@socialneuron/mcp-server 1.8.2 → 1.9.1

package/dist/index.js

@@ -19,7 +19,7 @@ var MCP_VERSION;
 var init_version = __esm({
   "src/lib/version.ts"() {
     "use strict";
-    MCP_VERSION = "1.8.2";
+    MCP_VERSION = "1.9.1";
   }
 });
 
@@ -384,6 +384,209 @@ var init_request_context = __esm({
   }
 });
 
+// src/lib/edge-function.ts
+var edge_function_exports = {};
+__export(edge_function_exports, {
+  callEdgeFunction: () => callEdgeFunction
+});
+function safeGatewayError(responseText, status) {
+  try {
+    const parsed = JSON.parse(responseText);
+    const nested = parsed.error && typeof parsed.error === "object" ? parsed.error : null;
+    const candidates = [
+      nested?.error_type,
+      nested?.code,
+      parsed.error_type,
+      parsed.error_code,
+      parsed.code,
+      typeof parsed.error === "string" ? parsed.error : null
+    ];
+    for (const value of candidates) {
+      if (typeof value !== "string") continue;
+      const normalized = value.trim().toLowerCase();
+      if (SAFE_GATEWAY_ERROR_CODES.has(normalized)) return normalized;
+      const embedded = [...SAFE_GATEWAY_ERROR_CODES].find((code) => normalized.includes(code));
+      if (embedded) return embedded;
+    }
+  } catch {
+  }
+  return `Backend request failed (HTTP ${status}).`;
+}
+function safeFailureData(responseText) {
+  try {
+    const parsed = JSON.parse(responseText);
+    const metric = (name) => {
+      const value = parsed[name];
+      return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+    };
+    const billingStatus = typeof parsed.billing_status === "string" && SAFE_BILLING_STATUSES.has(parsed.billing_status) ? parsed.billing_status : void 0;
+    const failureReason = parsed.failure_reason === "generation_failed" || parsed.failure_reason === "authentication_failed" || parsed.failure_reason === "cancelled_by_user" ? parsed.failure_reason : void 0;
+    const jobStatus = typeof parsed.status === "string" && SAFE_JOB_STATUSES.has(parsed.status) ? parsed.status : void 0;
+    const safe = {
+      ...jobStatus ? { status: jobStatus } : {},
+      ...metric("credits_reserved") !== void 0 ? { credits_reserved: metric("credits_reserved") } : {},
+      ...metric("credits_charged") !== void 0 ? { credits_charged: metric("credits_charged") } : {},
+      ...metric("credits_refunded") !== void 0 ? { credits_refunded: metric("credits_refunded") } : {},
+      ...billingStatus ? { billing_status: billingStatus } : {},
+      ...failureReason ? { failure_reason: failureReason } : {}
+    };
+    return Object.keys(safe).length > 0 ? safe : null;
+  } catch {
+    return null;
+  }
+}
+function getApiKeyOrNull() {
+  const envKey = process.env.SOCIALNEURON_API_KEY;
+  if (envKey && envKey.trim().length) return envKey.trim();
+  const requestToken = getRequestToken();
+  if (requestToken) return requestToken;
+  return getAuthenticatedApiKey();
+}
+async function callEdgeFunction(functionName, body, options) {
+  const supabaseUrl = getSupabaseUrl();
+  const apiKey = getApiKeyOrNull();
+  const controller = new AbortController();
+  const timeoutMs = options?.timeoutMs ?? 6e4;
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const enrichedBody = { ...body };
+  if (!enrichedBody.userId && !enrichedBody.user_id) {
+    try {
+      const defaultId = await getDefaultUserId();
+      enrichedBody.userId = defaultId;
+      enrichedBody.user_id = defaultId;
+    } catch {
+    }
+  } else {
+    if (enrichedBody.userId && !enrichedBody.user_id) enrichedBody.user_id = enrichedBody.userId;
+    if (enrichedBody.user_id && !enrichedBody.userId) enrichedBody.userId = enrichedBody.user_id;
+  }
+  if (!enrichedBody.projectId && !enrichedBody.project_id) {
+    try {
+      const { getDefaultProjectId: getDefaultProjectId2 } = await Promise.resolve().then(() => (init_supabase(), supabase_exports));
+      const defaultProjectId = await getDefaultProjectId2();
+      if (defaultProjectId) {
+        enrichedBody.projectId = defaultProjectId;
+        enrichedBody.project_id = defaultProjectId;
+      }
+    } catch {
+    }
+  }
+  let url;
+  let method = options?.method ?? "POST";
+  let headers;
+  let requestBody;
+  if (!apiKey) {
+    clearTimeout(timer);
+    return {
+      data: null,
+      error: "Not authenticated. Run: npx @socialneuron/mcp-server login \u2014 Requires a paid plan (Starter+). See https://socialneuron.com/pricing"
+    };
+  }
+  url = new URL(`${supabaseUrl}/functions/v1/mcp-gateway`);
+  headers = {
+    Authorization: `Bearer ${apiKey}`,
+    "Content-Type": "application/json"
+  };
+  requestBody = {
+    functionName,
+    body: enrichedBody,
+    query: options?.query,
+    method: method.toUpperCase(),
+    timeoutMs
+  };
+  method = "POST";
+  try {
+    const response = await fetch(url.toString(), {
+      method,
+      headers,
+      body: method === "GET" ? void 0 : JSON.stringify(requestBody),
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    const responseText = await response.text();
+    if (!response.ok) {
+      const errorCode = safeGatewayError(responseText, response.status);
+      const failureData = safeFailureData(responseText);
+      if (response.status === 401) {
+        return {
+          data: failureData,
+          error: `Authentication failed (HTTP 401). Run 'npx @socialneuron/mcp-server login' to re-authenticate.`
+        };
+      }
+      if (response.status === 403) {
+        return {
+          data: failureData,
+          error: `Forbidden (HTTP 403): ${errorCode}. This action isn't permitted for your account, plan, or scope \u2014 your connection is still valid.`
+        };
+      }
+      if (response.status === 429) {
+        const retryAfter = response.headers.get("retry-after") || "60";
+        return {
+          data: failureData,
+          error: `Rate limit exceeded (HTTP 429). Wait ${retryAfter}s before retrying. Reduce request frequency or upgrade your plan.`
+        };
+      }
+      return { data: failureData, error: errorCode };
+    }
+    try {
+      const data = JSON.parse(responseText);
+      return { data, error: null };
+    } catch {
+      return { data: { text: responseText }, error: null };
+    }
+  } catch (err) {
+    clearTimeout(timer);
+    if (err instanceof Error && err.name === "AbortError") {
+      return {
+        data: null,
+        error: `Edge Function '${functionName}' timed out after ${timeoutMs}ms`
+      };
+    }
+    return { data: null, error: "Network request failed. Please retry." };
+  }
+}
+var SAFE_GATEWAY_ERROR_CODES, SAFE_BILLING_STATUSES, SAFE_JOB_STATUSES;
+var init_edge_function = __esm({
+  "src/lib/edge-function.ts"() {
+    "use strict";
+    init_supabase();
+    init_request_context();
+    SAFE_GATEWAY_ERROR_CODES = /* @__PURE__ */ new Set([
+      "daily_limit_reached",
+      "insufficient_credits",
+      "project_scope_mismatch",
+      "schedule_conflict",
+      "post_not_found",
+      "post_not_reschedulable",
+      "post_in_progress",
+      "not_cancellable",
+      "publishing_in_progress",
+      "plan_upgrade_required",
+      "rate_limited",
+      "validation_error",
+      "permission_denied",
+      "not_found"
+    ]);
+    SAFE_BILLING_STATUSES = /* @__PURE__ */ new Set([
+      "reserved",
+      "charged",
+      "refunded",
+      "failed_no_charge",
+      "refund_pending",
+      "not_charged"
+    ]);
+    SAFE_JOB_STATUSES = /* @__PURE__ */ new Set([
+      "queued",
+      "pending",
+      "processing",
+      "completed",
+      "failed",
+      "cancelled",
+      "canceled"
+    ]);
+  }
+});
+
 // src/cli/credentials.ts
 var credentials_exports = {};
 __export(credentials_exports, {
@@ -410,6 +613,10 @@ import {
 } from "node:fs";
 import { homedir, platform } from "node:os";
 import { join } from "node:path";
+function loadNativeKeyring() {
+  nativeKeyringModule ??= import("@napi-rs/keyring").catch(() => null);
+  return nativeKeyringModule;
+}
 function assertSafeCredentialPaths() {
   if (platform() === "win32") return;
   const uid = process.getuid?.();
@@ -529,50 +736,91 @@ function writeCredentialsFile(data) {
   }
   hardenCredentialPermissions();
 }
-function macKeychainRead(service) {
+function isMacKeychainItemMissing(error) {
+  const commandError = error;
+  if (commandError?.status === 44) return true;
+  const detail = `${commandError?.stderr ?? ""}
+${commandError?.message ?? ""}`;
+  return /\berrsecitemnotfound\b/i.test(detail) || /(?:^|:\s*)the specified item could not be found in the keychain\.\s*$/i.test(detail.trim());
+}
+async function inspectMacKeychain(service) {
+  const native = await loadNativeKeyring();
+  if (native) {
+    try {
+      const value = new native.Entry(service, KEYCHAIN_ACCOUNT).getPassword();
+      if (value) return { status: "found", value };
+    } catch {
+    }
+  }
   try {
     const result = execFileSync(
       "security",
       ["find-generic-password", "-a", KEYCHAIN_ACCOUNT, "-s", service, "-w"],
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     );
-    return result.trim() || null;
-  } catch {
-    return null;
+    const value = result.trim();
+    return value ? { status: "found", value } : { status: "missing" };
+  } catch (error) {
+    return isMacKeychainItemMissing(error) ? { status: "missing" } : { status: "unavailable" };
   }
 }
-function macKeychainWrite(service, value) {
+async function macKeychainRead(service) {
+  const result = await inspectMacKeychain(service);
+  return result.status === "found" ? result.value : null;
+}
+async function macKeychainWrite(service, value) {
+  const native = await loadNativeKeyring();
+  if (!native) return false;
   try {
-    execFileSync(
-      "security",
-      [
-        "add-generic-password",
-        "-a",
-        KEYCHAIN_ACCOUNT,
-        "-s",
-        service,
-        "-w",
-        value,
-        "-U"
-        // update if exists
-      ],
-      { stdio: ["pipe", "pipe", "pipe"] }
-    );
+    new native.Entry(service, KEYCHAIN_ACCOUNT).setPassword(value);
     return true;
   } catch {
     return false;
   }
 }
-function macKeychainDelete(service) {
+async function macKeychainDelete(service) {
+  const native = await loadNativeKeyring();
+  let nativeDeleted = false;
+  if (native) {
+    try {
+      nativeDeleted = new native.Entry(service, KEYCHAIN_ACCOUNT).deletePassword();
+    } catch {
+    }
+  }
   try {
     execFileSync("security", ["delete-generic-password", "-a", KEYCHAIN_ACCOUNT, "-s", service], {
       stdio: ["pipe", "pipe", "pipe"]
     });
-    return true;
-  } catch {
-    return false;
+    return "deleted";
+  } catch (error) {
+    if (isMacKeychainItemMissing(error)) return nativeDeleted ? "deleted" : "missing";
+    return "unavailable";
   }
 }
+async function clearMacKeychain(service) {
+  for (let attempt = 0; attempt < 4; attempt += 1) {
+    const deleted = await macKeychainDelete(service);
+    if (deleted === "unavailable") break;
+    const remaining = await inspectMacKeychain(service);
+    if (remaining.status === "missing") return;
+    if (remaining.status === "unavailable") break;
+  }
+  throw new Error(
+    "Unable to verify removal of the existing Social Neuron Keychain credential. Unlock Keychain Access, remove the item, and retry."
