClientTouch.get(clientId);
+    if (lastTouchedAt !== void 0 && now - lastTouchedAt < OAUTH_CLIENT_TOUCH_INTERVAL_MS) {
+      return;
+    }
+    lastClientTouch.set(clientId, now);
+    const releaseTouchReservation = () => {
+      if (lastClientTouch.get(clientId) === now) {
+        lastClientTouch.delete(clientId);
+      }
+    };
+    void (async () => {
+      try {
+        const supabase = getSupabaseClient();
+        const { error: touchError } = await supabase.from("mcp_oauth_clients").update({ last_used_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("client_id", clientId);
+        if (touchError) {
+          releaseTouchReservation();
+          console.error(
+            `[oauth] failed to update client activity: ${sanitizeError(touchError)}`
+          );
+        }
+      } catch (touchError) {
+        releaseTouchReservation();
+        console.error(`[oauth] failed to update client activity: ${sanitizeError(touchError)}`);
+      }
+    })();
+  }
   return {
     async getClient(clientId) {
       const cached3 = cache.get(clientId);
       if (cached3) {
         if (!hasAllowedRedirectUris(cached3)) {
           cache.delete(clientId);
+          lastClientTouch.delete(clientId);
           return void 0;
         }
+        touchClientActivity(clientId);
         return cached3;
       }
       if (!supabaseAvailable) return void 0;
@@ -17444,8 +18591,8 @@ function createClientsStore() {
           }
           return void 0;
         }
-        cacheClient(cache, clientId, client3);
-        void supabase.from("mcp_oauth_clients").update({ last_used_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("client_id", clientId);
+        clearEvictedClientTouches(cacheClient(cache, clientId, client3));
+        touchClientActivity(clientId);
         return client3;
       } catch (err) {
         markUnavailable(err instanceof Error ? err.message : "unknown error");
@@ -17491,7 +18638,8 @@ function createClientsStore() {
           markUnavailable(err instanceof Error ? err.message : "unknown error");
         }
       }
-      cacheClient(cache, client3.client_id, client3);
+      lastClientTouch.delete(client3.client_id);
+      clearEvictedClientTouches(cacheClient(cache, client3.client_id, client3));
       return client3;
     }
   };