+  );
+}
+async function verifyMacFileFallback(service) {
+  const existing = await inspectMacKeychain(service);
+  if (existing.status === "missing") return;
+  if (existing.status === "found") {
+    throw new Error(
+      "An existing Social Neuron Keychain credential could not be replaced. The existing value was retained; unlock or remove it in Keychain Access and retry."
+    );
+  }
+  throw new Error(
+    "Unable to verify absence of an existing Social Neuron Keychain credential. Unlock Keychain Access and retry."
+  );
+}
 function linuxSecretRead(key) {
   try {
     const result = execFileSync(
@@ -612,7 +860,7 @@ async function loadApiKey() {
   if (envKey) return envKey;
   const os = platform();
   if (os === "darwin") {
-    const key = macKeychainRead(KEYCHAIN_SERVICE_API);
+    const key = await macKeychainRead(KEYCHAIN_SERVICE_API);
     if (key) return key;
   } else if (os === "linux") {
     const key = linuxSecretRead("api-key");
@@ -629,13 +877,18 @@ async function loadApiKey() {
 async function saveApiKey(key) {
   const os = platform();
   let saved = false;
+  let fallbackCredentials;
   if (os === "darwin") {
-    saved = macKeychainWrite(KEYCHAIN_SERVICE_API, key);
+    saved = await macKeychainWrite(KEYCHAIN_SERVICE_API, key);
+    if (!saved) {
+      fallbackCredentials = readCredentialsFile();
+      await verifyMacFileFallback(KEYCHAIN_SERVICE_API);
+    }
   } else if (os === "linux") {
     saved = linuxSecretWrite("api-key", key);
   }
   if (!saved) {
-    const creds = readCredentialsFile();
+    const creds = fallbackCredentials ?? readCredentialsFile();
     creds.apiKey = key;
     writeCredentialsFile(creds);
     if (os === "win32") {
@@ -658,8 +911,13 @@ async function saveApiKey(key) {
 }
 async function deleteApiKey() {
   const os = platform();
+  let keychainError;
   if (os === "darwin") {
-    macKeychainDelete(KEYCHAIN_SERVICE_API);
+    try {
+      await clearMacKeychain(KEYCHAIN_SERVICE_API);
+    } catch (error) {
+      keychainError = error;
+    }
   } else if (os === "linux") {
     linuxSecretDelete("api-key");
   }
@@ -675,13 +933,14 @@ async function deleteApiKey() {
       writeCredentialsFile(creds);
     }
   }
+  if (keychainError) throw keychainError;
 }
 async function loadSupabaseUrl() {
   const envUrl = process.env.SOCIALNEURON_SUPABASE_URL || process.env.SUPABASE_URL;
   if (envUrl) return envUrl;
   const os = platform();
   if (os === "darwin") {
-    const url = macKeychainRead(KEYCHAIN_SERVICE_URL);
+    const url = await macKeychainRead(KEYCHAIN_SERVICE_URL);
     if (url) return url;
   } else if (os === "linux") {
     const url = linuxSecretRead("supabase-url");
@@ -693,18 +952,23 @@ async function loadSupabaseUrl() {
 async function saveSupabaseUrl(url) {
   const os = platform();
   let saved = false;
+  let fallbackCredentials;
   if (os === "darwin") {
-    saved = macKeychainWrite(KEYCHAIN_SERVICE_URL, url);
+    saved = await macKeychainWrite(KEYCHAIN_SERVICE_URL, url);
+    if (!saved) {
+      fallbackCredentials = readCredentialsFile();
+      await verifyMacFileFallback(KEYCHAIN_SERVICE_URL);
+    }
   } else if (os === "linux") {
     saved = linuxSecretWrite("supabase-url", url);
   }
   if (!saved) {
-    const creds = readCredentialsFile();
+    const creds = fallbackCredentials ?? readCredentialsFile();
     creds.supabaseUrl = url;
     writeCredentialsFile(creds);
   }
 }
-var KEYCHAIN_ACCOUNT, KEYCHAIN_SERVICE_API, KEYCHAIN_SERVICE_URL, CONFIG_DIR, CREDENTIALS_FILE;
+var KEYCHAIN_ACCOUNT, KEYCHAIN_SERVICE_API, KEYCHAIN_SERVICE_URL, CONFIG_DIR, CREDENTIALS_FILE, nativeKeyringModule;
 var init_credentials = __esm({
   "src/cli/credentials.ts"() {
     "use strict";
@@ -857,7 +1121,10 @@ __export(supabase_exports, {
   getSupabaseUrl: () => getSupabaseUrl,
   initializeAuth: () => initializeAuth,
   isTelemetryDisabled: () => isTelemetryDisabled,
-  logMcpToolInvocation: () => logMcpToolInvocation
+  listAccessibleProjectsWithAccountStatus: () => listAccessibleProjectsWithAccountStatus,
+  logMcpToolInvocation: () => logMcpToolInvocation,
+  resolveProjectForConnectedAccountTool: () => resolveProjectForConnectedAccountTool,
+  resolveProjectStrict: () => resolveProjectStrict
 });
 import { createClient } from "@supabase/supabase-js";
 import { randomUUID } from "node:crypto";
@@ -896,20 +1163,17 @@ async function getDefaultUserId() {
   if (authenticatedUserId) return authenticatedUserId;
   const envUserId = process.env.SOCIALNEURON_USER_ID;
   if (envUserId) return envUserId;
-  throw new Error("No user ID available. Set SOCIALNEURON_USER_ID or authenticate via API key.");
+  throw new Error(
+    "No user ID available. Set SOCIALNEURON_USER_ID or authenticate via API key."
+  );
 }
 async function getDefaultProjectId() {
   const requestProjectId = getRequestProjectId();
   if (requestProjectId) return requestProjectId;
   if (authenticatedProjectId) return authenticatedProjectId;
   const userId = await getDefaultUserId().catch(() => null);
-  if (userId) {
-    const cached = projectIdCache.get(userId);
-    if (cached) return cached;
-  }
   const envProjectId = process.env.SOCIALNEURON_PROJECT_ID;
   if (envProjectId) {
-    if (userId) projectIdCache.set(userId, envProjectId);
     return envProjectId;
   }
   if (!userId) return null;
@@ -918,15 +1182,126 @@ async function getDefaultProjectId() {
     const { data: memberships } = await supabase.from("organization_members").select("organization_id").eq("user_id", userId);
     const orgIds = (memberships ?? []).map((m) => m.organization_id);
     if (orgIds.length === 0) return null;
-    const { data } = await supabase.from("projects").select("id").in("organization_id", orgIds).order("created_at", { ascending: false }).limit(1).maybeSingle();
-    if (data?.id) {
-      projectIdCache.set(userId, data.id);
-      return data.id;
-    }
+    const { data } = await supabase.from("projects").select("id").in("organization_id", orgIds).order("created_at", { ascending: false }).limit(2);
+    if (data?.length === 1) return data[0].id;
   } catch {
   }
   return null;
 }
+function normalizePlatformFilter(platform3) {
+  if (!platform3) return null;
+  const values = Array.isArray(platform3) ? platform3 : [platform3];
+  const set = new Set(values.filter(Boolean).map((p) => p.toLowerCase()));
+  return set.size > 0 ? set : null;
+}
+async function listAccessibleProjectsWithAccountStatusDirect(userId, platform3) {
+  try {
+    const supabase = getSupabaseClient();
+    const { data: memberships } = await supabase.from("organization_members").select("organization_id").eq("user_id", userId);
+    const orgIds = (memberships ?? []).map((m) => m.organization_id);
+    if (orgIds.length === 0) return [];
+    const { data: projects } = await supabase.from("projects").select("id, name").in("organization_id", orgIds).order("created_at", { ascending: false });
+    const projectRows = projects ?? [];
+    if (projectRows.length === 0) return [];
+    const projectIds = projectRows.map((p) => p.id);
+    const { data: accounts } = await supabase.from("connected_accounts").select("project_id, status, platform").eq("user_id", userId).in("project_id", projectIds);
+    const anyAccountByProject = /* @__PURE__ */ new Set();
+    const platformsByProject = /* @__PURE__ */ new Map();
+    for (const row of accounts ?? []) {
+      if (row.status !== "active" && row.status !== "expires_soon") continue;
+      if (!row.project_id) continue;
+      anyAccountByProject.add(row.project_id);
+      if (row.platform) {
+        const set = platformsByProject.get(row.project_id) ?? /* @__PURE__ */ new Set();
+        set.add(row.platform.toLowerCase());
+        platformsByProject.set(row.project_id, set);
+      }
+    }
+    const requestedPlatforms = normalizePlatformFilter(platform3);
+    return projectRows.map((p) => {
+      const platforms = Array.from(platformsByProject.get(p.id) ?? []);
+      const hasConnectedAccounts = requestedPlatforms ? platforms.some((pl) => requestedPlatforms.has(pl)) : anyAccountByProject.has(p.id);
+      return { id: p.id, name: p.name, hasConnectedAccounts, platforms };
+    });
+  } catch {
+    return [];
+  }
+}
+async function listAccessibleProjectsWithAccountStatusViaEdgeFunction(userId, platform3) {
+  try {
+    const { callEdgeFunction: callEdgeFunction2 } = await Promise.resolve().then(() => (init_edge_function(), edge_function_exports));
+    const { data, error } = await callEdgeFunction2(
+      "mcp-data",
+      { action: "projects", userId, user_id: userId },
+      { timeoutMs: 1e4 }
+    );
+    if (error || !data?.success || !Array.isArray(data.projects)) return [];
+    const requestedPlatforms = normalizePlatformFilter(platform3);
+    return data.projects.map((p) => {
+      const platforms = (p.platforms ?? []).map((pl) => pl.toLowerCase());
+      const hasConnectedAccounts = requestedPlatforms ? platforms.some((pl) => requestedPlatforms.has(pl)) : Boolean(p.hasConnectedAccounts);
+      return { id: p.id, name: p.name, hasConnectedAccounts, platforms };
+    });
+  } catch {
+    return [];
+  }
+}
+async function listAccessibleProjectsWithAccountStatus(userId, platform3) {
+  if (getServiceKeyOrNull()) {
+    return listAccessibleProjectsWithAccountStatusDirect(userId, platform3);
+  }
+  return listAccessibleProjectsWithAccountStatusViaEdgeFunction(
+    userId,
+    platform3
+  );
+}
+async function resolveProjectForConnectedAccountTool(explicitProjectId, platform3) {
+  if (explicitProjectId) return { projectId: explicitProjectId };
+  const defaultProjectId = await getDefaultProjectId();
+  if (defaultProjectId) return { projectId: defaultProjectId };
+  const genericError = "project_id is required. Configure an explicit project or use an API key scoped to exactly one project.";
+  const userId = await getDefaultUserId().catch(() => null);
+  if (!userId) return { error: genericError };
+  const projects = await listAccessibleProjectsWithAccountStatus(
+    userId,
+    platform3
+  );
+  if (projects.length === 0) return { error: genericError };
+  const withAccounts = projects.filter((p) => p.hasConnectedAccounts);
+  if (withAccounts.length === 1) {
+    const chosen = withAccounts[0];
+    const platformNote = platform3 ? ` for ${Array.isArray(platform3) ? platform3.join("/") : platform3}` : "";
+    return {
+      projectId: chosen.id,
+      autoResolvedNote: `project_id was not provided; auto-resolved to "${chosen.name}" (${chosen.id}) \u2014 the only one of your ${projects.length} project(s) with an active connected account${platformNote}.`,
+      projects
+    };
+  }
+  const projectList = projects.map(
+    (p) => `${p.name} (${p.id}${p.hasConnectedAccounts ? ", has connected accounts" : ""})`
+  ).join("; ");
+  return {
+    error: `project_id is required \u2014 your account has ${projects.length} projects and the target could not be auto-resolved. Pass the exact project_id from this list: ${projectList}.`,
+    projects
+  };
+}
+async function resolveProjectStrict(explicitProjectId) {
+  if (explicitProjectId) return { projectId: explicitProjectId };
+  const defaultProjectId = await getDefaultProjectId();
+  if (defaultProjectId) return { projectId: defaultProjectId };
+  const genericError = "project_id is required. Configure an explicit project or use an API key scoped to exactly one project.";
+  const userId = await getDefaultUserId().catch(() => null);
+  if (!userId) return { error: genericError };
+  const projects = await listAccessibleProjectsWithAccountStatus(userId);
+  if (projects.length === 0) return { error: genericError };
+  const projectList = projects.map(
+    (p) => `${p.name} (${p.id}${p.hasConnectedAccounts ? ", has connected accounts" : ""})`
+  ).join("; ");
+  return {
+    error: `project_id is required \u2014 your account has ${projects.length} projects. Pass the exact project_id from this list: ${projectList}.`,
+    projects
+  };
+}
 async function initializeAuth() {
   const { loadApiKey: loadApiKey2 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));
   const apiKey = await loadApiKey2();
@@ -952,8 +1327,11 @@ async function initializeAuth() {
       }
       if (authenticatedExpiresAt) {
         const expiresMs = new Date(authenticatedExpiresAt).getTime();
-        const daysLeft = Math.ceil((expiresMs - Date.now()) / (1e3 * 60 * 60 * 24));
-        if (!_quietAuth) console.error("[MCP] Key expires: " + authenticatedExpiresAt);
+        const daysLeft = Math.ceil(
+          (expiresMs - Date.now()) / (1e3 * 60 * 60 * 24)
+        );
+        if (!_quietAuth)
+          console.error("[MCP] Key expires: " + authenticatedExpiresAt);
         if (daysLeft <= 7) {
           console.error(
             `[MCP] Warning: API key expires in ${daysLeft} day(s). Run: npx @socialneuron/mcp-server login`
@@ -1032,7 +1410,7 @@ async function logMcpToolInvocation(args) {
   Promise.resolve().then(() => (init_posthog(), posthog_exports)).then(({ captureToolEvent: captureToolEvent2 }) => captureToolEvent2(args)).catch(() => {
   });
 }
-var SUPABASE_URL, SUPABASE_SERVICE_KEY, client2, _authMode, authenticatedUserId, authenticatedScopes, authenticatedEmail, authenticatedExpiresAt, authenticatedApiKey, authenticatedProjectId, MCP_RUN_ID, CLOUD_SUPABASE_URL, CLOUD_SUPABASE_ANON_KEY, projectIdCache;
+var SUPABASE_URL, SUPABASE_SERVICE_KEY, client2, _authMode, authenticatedUserId, authenticatedScopes, authenticatedEmail, authenticatedExpiresAt, authenticatedApiKey, authenticatedProjectId, MCP_RUN_ID, CLOUD_SUPABASE_URL, CLOUD_SUPABASE_ANON_KEY;
 var init_supabase = __esm({
   "src/lib/supabase.ts"() {
     "use strict";
@@ -1050,7 +1428,6 @@ var init_supabase = __esm({
     MCP_RUN_ID = randomUUID();
     CLOUD_SUPABASE_URL = "https://rhukkjscgzauutioyeei.supabase.co";
     CLOUD_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InJodWtranNjZ3phdXV0aW95ZWVpIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjQ4NjM4ODYsImV4cCI6MjA4MDQzOTg4Nn0.JVtrviGvN0HaSh0JFS5KNl5FAB5ffG5Y1IMZsQFUrNQ";
-    projectIdCache = /* @__PURE__ */ new Map();
   }
 });
 
@@ -2016,269 +2393,66 @@ var COMPILED;
 var init_pii = __esm({
   "src/lib/agent-harness/detectors/pii.ts"() {
     "use strict";
-    init_constants2();
-    COMPILED = Object.entries(CONSTANTS.PII_PATTERNS).map(
-      ([name, pattern]) => ({ name, re: new RegExp(pattern, "gi") })
-    );
-  }
-});
-
-// src/lib/agent-harness/scanner.ts
-function scan(text, options) {
-  const flagged = /* @__PURE__ */ new Set();
-  let risk = 0;
-  const maxLength = options.source === "mcp_tool_output" ? CONSTANTS.MAX_OUTPUT_LENGTH : CONSTANTS.MAX_LENGTH;
-  if (text.length > maxLength) {
-    return {
-      passed: false,
-      risk_score: 1,
-      flagged_patterns: ["excessive_length"],
-      pii_redacted: false
-    };
-  }
-  const zw = detectZeroWidth(text);
-  if (zw.found) {
-    flagged.add(zw.pattern);
-    risk = Math.max(risk, 0.95);
-  }
-  const ipRaw = detectInstructionPhrase(text);
-  if (ipRaw.found) {
-    flagged.add(ipRaw.pattern);
-    risk = Math.max(risk, 0.9);
-  }
-  const normalized = normalize(text);
-  const ipNorm = detectInstructionPhrase(normalized);
-  if (ipNorm.found) {
-    flagged.add(ipNorm.pattern);
-    risk = Math.max(risk, 0.9);
-  }
-  const flaggedArr = Array.from(flagged);
-  if ((options.mode === "block" || options.mode === "sanitize") && flaggedArr.length > 0) {
-    return { passed: false, risk_score: risk, flagged_patterns: flaggedArr, pii_redacted: false };
-  }
-  const pii = scrubPii(normalized, options.source);
-  if (pii.redacted) {
-    return {
-      passed: true,
-      risk_score: Math.max(risk, 0.3),
-      flagged_patterns: [...flaggedArr, ...pii.patterns.map((p) => `pii_${p}`)],
-      sanitized_text: pii.text,
-      pii_redacted: true
-    };
-  }
-  return { passed: true, risk_score: risk, flagged_patterns: flaggedArr, pii_redacted: false };
-}
-var init_scanner = __esm({
-  "src/lib/agent-harness/scanner.ts"() {
-    "use strict";
-    init_constants2();
-    init_normalize();
-    init_zeroWidth();
-    init_instructionPhrase();
-    init_pii();
-  }
-});
-
-// src/lib/edge-function.ts
-var edge_function_exports = {};
-__export(edge_function_exports, {
-  callEdgeFunction: () => callEdgeFunction
-});
-function safeGatewayError(responseText, status) {
-  try {
-    const parsed = JSON.parse(responseText);
-    const nested = parsed.error && typeof parsed.error === "object" ? parsed.error : null;
-    const candidates = [
-      nested?.error_type,
-      nested?.code,
-      parsed.error_type,
-      parsed.error_code,
-      parsed.code,
-      typeof parsed.error === "string" ? parsed.error : null
-    ];
-    for (const value of candidates) {
-      if (typeof value !== "string") continue;
-      const normalized = value.trim().toLowerCase();
-      if (SAFE_GATEWAY_ERROR_CODES.has(normalized)) return normalized;
-      const embedded = [...SAFE_GATEWAY_ERROR_CODES].find((code) => normalized.includes(code));
-      if (embedded) return embedded;
-    }
-  } catch {
-  }
-  return `Backend request failed (HTTP ${status}).`;
-}
-function safeFailureData(responseText) {
-  try {
-    const parsed = JSON.parse(responseText);
-    const metric = (name) => {
-      const value = parsed[name];
-      return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
-    };
-    const billingStatus = typeof parsed.billing_status === "string" && SAFE_BILLING_STATUSES.has(parsed.billing_status) ? parsed.billing_status : void 0;
-    const failureReason = parsed.failure_reason === "generation_failed" || parsed.failure_reason === "authentication_failed" || parsed.failure_reason === "cancelled_by_user" ? parsed.failure_reason : void 0;
-    const jobStatus = typeof parsed.status === "string" && SAFE_JOB_STATUSES.has(parsed.status) ? parsed.status : void 0;
-    const safe = {
-      ...jobStatus ? { status: jobStatus } : {},
-      ...metric("credits_reserved") !== void 0 ? { credits_reserved: metric("credits_reserved") } : {},
-      ...metric("credits_charged") !== void 0 ? { credits_charged: metric("credits_charged") } : {},
-      ...metric("credits_refunded") !== void 0 ? { credits_refunded: metric("credits_refunded") } : {},
-      ...billingStatus ? { billing_status: billingStatus } : {},
-      ...failureReason ? { failure_reason: failureReason } : {}
-    };
-    return Object.keys(safe).length > 0 ? safe : null;
-  } catch {
-    return null;
-  }
-}
-function getApiKeyOrNull() {
-  const envKey = process.env.SOCIALNEURON_API_KEY;
-  if (envKey && envKey.trim().length) return envKey.trim();
-  const requestToken = getRequestToken();
-  if (requestToken) return requestToken;
-  return getAuthenticatedApiKey();
-}
-async function callEdgeFunction(functionName, body, options) {
-  const supabaseUrl = getSupabaseUrl();
-  const apiKey = getApiKeyOrNull();
-  const controller = new AbortController();
-  const timeoutMs = options?.timeoutMs ?? 6e4;
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const enrichedBody = { ...body };
-  if (!enrichedBody.userId && !enrichedBody.user_id) {
-    try {
-      const defaultId = await getDefaultUserId();
-      enrichedBody.userId = defaultId;
-      enrichedBody.user_id = defaultId;
-    } catch {
-    }
-  } else {
-    if (enrichedBody.userId && !enrichedBody.user_id) enrichedBody.user_id = enrichedBody.userId;
-    if (enrichedBody.user_id && !enrichedBody.userId) enrichedBody.userId = enrichedBody.user_id;
-  }
-  if (!enrichedBody.projectId && !enrichedBody.project_id) {
-    try {
-      const { getDefaultProjectId: getDefaultProjectId2 } = await Promise.resolve().then(() => (init_supabase(), supabase_exports));
-      const defaultProjectId = await getDefaultProjectId2();
-      if (defaultProjectId) {
-        enrichedBody.projectId = defaultProjectId;
-        enrichedBody.project_id = defaultProjectId;
-      }
-    } catch {
-    }
+    init_constants2();
+    COMPILED = Object.entries(CONSTANTS.PII_PATTERNS).map(
+      ([name, pattern]) => ({ name, re: new RegExp(pattern, "gi") })
+    );
   }
-  let url;
-  let method = options?.method ?? "POST";
-  let headers;
-  let requestBody;
-  if (!apiKey) {
-    clearTimeout(timer);
+});
+
+// src/lib/agent-harness/scanner.ts
+function scan(text, options) {
+  const flagged = /* @__PURE__ */ new Set();
+  let risk = 0;
+  const maxLength = options.source === "mcp_tool_output" ? CONSTANTS.MAX_OUTPUT_LENGTH : CONSTANTS.MAX_LENGTH;
+  if (text.length > maxLength) {
     return {
-      data: null,
-      error: "Not authenticated. Run: npx @socialneuron/mcp-server login \u2014 Requires a paid plan (Starter+). See https://socialneuron.com/pricing"
+      passed: false,
+      risk_score: 1,
+      flagged_patterns: ["excessive_length"],
+      pii_redacted: false
     };
   }
-  url = new URL(`${supabaseUrl}/functions/v1/mcp-gateway`);
-  headers = {
-    Authorization: `Bearer ${apiKey}`,
-    "Content-Type": "application/json"
-  };
-  requestBody = {
-    functionName,
-    body: enrichedBody,
-    query: options?.query,
-    method: method.toUpperCase(),
-    timeoutMs
-  };
-  method = "POST";
-  try {
-    const response = await fetch(url.toString(), {
-      method,
-      headers,
-      body: method === "GET" ? void 0 : JSON.stringify(requestBody),
-      signal: controller.signal
-    });
-    clearTimeout(timer);
-    const responseText = await response.text();
-    if (!response.ok) {
-      const errorCode = safeGatewayError(responseText, response.status);
-      const failureData = safeFailureData(responseText);
-      if (response.status === 401) {
-        return {
-          data: failureData,
-          error: `Authentication failed (HTTP 401). Run 'npx @socialneuron/mcp-server login' to re-authenticate.`
-        };
-      }
-      if (response.status === 403) {
-        return {
-          data: failureData,
-          error: `Forbidden (HTTP 403): ${errorCode}. This action isn't permitted for your account, plan, or scope \u2014 your connection is still valid.`
-        };
-      }
-      if (response.status === 429) {
-        const retryAfter = response.headers.get("retry-after") || "60";
-        return {
-          data: failureData,
-          error: `Rate limit exceeded (HTTP 429). Wait ${retryAfter}s before retrying. Reduce request frequency or upgrade your plan.`
-        };
-      }
-      return { data: failureData, error: errorCode };
-    }
-    try {
-      const data = JSON.parse(responseText);
-      return { data, error: null };
-    } catch {
-      return { data: { text: responseText }, error: null };
-    }
-  } catch (err) {
-    clearTimeout(timer);
-    if (err instanceof Error && err.name === "AbortError") {
-      return {
-        data: null,
-        error: `Edge Function '${functionName}' timed out after ${timeoutMs}ms`
-      };
-    }
-    return { data: null, error: "Network request failed. Please retry." };
+  const zw = detectZeroWidth(text);
+  if (zw.found) {
+    flagged.add(zw.pattern);
+    risk = Math.max(risk, 0.95);
+  }
+  const ipRaw = detectInstructionPhrase(text);
+  if (ipRaw.found) {
+    flagged.add(ipRaw.pattern);
+    risk = Math.max(risk, 0.9);
+  }
+  const normalized = normalize(text);
+  const ipNorm = detectInstructionPhrase(normalized);
+  if (ipNorm.found) {
+    flagged.add(ipNorm.pattern);
+    risk = Math.max(risk, 0.9);
+  }
+  const flaggedArr = Array.from(flagged);
+  if ((options.mode === "block" || options.mode === "sanitize") && flaggedArr.length > 0) {
+    return { passed: false, risk_score: risk, flagged_patterns: flaggedArr, pii_redacted: false };
+  }
+  const pii = scrubPii(normalized, options.source);
+  if (pii.redacted) {
+    return {
+      passed: true,
+      risk_score: Math.max(risk, 0.3),
+      flagged_patterns: [...flaggedArr, ...pii.patterns.map((p) => `pii_${p}`)],
+      sanitized_text: pii.text,
+      pii_redacted: true
+    };
   }
+  return { passed: true, risk_score: risk, flagged_patterns: flaggedArr, pii_redacted: false };
 }
-var SAFE_GATEWAY_ERROR_CODES, SAFE_BILLING_STATUSES, SAFE_JOB_STATUSES;
-var init_edge_function = __esm({
-  "src/lib/edge-function.ts"() {
+var init_scanner = __esm({
+  "src/lib/agent-harness/scanner.ts"() {
     "use strict";
-    init_supabase();
-    init_request_context();
-    SAFE_GATEWAY_ERROR_CODES = /* @__PURE__ */ new Set([
-      "daily_limit_reached",
-      "insufficient_credits",
-      "project_scope_mismatch",
-      "schedule_conflict",
-      "post_not_found",
-      "post_not_reschedulable",
-      "post_in_progress",
-      "not_cancellable",
-      "publishing_in_progress",
-      "plan_upgrade_required",
-      "rate_limited",
-      "validation_error",
-      "permission_denied",
-      "not_found"
-    ]);
-    SAFE_BILLING_STATUSES = /* @__PURE__ */ new Set([
-      "reserved",
-      "charged",
-      "refunded",
-      "failed_no_charge",
-      "refund_pending",
-      "not_charged"
-    ]);
-    SAFE_JOB_STATUSES = /* @__PURE__ */ new Set([
-      "queued",
-      "pending",
-      "processing",
-      "completed",
-      "failed",
-      "cancelled",
-      "canceled"
-    ]);
+    init_constants2();
+    init_normalize();
+    init_zeroWidth();
+    init_instructionPhrase();
+    init_pii();
   }
 });
 
@@ -2770,6 +2944,92 @@ var init_ideation = __esm({
   }
 });
 
+// src/lib/sanitize-error.ts
+function redactSensitiveIdentifiers(message) {
+  return message.replace(EMAIL_PATTERN, "[redacted-email]").replace(UUID_PATTERN, "[redacted-id]");
+}
+function sanitizeError(error) {
+  const msg = error instanceof Error ? error.message : typeof error === "string" ? error : "Unknown error";
+  for (const [pattern, userMessage] of ERROR_PATTERNS) {
+    if (pattern.test(msg)) {
+      return userMessage;
+    }
+  }
+  return "An unexpected error occurred. Please try again.";
+}
+var ERROR_PATTERNS, UUID_PATTERN, EMAIL_PATTERN;
+var init_sanitize_error = __esm({
+  "src/lib/sanitize-error.ts"() {
+    "use strict";
+    ERROR_PATTERNS = [
+      // Postgres / PostgREST
+      [
+        /PGRST301|permission denied/i,
+        "Access denied. Check your account permissions."
+      ],
+      [
+        /42P01|does not exist/i,
+        "Service temporarily unavailable. Please try again."
+      ],
+      [
+        /23505|unique.*constraint|duplicate key/i,
+        "A duplicate record already exists."
+      ],
+      [/23503|foreign key/i, "Referenced record not found."],
+      // Gemini / Google AI
+      [
+        /google.*api.*key|googleapis\.com.*40[13]/i,
+        "Content generation failed. Please try again."
+      ],
+      [
+        /RESOURCE_EXHAUSTED|quota.*exceeded|429.*google/i,
+        "AI service rate limit reached. Please wait and retry."
+      ],
+      [
+        /SAFETY|prompt.*blocked|content.*filter/i,
+        "Content was blocked by the AI safety filter. Try rephrasing."
+      ],
+      [
+        /gemini.*error|generativelanguage/i,
+        "Content generation failed. Please try again."
+      ],
+      // Kie.ai
+      [/kie\.ai|kieai|kie_api/i, "Media generation failed. Please try again."],
+      // Stripe
+      [
+        /stripe.*api|sk_live_|sk_test_/i,
+        "Payment processing error. Please try again."
+      ],
+      // Network / fetch
+      [
+        /ECONNREFUSED|ENOTFOUND|ETIMEDOUT|ECONNRESET/i,
+        "External service unavailable. Please try again."
+      ],
+      [
+        /fetch failed|network error|abort.*timeout/i,
+        "Network request failed. Please try again."
+      ],
+      [/CERT_|certificate|SSL|TLS/i, "Secure connection failed. Please try again."],
+      // Supabase Edge Function internals
+      [
+        /FunctionsHttpError|non-2xx status/i,
+        "Backend service error. Please try again."
+      ],
+      [
+        /JWT|token.*expired|token.*invalid/i,
+        "Authentication expired. Please re-authenticate."
+      ],
+      // Generic sensitive patterns (API keys, URLs with secrets)
+      [
+        /[a-z0-9]{32,}.*key|Bearer [a-zA-Z0-9._-]+/i,
+        "An internal error occurred. Please try again."
+      ]
+    ];
+    UUID_PATTERN = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi;
+    EMAIL_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+  }
+});
+
 // src/lib/checkStatusShape.ts
 function buildCheckStatusPayload(job, liveStatus) {
   const status = liveStatus?.status ?? job.status;
@@ -2865,9 +3125,22 @@ function checkCreditBudget(estimatedCost) {
   }
   const used = getCreditsUsed();
   if (used + estimatedCost > MAX_CREDITS_PER_RUN) {
+    const message = `Per-run credit cap reached \u2014 this is a local spend guard, not a server rate limit, so retrying will not help. The SOCIALNEURON_MAX_CREDITS_PER_RUN environment variable is set to ${MAX_CREDITS_PER_RUN} credits. This run has already spent ${used} credits and this call is estimated at ~${estimatedCost} more (${used} + ${estimatedCost} = ${used + estimatedCost} > ${MAX_CREDITS_PER_RUN}). To proceed, raise or unset SOCIALNEURON_MAX_CREDITS_PER_RUN.`;
     return {
       ok: false,
-      message: `Credit budget exceeded for this MCP run. Used=${used}, next~=${estimatedCost}, limit=${MAX_CREDITS_PER_RUN}.`
+      message,
+      error: toolError("billing_error", message, {
+        recover_with: [
+          "Raise SOCIALNEURON_MAX_CREDITS_PER_RUN to a higher credit ceiling.",
+          "Unset SOCIALNEURON_MAX_CREDITS_PER_RUN to remove the per-run cap."
+        ],
+        details: {
+          env_var: "SOCIALNEURON_MAX_CREDITS_PER_RUN",
+          credits_used_this_run: used,
+          estimated_call_cost: estimatedCost,
+          max_credits_per_run: MAX_CREDITS_PER_RUN
+        }
+      })
     };
   }
   return { ok: true };
@@ -2890,8 +3163,15 @@ var init_budget = __esm({
   "src/lib/budget.ts"() {
     "use strict";
     init_request_context();
-    MAX_CREDITS_PER_RUN = Math.max(0, Number(process.env.SOCIALNEURON_MAX_CREDITS_PER_RUN || 0));
-    MAX_ASSETS_PER_RUN = Math.max(0, Number(process.env.SOCIALNEURON_MAX_ASSETS_PER_RUN || 0));
+    init_tool_error();
+    MAX_CREDITS_PER_RUN = Math.max(
+      0,
+      Number(process.env.SOCIALNEURON_MAX_CREDITS_PER_RUN || 0)
+    );
+    MAX_ASSETS_PER_RUN = Math.max(
+      0,
+      Number(process.env.SOCIALNEURON_MAX_ASSETS_PER_RUN || 0)
+    );
     _globalCreditsUsed = 0;
     _globalAssetsGenerated = 0;
   }
@@ -2918,7 +3198,7 @@ function asEnvelope2(data) {
 function registerContentTools(server2) {
   server2.tool(
     "generate_video",
-    "Start an async AI video generation job \u2014 returns a job_id immediately. Poll with check_status every 10-30s until complete. Base credit costs (reference config; dynamic models scale with duration/audio/resolution): seedance-2-fast 264 (8s, best quality/credit) \xB7 kling-3 100 (5s no-audio) \xB7 grok-imagine 30 (6s, cheapest) \xB7 veo3-fast 65 (8s) \xB7 kling-3-pro 135 (5s no-audio) \xB7 seedance-2 328 (8s 720p) \xB7 veo3-quality 1000 (8s) \xB7 wan-2.6 105 (5s) \xB7 gemini-omni-video 126 (multi-reference composites) \xB7 hailuo-02-standard 180 / seedance-1.5-pro 150 / kling 170 (legacy/budget fallbacks). Costs are estimated pre-check and reconciled post-response from the actual charge. audio adds ~1.5x on kling-3/kling-3-pro and ~2.65x on kling (enable_audio defaults to FALSE). Check get_credit_balance first for expensive generations.",
+    "Start an async AI video generation job \u2014 returns a job_id immediately. Poll with check_status every 10-30s until complete. Base credit costs (reference config; dynamic models scale with duration/audio/resolution): seedance-2-fast 264 (8s, best quality/credit) \xB7 kling-3 100 (5s no-audio) \xB7 grok-imagine 30 (6s, cheapest) \xB7 veo3-fast 65 (8s) \xB7 kling-3-pro 135 (5s no-audio) \xB7 seedance-2 328 (8s 720p) \xB7 veo3-quality 1000 (8s) \xB7 wan-2.6 105 (5s) \xB7 gemini-omni-video 126 (multi-reference composites) \xB7 hailuo-02-standard 180 / seedance-1.5-pro 150 / kling 170 (legacy/budget fallbacks). Costs are estimated pre-check and reconciled post-response from the actual charge. audio adds ~1.5x on kling-3/kling-3-pro and ~2.65x on kling; enable_audio defaults to FALSE EXCEPT the seedance-2 family (seedance-2-fast, seedance-2) where audio is ON by default and its cost is already included. Check get_credit_balance first for expensive generations.",
     {
       prompt: z2.string().max(2500).describe(
         'Video prompt \u2014 be specific about visual style, camera movement, lighting, and mood. Example: "Aerial drone shot of coastal cliffs at golden hour, slow dolly forward, cinematic 24fps, warm color grading." Vague prompts produce generic results.'
@@ -2933,7 +3213,7 @@ function registerContentTools(server2) {
         "Video aspect ratio. 16:9 for YouTube/landscape, 9:16 for TikTok/Reels/Shorts, 1:1 for Instagram feed/square. Defaults to 16:9."
       ),
       enable_audio: z2.boolean().optional().describe(
-        "Enable native audio generation. DEFAULTS TO FALSE (cost control). Cost multiplier when true: kling 2.6 ~2.65x (17->45 cr/sec), kling-3 1.5x (20->30 cr/sec), kling-3-pro ~1.5x (27->40 cr/sec). seedance-2/-fast generate audio natively regardless. 5+ languages."
+        "Enable native audio generation. For most models this DEFAULTS TO FALSE (cost control). EXCEPTION: the seedance-2 family (seedance-2-fast, seedance-2) DEFAULTS TO TRUE \u2014 these generate audio natively and their credit cost already includes it, so audio is on unless you explicitly pass false. Cost multiplier when true on other models: kling 2.6 ~2.65x (17->45 cr/sec), kling-3 1.5x (20->30 cr/sec), kling-3-pro ~1.5x (27->40 cr/sec). 5+ languages."
       ),
       image_url: z2.string().optional().describe(
         "Start frame image URL for image-to-video (Kling 3.0 frame control)."
@@ -2969,12 +3249,12 @@ function registerContentTools(server2) {
       const estimatedCost = VIDEO_CREDIT_ESTIMATES[model] ?? 120;
       const budgetCheck = checkCreditBudget(estimatedCost);
       if (!budgetCheck.ok) {
-        return {
-          content: [{ type: "text", text: budgetCheck.message }],
-          isError: true
-        };
+        return budgetCheck.error;
       }
-      const rateLimit = checkRateLimit("generation", `generate_video:${userId}`);
+      const rateLimit = checkRateLimit(
+        "generation",
+        `generate_video:${userId}`
+      );
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -2993,9 +3273,12 @@ function registerContentTools(server2) {
           model,
           duration: duration ?? 5,
           aspectRatio: aspect_ratio ?? "16:9",
-          // Default FALSE (2026-07-13): the old `?? true` default silently multiplied
-          // kling-family costs (2.65x on kling 2.6) for callers that never asked for audio.
-          enableAudio: enable_audio ?? false,
+          // Default FALSE for most models (2026-07-13): the old `?? true` default silently
+          // multiplied kling-family costs (2.65x on kling 2.6) for callers that never asked
+          // for audio. Exception (2026-07-17): the seedance-2 family bills audio into its base
+          // cost and generates it natively, so a false default there shipped silent no-audio
+          // mp4s — those models default TRUE when the caller omits enable_audio.
+          enableAudio: enable_audio ?? AUDIO_NATIVE_DEFAULT_MODELS.has(model),
           ...image_url && { imageUrl: image_url },
           ...end_frame_url && { endFrameUrl: end_frame_url },
           // The server reads projectId and enforces
@@ -3097,7 +3380,14 @@ function registerContentTools(server2) {
       project_id: z2.string().optional().describe("Project ID to associate the generated image with."),
       response_format: z2.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ prompt: prompt2, model, aspect_ratio, image_url, project_id, response_format }) => {
+    async ({
+      prompt: prompt2,
+      model,
+      aspect_ratio,
+      image_url,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
       const userId = await getDefaultUserId();
       const assetBudget = checkAssetBudget();
@@ -3110,12 +3400,12 @@ function registerContentTools(server2) {
       const estimatedCost = IMAGE_CREDIT_ESTIMATES[model] ?? 30;
       const budgetCheck = checkCreditBudget(estimatedCost);
       if (!budgetCheck.ok) {
-        return {
-          content: [{ type: "text", text: budgetCheck.message }],
-          isError: true
-        };
+        return budgetCheck.error;
       }
-      const rateLimit = checkRateLimit("generation", `generate_image:${userId}`);
+      const rateLimit = checkRateLimit(
+        "generation",
+        `generate_image:${userId}`
+      );
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -3246,6 +3536,15 @@ function registerContentTools(server2) {
           isError: true
         };
       }
+      let projectsDisclosure;
+      const ownScopedProjectId = await getDefaultProjectId();
+      if (!ownScopedProjectId) {
+        const ownUserId = await getDefaultUserId().catch(() => null);
+        if (ownUserId) {
+          const list = await listAccessibleProjectsWithAccountStatus(ownUserId);
+          if (list.length > 0) projectsDisclosure = list;
+        }
+      }
       if (job.external_id && (job.status === "pending" || job.status === "processing")) {
         const { data: liveStatus } = await callEdgeFunction(
           "kie-task-status",
@@ -3269,15 +3568,25 @@ function registerContentTools(server2) {
           if (livePayload.error) {
             lines2.push(`Error: ${livePayload.error}`);
           }
-          const fallbackDisclosure2 = buildFallbackDisclosureLine(job.result_metadata);
+          const fallbackDisclosure2 = buildFallbackDisclosureLine(
+            job.result_metadata
+          );
           if (fallbackDisclosure2) lines2.push(fallbackDisclosure2);
           lines2.push(`Credits: ${job.credits_cost}`);
           if (job.billing_status) {
             lines2.push(
-              `Billing: ${job.billing_status} (charged ${job.credits_charged ?? 0}, refunded ${job.credits_refunded ?? 0})`
+              `Billing: ${job.billing_status} (charged ${job.credits_charged ?? 0}, refunded ${job.credits_refunded ?? 0})`
+            );
+          }
+          lines2.push(`Created: ${job.created_at}`);
+          if (projectsDisclosure) {
+            lines2.push(
+              "",
+              `Projects (project_id required elsewhere? pick one): ${projectsDisclosure.map(
+                (p) => `${p.name} (${p.id}${p.hasConnectedAccounts ? ", has connected accounts" : ""})`
+              ).join("; ")}`
             );
           }
-          lines2.push(`Created: ${job.created_at}`);
           if (format === "json") {
             return {
               content: [
@@ -3294,7 +3603,8 @@ function registerContentTools(server2) {
                     // `job` + `liveStatus`; do not duplicate them here.
                     asEnvelope2({
                       ...liveStatus,
-                      ...livePayload
+                      ...livePayload,
+                      ...projectsDisclosure ? { projects: projectsDisclosure } : {}
                     }),
                     null,
                     2
@@ -3335,9 +3645,11 @@ function registerContentTools(server2) {
         );
       }
       if (job.error_message) {
-        lines.push(`Error: ${job.error_message}`);
+        lines.push(`Error: ${redactSensitiveIdentifiers(job.error_message)}`);
       }
-      const fallbackDisclosure = buildFallbackDisclosureLine(job.result_metadata);
+      const fallbackDisclosure = buildFallbackDisclosureLine(
+        job.result_metadata
+      );
       if (fallbackDisclosure) lines.push(fallbackDisclosure);
       lines.push(`Credits: ${job.credits_cost}`);
       if (job.billing_status) {
@@ -3349,10 +3661,19 @@ function registerContentTools(server2) {
       if (job.completed_at) {
         lines.push(`Completed: ${job.completed_at}`);
       }
+      if (projectsDisclosure) {
+        lines.push(
+          "",
+          `Projects (project_id required elsewhere? pick one): ${projectsDisclosure.map(
+            (p) => `${p.name} (${p.id}${p.hasConnectedAccounts ? ", has connected accounts" : ""})`
+          ).join("; ")}`
+        );
+      }
       if (format === "json") {
         const enriched = {
           ...job,
-          ...buildCheckStatusPayload(job)
+          ...buildCheckStatusPayload(job),
+          ...projectsDisclosure ? { projects: projectsDisclosure } : {}
         };
         return {
           content: [
@@ -3478,10 +3799,7 @@ Return ONLY valid JSON in this exact format:
       const estimatedCost = 10;
       const budgetCheck = checkCreditBudget(estimatedCost);
       if (!budgetCheck.ok) {
-        return {
-          content: [{ type: "text", text: budgetCheck.message }],
-          isError: true
-        };
+        return budgetCheck.error;
       }
       const { data, error } = await callEdgeFunction(
         "social-neuron-ai",
@@ -3568,10 +3886,7 @@ Return ONLY valid JSON in this exact format:
       const estimatedCost = 15;
       const budgetCheck = checkCreditBudget(estimatedCost);
       if (!budgetCheck.ok) {
-        return {
-          content: [{ type: "text", text: budgetCheck.message }],
-          isError: true
-        };
+        return budgetCheck.error;
       }
       const rateLimit = checkRateLimit(
         "generation",
@@ -3734,10 +4049,7 @@ Return ONLY valid JSON in this exact format:
       const estimatedCost = 10 + slideCount * 2;
       const budgetCheck = checkCreditBudget(estimatedCost);
       if (!budgetCheck.ok) {
-        return {
-          content: [{ type: "text", text: budgetCheck.message }],
-          isError: true
-        };
+        return budgetCheck.error;
       }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit(
@@ -3840,13 +4152,14 @@ Return ONLY valid JSON in this exact format:
     }
   );
 }
-var VIDEO_CREDIT_ESTIMATES, VIDEO_MODEL_ENUM, IMAGE_CREDIT_ESTIMATES;
+var VIDEO_CREDIT_ESTIMATES, AUDIO_NATIVE_DEFAULT_MODELS, VIDEO_MODEL_ENUM, IMAGE_CREDIT_ESTIMATES;
 var init_content = __esm({
   "src/tools/content.ts"() {
     "use strict";
     init_edge_function();
     init_rate_limit();
     init_supabase();
+    init_sanitize_error();
     init_version();
     init_checkStatusShape();
     init_budget();
@@ -3864,6 +4177,10 @@ var init_content = __esm({
       "seedance-1.5-pro": 150,
       kling: 170
     };
+    AUDIO_NATIVE_DEFAULT_MODELS = /* @__PURE__ */ new Set([
+      "seedance-2-fast",
+      "seedance-2"
+    ]);
     VIDEO_MODEL_ENUM = [
       "seedance-2-fast",
       "kling-3",
@@ -3892,57 +4209,6 @@ var init_content = __esm({
   }
 });
 
-// src/lib/sanitize-error.ts
-function sanitizeError(error) {
-  const msg = error instanceof Error ? error.message : typeof error === "string" ? error : "Unknown error";
-  for (const [pattern, userMessage] of ERROR_PATTERNS) {
-    if (pattern.test(msg)) {
-      return userMessage;
-    }
-  }
-  return "An unexpected error occurred. Please try again.";
-}
-var ERROR_PATTERNS;
-var init_sanitize_error = __esm({
-  "src/lib/sanitize-error.ts"() {
-    "use strict";
-    ERROR_PATTERNS = [
-      // Postgres / PostgREST
-      [/PGRST301|permission denied/i, "Access denied. Check your account permissions."],
-      [/42P01|does not exist/i, "Service temporarily unavailable. Please try again."],
-      [/23505|unique.*constraint|duplicate key/i, "A duplicate record already exists."],
-      [/23503|foreign key/i, "Referenced record not found."],
-      // Gemini / Google AI
-      [/google.*api.*key|googleapis\.com.*40[13]/i, "Content generation failed. Please try again."],
-      [
-        /RESOURCE_EXHAUSTED|quota.*exceeded|429.*google/i,
-        "AI service rate limit reached. Please wait and retry."
-      ],
-      [
-        /SAFETY|prompt.*blocked|content.*filter/i,
-        "Content was blocked by the AI safety filter. Try rephrasing."
-      ],
-      [/gemini.*error|generativelanguage/i, "Content generation failed. Please try again."],
-      // Kie.ai
-      [/kie\.ai|kieai|kie_api/i, "Media generation failed. Please try again."],
-      // Stripe
-      [/stripe.*api|sk_live_|sk_test_/i, "Payment processing error. Please try again."],
-      // Network / fetch
-      [
-        /ECONNREFUSED|ENOTFOUND|ETIMEDOUT|ECONNRESET/i,
-        "External service unavailable. Please try again."
-      ],
-      [/fetch failed|network error|abort.*timeout/i, "Network request failed. Please try again."],
-      [/CERT_|certificate|SSL|TLS/i, "Secure connection failed. Please try again."],
-      // Supabase Edge Function internals
-      [/FunctionsHttpError|non-2xx status/i, "Backend service error. Please try again."],
-      [/JWT|token.*expired|token.*invalid/i, "Authentication expired. Please re-authenticate."],
-      // Generic sensitive patterns (API keys, URLs with secrets)
-      [/[a-z0-9]{32,}.*key|Bearer [a-zA-Z0-9._-]+/i, "An internal error occurred. Please try again."]
-    ];
-  }
-});
-
 // src/lib/ssrf.ts
 import { promises as dnsPromises } from "node:dns";
 function isBlockedIP(ip) {
@@ -4229,6 +4495,122 @@ var init_quality = __esm({
   }
 });
 
+// src/lib/connected-account-routing.ts
+function canonicalPlatform(value) {
+  const normalized = value.trim().toLowerCase();
+  return normalized === "x" ? "twitter" : normalized;
+}
+function providerPlatform(value) {
+  return PLATFORM_CASE_MAP[canonicalPlatform(value)] ?? value;
+}
+function isUsable(account) {
+  const status = account.effective_status ?? account.status;
+  return status === "active" || status === "expires_soon";
+}
+function normalizeRequestedIds(requested) {
+  const ids = /* @__PURE__ */ new Map();
+  for (const [platform3, accountId] of Object.entries(requested ?? {})) {
+    const canonical = canonicalPlatform(platform3);
+    const existing = ids.get(canonical);
+    if (existing && existing !== accountId) {
+      return {
+        error: `Conflicting account IDs were supplied for ${platform3} and its platform alias.`
+      };
+    }
+    ids.set(canonical, accountId);
+  }
+  return { ids };
+}
+async function resolveConnectedAccountRouting(input) {
+  const normalizedRequested = normalizeRequestedIds(input.requestedAccountIds);
+  if (normalizedRequested.error) return { error: normalizedRequested.error };
+  const targetPlatforms = new Set(input.platforms.map(canonicalPlatform));
+  for (const requestedPlatform of normalizedRequested.ids?.keys() ?? []) {
+    if (!targetPlatforms.has(requestedPlatform)) {
+      return {
+        error: `An account ID was supplied for untargeted platform ${requestedPlatform}.`
+      };
+    }
+  }
+  const { data, error } = await callEdgeFunction(
+    "mcp-data",
+    {
+      action: "connected-accounts",
+      projectId: input.projectId,
+      project_id: input.projectId
+    },
+    { timeoutMs: 1e4 }
+  );
+  if (error || !Array.isArray(data?.accounts)) {
+    return {
+      error: `Connected-account verification failed: ${error ?? data?.error ?? "no account inventory returned"}.`
+    };
+  }
+  const connectedAccountIds = {};
+  for (const platform3 of input.platforms) {
+    const canonical = canonicalPlatform(platform3);
+    const displayPlatform = providerPlatform(platform3);
+    const platformAccounts = data.accounts.filter(
+      (account) => canonicalPlatform(account.platform) === canonical && account.project_id === input.projectId && isUsable(account)
+    );
+    const requestedId = normalizedRequested.ids?.get(canonical);
+    let selected;
+    if (requestedId) {
+      selected = data.accounts.find((account) => account.id === requestedId);
+      if (!selected) {
+        return {
+          error: `${displayPlatform}: account ${requestedId} is not available for project_id ${input.projectId}.`
+        };
+      }
+      if (canonicalPlatform(selected.platform) !== canonical) {
+        return {
+          error: `${displayPlatform}: account ${requestedId} belongs to ${selected.platform}.`
+        };
+      }
+      if (selected.project_id !== input.projectId) {
+        return {
+          error: `${displayPlatform}: account ${requestedId} is not bound to project_id ${input.projectId}.`
+        };
+      }
+      if (!isUsable(selected)) {
+        return {
+          error: `${displayPlatform}: account ${requestedId} is ${selected.effective_status ?? selected.status}.`
+        };
+      }
+    } else if (platformAccounts.length === 1) {
+      selected = platformAccounts[0];
+    } else if (platformAccounts.length === 0) {
+      return {
+        error: `${displayPlatform}: no active account is bound to project_id ${input.projectId}.`
+      };
+    } else {
+      return {
+        error: `${displayPlatform}: multiple active accounts are bound to project_id ${input.projectId}; pass the exact account ID returned by list_connected_accounts.`
+      };
+    }
+    connectedAccountIds[displayPlatform] = selected.id;
+  }
+  return { connectedAccountIds };
+}
+var PLATFORM_CASE_MAP;
+var init_connected_account_routing = __esm({
+  "src/lib/connected-account-routing.ts"() {
+    "use strict";
+    init_edge_function();
+    PLATFORM_CASE_MAP = {
+      youtube: "YouTube",
+      tiktok: "TikTok",
+      instagram: "Instagram",
+      twitter: "Twitter",
+      x: "Twitter",
+      linkedin: "LinkedIn",
+      facebook: "Facebook",
+      threads: "Threads",
+      bluesky: "Bluesky"
+    };
+  }
+});
+
 // src/tools/distribution.ts
 import { z as z3 } from "zod";
 import { createHash } from "node:crypto";
@@ -4341,21 +4723,6 @@ async function validatePublishMediaUrl(url) {
 function accountEffectiveStatus(account) {
   return account.effective_status || account.status;
 }
-function isUsableAccount(account) {
-  const status = accountEffectiveStatus(account);
-  return status === "active" || status === "expires_soon";
-}
-function formatAccountChoice(account) {
-  const name = account.username ? `@${account.username}` : "unnamed";
-  const project = account.project_id ? `project_id=${account.project_id}` : "project_id=unassigned";
-  const refresh = account.has_refresh_token ? "OAuth 2.0 refresh" : "no refresh token";
-  return `${account.id} (${name}, ${project}, ${accountEffectiveStatus(account)}, ${refresh})`;
-}
-function requestedAccountIdForPlatform(accountId, accountIds, platform3) {
-  if (accountId) return accountId;
-  if (!accountIds) return void 0;
-  return accountIds[platform3] || accountIds[platform3.toLowerCase()];
-}
 async function rehostExternalUrl(mediaUrl, projectId) {
   const ssrf = await validateUrlForSSRF(mediaUrl);
   if (!ssrf.isValid) {
@@ -4491,17 +4858,17 @@ function registerDistributionTools(server2) {
       schedule_at: z3.string().optional().describe(
         'ISO 8601 UTC datetime for scheduled posting (e.g. "2026-03-20T14:00:00Z"). Omit to post immediately. Must be in the future.'
       ),
-      project_id: z3.string().optional().describe(
+      project_id: z3.string().uuid().optional().describe(
         "Social Neuron brand/project ID to associate this post with. Provide this when the account has multiple brands so brand voice and connected account routing stay scoped to the right brand."
       ),
       response_format: z3.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text."),
       attribution: z3.boolean().optional().describe(
         'If true, appends "Created with Social Neuron" to the caption. Default: false.'
       ),
-      account_id: z3.string().optional().describe(
-        "Connected account ID to post from. Use list_connected_accounts to find the right ID. Required when multiple accounts exist for the same platform. If project_id is provided, the account must belong to that project or be unassigned."
+      account_id: z3.string().uuid().optional().describe(
+        "Connected account ID to post from. Optional when the resolved project has exactly one active account for the target platform \u2014 it is auto-bound. Required (with a clear error listing candidates) when multiple accounts exist for the same platform. Use list_connected_accounts to find the right ID. The account must be active and bound to the exact project_id."
       ),
-      account_ids: z3.record(z3.string(), z3.string()).optional().describe(
+      account_ids: z3.record(z3.string(), z3.string().uuid()).optional().describe(
         'Per-platform account IDs when posting to multiple platforms. Example: {"twitter": "abc123", "instagram": "def456"}. Use list_connected_accounts with the same project_id to find IDs.'
       ),
       auto_rehost: z3.boolean().optional().describe(
@@ -4545,6 +4912,45 @@ function registerDistributionTools(server2) {
           isError: true
         };
       }
+      const projectResolution = await resolveProjectForConnectedAccountTool(
+        project_id,
+        platforms
+      );
+      if (!projectResolution.projectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: projectResolution.error ?? "A project_id is required for publishing. Configure an explicit project or use an API key that is scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolvedProjectId = projectResolution.projectId;
+      const projectAutoResolvedNote = projectResolution.autoResolvedNote;
+      if (account_id && account_ids) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "Pass either account_id or account_ids, not both."
+            }
+          ],
+          isError: true
+        };
+      }
+      if (account_id && platforms.length !== 1) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "account_id is valid only for a single target platform. Use account_ids for multi-platform publishing."
+            }
+          ],
+          isError: true
+        };
+      }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("posting", `schedule_post:${userId}`);
       if (!rateLimit.allowed) {
@@ -4649,11 +5055,16 @@ function registerDistributionTools(server2) {
           }
           const resolvedJobs = resolved;
           resolvedMediaUrls = resolvedJobs.map((item) => item.url);
-          resolvedMediaUrlsAreTrustedR2 = resolvedJobs.map((item) => item.trustedR2);
+          resolvedMediaUrlsAreTrustedR2 = resolvedJobs.map(
+            (item) => item.trustedR2
+          );
         }
         const shouldRehost = auto_rehost !== false;
         if (shouldRehost && resolvedMediaUrl && !resolvedMediaUrlIsTrustedR2) {
-          const rehost = await rehostExternalUrl(resolvedMediaUrl, project_id);
+          const rehost = await rehostExternalUrl(
+            resolvedMediaUrl,
+            resolvedProjectId
+          );
           if ("error" in rehost) {
             return {
               content: [
@@ -4671,7 +5082,7 @@ function registerDistributionTools(server2) {
         if (shouldRehost && resolvedMediaUrls && resolvedMediaUrls.length > 0) {
           const rehosted = await Promise.all(
             resolvedMediaUrls.map(
-              (u, index) => resolvedMediaUrlsAreTrustedR2[index] ? Promise.resolve({ signedUrl: u, r2Key: "" }) : rehostExternalUrl(u, project_id)
+              (u, index) => resolvedMediaUrlsAreTrustedR2[index] ? Promise.resolve({ signedUrl: u, r2Key: "" }) : rehostExternalUrl(u, resolvedProjectId)
             )
           );
           const failIdx = rehosted.findIndex((r) => "error" in r);
@@ -4738,7 +5149,7 @@ function registerDistributionTools(server2) {
         }
       }
       const normalizedPlatforms = platforms.map(
-        (p) => PLATFORM_CASE_MAP[p.toLowerCase()] || p
+        (p) => PLATFORM_CASE_MAP2[p.toLowerCase()] || p
       );
       const blockedPlatforms = normalizedPlatforms.filter(
         (p) => MCP_NOT_LIVE_FOR_POSTING.has(p)
@@ -4754,92 +5165,27 @@ function registerDistributionTools(server2) {
           isError: true
         };
       }
-      const { data: accountsData } = await callEdgeFunction(
-        "mcp-data",
-        {
-          action: "connected-accounts",
-          ...project_id ? { projectId: project_id, project_id } : {}
-        },
-        { timeoutMs: 1e4 }
-      );
-      if (accountsData?.accounts) {
-        const accounts = accountsData.accounts;
-        const issues = [];
-        for (const platform3 of normalizedPlatforms) {
-          const platformAccounts = accounts.filter(
-            (a) => a.platform.toLowerCase() === platform3.toLowerCase() && isUsableAccount(a)
-          );
-          const requestedAccountId = requestedAccountIdForPlatform(
-            account_id,
-            account_ids,
-            platform3
-          );
-          if (requestedAccountId) {
-            const selected = accounts.find((a) => a.id === requestedAccountId);
-            if (!selected) {
-              issues.push(
-                `${platform3}: Account "${requestedAccountId}" is not available${project_id ? ` for project_id ${project_id}` : ""}. Call \`list_connected_accounts\`${project_id ? " with the same project_id" : ""} and choose one of the returned IDs.`
-              );
-            } else if (selected.platform.toLowerCase() !== platform3.toLowerCase()) {
-              issues.push(
-                `${platform3}: Account "${requestedAccountId}" belongs to ${selected.platform}, not ${platform3}.`
-              );
-            } else if (!isUsableAccount(selected)) {
-              issues.push(
-                `${platform3}: Account "${selected.username || selected.id}" is ${accountEffectiveStatus(selected)}. Reconnect at socialneuron.com/settings/connections.`
-              );
-            } else if (project_id && selected.project_id && selected.project_id !== project_id) {
-              issues.push(
-                `${platform3}: Account "${selected.username || selected.id}" is bound to project_id ${selected.project_id}, not ${project_id}. Use the selected brand's account or reconnect/assign it in Settings > Integrations.`
-              );
-            }
-            continue;
-          }
-          if (platformAccounts.length === 0) {
-            issues.push(
-              `${platform3}: not connected yet. This is a one-time browser setup on socialneuron.com \u2014 NOT another OAuth in Claude. Call \`start_platform_connection\` with platform="${platform3.toLowerCase()}"${project_id ? ` and project_id="${project_id}"` : ""} to get a deep link, ask the user to open it in their browser and approve on the platform, then call \`wait_for_connection\` before retrying schedule_post.`
-            );
-          } else if (platformAccounts.length > 1) {
-            const accountList = platformAccounts.map((a) => `  - ${formatAccountChoice(a)}`).join("\n");
-            issues.push(
-              `${platform3}: Multiple accounts found. Specify account_id or account_ids to choose:
-${accountList}`
-            );
-          } else if (platformAccounts.length === 1) {
-            const acct = platformAccounts[0];
-            if (acct.expires_at && new Date(acct.expires_at) < /* @__PURE__ */ new Date() && !acct.has_refresh_token) {
-              issues.push(
-                `${platform3}: Account "${acct.username || acct.id}" has expired OAuth and no refresh token. Reconnect at socialneuron.com/settings/connections.`
-              );
-            }
-          }
-        }
-        if (issues.length > 0) {
-          return {
-            content: [
-              {
-                type: "text",
-                text: `Cannot post \u2014 account issues found:
-
-${issues.join("\n\n")}`
-              }
-            ],
-            isError: true
-          };
-        }
-      }
-      let connectedAccountIds;
+      let requestedAccountIds;
       if (account_id) {
-        connectedAccountIds = {};
-        for (const p of normalizedPlatforms) {
-          connectedAccountIds[p] = account_id;
-        }
+        requestedAccountIds = { [normalizedPlatforms[0]]: account_id };
       } else if (account_ids) {
-        connectedAccountIds = {};
-        for (const [key, val] of Object.entries(account_ids)) {
-          const normalizedKey = PLATFORM_CASE_MAP[key.toLowerCase()] || key;
-          connectedAccountIds[normalizedKey] = val;
-        }
+        requestedAccountIds = account_ids;
+      }
+      const routing = await resolveConnectedAccountRouting({
+        projectId: resolvedProjectId,
+        platforms: normalizedPlatforms,
+        requestedAccountIds
+      });
+      if (routing.error || !routing.connectedAccountIds) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Cannot post \u2014 ${routing.error ?? "exact connected-account routing could not be established."}`
+            }
+          ],
+          isError: true
+        };
       }
       let finalCaption = caption;
       if (attribution && finalCaption) {
@@ -4893,8 +5239,9 @@ Created with Social Neuron`;
           title,
           hashtags,
           scheduledAt: schedule_at,
-          projectId: project_id,
-          ...connectedAccountIds ? { connectedAccountIds } : {},
+          projectId: resolvedProjectId,
+          project_id: resolvedProjectId,
+          connectedAccountIds: routing.connectedAccountIds,
           ...normalizedPlatformMetadata ? {
             platformMetadata: convertPlatformMetadata(
               normalizedPlatformMetadata
@@ -4929,10 +5276,14 @@ Created with Social Neuron`;
           isError: true
         };
       }
+      const responseData = projectAutoResolvedNote ? { ...data, project_auto_resolved: projectAutoResolvedNote } : data;
       const lines = [
         data.success ? "Post scheduled successfully." : "Post scheduling had errors.",
         `Scheduled for: ${data.scheduledAt}`
       ];
+      if (projectAutoResolvedNote) {
+        lines.push("", `Note: ${projectAutoResolvedNote}`);
+      }
       if (tiktokAutoInboxApplied) {
         lines.push(
           "",
@@ -4950,7 +5301,7 @@ Created with Social Neuron`;
         }
       }
       if (format === "json") {
-        const structuredContent = asEnvelope3(data);
+        const structuredContent = asEnvelope3(responseData);
         return {
           structuredContent,
           content: [
@@ -4963,7 +5314,7 @@ Created with Social Neuron`;
         };
       }
       return {
-        structuredContent: asEnvelope3(data),
+        structuredContent: asEnvelope3(responseData),
         content: [{ type: "text", text: lines.join("\n") }],
         isError: !data.success
       };
@@ -4977,7 +5328,9 @@ Created with Social Neuron`;
       project_id: z3.string().uuid().optional().describe(
         "Brand/project ID that owns the post. Defaults to the authenticated key's project or the account default."
       ),
-      scheduled_at: z3.string().datetime({ offset: true }).describe("New future publish time as an ISO 8601 datetime with timezone."),
+      scheduled_at: z3.string().datetime({ offset: true }).describe(
+        "New future publish time as an ISO 8601 datetime with timezone."
+      ),
       expected_scheduled_at: z3.string().datetime({ offset: true }).optional().describe(
         "Optional current schedule timestamp. If it changed since you read it, the update is rejected instead of silently overwriting it."
       ),
@@ -5033,7 +5386,11 @@ Created with Social Neuron`;
         projectId: resolvedProjectId,
         project_id: resolvedProjectId,
         scheduled_at: next.toISOString(),
-        ...expected_scheduled_at ? { expected_scheduled_at: new Date(expected_scheduled_at).toISOString() } : {}
+        ...expected_scheduled_at ? {
+          expected_scheduled_at: new Date(
+            expected_scheduled_at
+          ).toISOString()
+        } : {}
       });
       if (error || !result?.success) {
         const code = result?.error ?? error ?? "reschedule_failed";
@@ -5066,17 +5423,34 @@ Created with Social Neuron`;
     "list_connected_accounts",
     "Check which social platforms have active OAuth connections for posting. Call this before schedule_post to verify credentials. Pass project_id to list the accounts for a specific brand/project, then pass the returned account id as account_id/account_ids when posting. If a platform is missing or expired, the user needs to reconnect at socialneuron.com/settings/connections.",
     {
-      project_id: z3.string().optional().describe(
+      project_id: z3.string().uuid().optional().describe(
         "Brand/project ID to scope connected accounts. Use the same project_id when calling schedule_post."
       ),
-      include_all: z3.boolean().optional().describe("If true, include expired or inactive accounts as well as usable accounts."),
+      include_all: z3.boolean().optional().describe(
+        "If true, include expired or inactive accounts as well as usable accounts."
+      ),
       response_format: z3.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
     async ({ project_id, include_all, response_format }) => {
       const format = response_format ?? "text";
+      const projectResolution = await resolveProjectForConnectedAccountTool(project_id);
+      if (!projectResolution.projectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: projectResolution.error ?? "A project_id is required to list connected accounts. Configure an explicit project or use an API key scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolvedProjectId = projectResolution.projectId;
+      const projectAutoResolvedNote = projectResolution.autoResolvedNote;
       const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
         action: "connected-accounts",
-        ...project_id ? { projectId: project_id, project_id } : {},
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId,
         ...include_all ? { includeAll: true } : {}
       });
       if (efError || !result?.success) {
@@ -5090,10 +5464,27 @@ Created with Social Neuron`;
           isError: true
         };
       }
-      const accounts = (result.accounts ?? []).map(publicConnectedAccount).filter((account) => account !== null);
+      const parsedAccounts = (result.accounts ?? []).map(publicConnectedAccount).filter((account) => account !== null);
+      if (parsedAccounts.some(
+        (account) => account.project_id !== resolvedProjectId
+      )) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "Connected-account project attestation failed. No account inventory was returned."
+            }
+          ],
+          isError: true
+        };
+      }
+      const accounts = parsedAccounts;
       if (accounts.length === 0) {
         if (format === "json") {
-          const structuredContent = asEnvelope3({ accounts: [] });
+          const structuredContent = asEnvelope3({
+            accounts: [],
+            ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
+          });
           return {
             structuredContent,
             content: [
@@ -5108,13 +5499,15 @@ Created with Social Neuron`;
           content: [
             {
               type: "text",
-              text: "No connected social media accounts found. Connect platforms in Social Neuron Settings > Connections."
+              text: "No connected social media accounts found. Connect platforms in Social Neuron Settings > Connections." + (projectAutoResolvedNote ? `
+
+Note: ${projectAutoResolvedNote}` : "")
             }
           ]
         };
       }
       const lines = [
-        `${accounts.length} connected account(s)${project_id ? ` for project ${project_id}` : ""}:`,
+        `${accounts.length} connected account(s) for project ${resolvedProjectId}:`,
         ""
       ];
       for (const account of accounts) {
@@ -5126,8 +5519,14 @@ Created with Social Neuron`;
           `  ${platformLower}: ${name} | id=${account.id} | ${project} | status=${status} (connected ${account.created_at.split("T")[0]})`
         );
       }
+      if (projectAutoResolvedNote) {
+        lines.push("", `Note: ${projectAutoResolvedNote}`);
+      }
       if (format === "json") {
-        const structuredContent = asEnvelope3({ accounts });
+        const structuredContent = asEnvelope3({
+          accounts,
+          ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
+        });
         return {
           structuredContent,
           content: [
@@ -5322,7 +5721,10 @@ Created with Social Neuron`;
         if (!Number.isFinite(startDate.getTime())) {
           return {
             content: [
-              { type: "text", text: "start_after must be a valid ISO datetime." }
+              {
+                type: "text",
+                text: "start_after must be a valid ISO datetime."
+              }
             ],
             isError: true
           };
@@ -5423,11 +5825,14 @@ Created with Social Neuron`;
     "Schedule all posts in a content plan. Optionally auto-assigns time slots and runs quality checks before scheduling. Supports dry-run mode.",
     {
       plan: z3.object({
+        project_id: z3.string().uuid().optional(),
+        account_ids: z3.record(z3.string(), z3.string().uuid()).optional().describe("Exact connected-account ID per platform."),
         posts: z3.array(
           z3.object({
             id: z3.string(),
             caption: z3.string(),
             platform: z3.string(),
+            connected_account_id: z3.string().uuid().optional(),
             title: z3.string().optional(),
             media_url: z3.string().optional(),
             schedule_at: z3.string().optional(),
@@ -5435,6 +5840,12 @@ Created with Social Neuron`;
           })
         )
       }).passthrough().optional(),
+      project_id: z3.string().uuid().optional().describe(
+        "Exact brand/project ID. Defaults only when the authenticated user has one project."
+      ),
+      account_ids: z3.record(z3.string(), z3.string().uuid()).optional().describe(
+        "Exact connected-account ID per platform for every post in the plan."
+      ),
       plan_id: z3.string().uuid().optional().describe("Persisted content plan ID from content_plans table"),
       auto_slot: z3.boolean().default(true).describe("Auto-assign time slots for posts without schedule_at"),
       dry_run: z3.boolean().default(false).describe("Preview without actually scheduling"),
@@ -5451,6 +5862,8 @@ Created with Social Neuron`;
     async ({
       plan,
       plan_id,
+      project_id,
+      account_ids,
       auto_slot,
       dry_run,
       response_format,
@@ -5460,9 +5873,11 @@ Created with Social Neuron`;
       idempotency_seed
     }) => {
       try {
+        const effectiveBatchSize = batch_size ?? 4;
         let workingPlan = plan;
         let effectivePlanId = plan_id;
-        let effectiveProjectId;
+        let effectiveProjectId = project_id;
+        let projectAutoResolvedNote;
         let approvalSummary;
         if (!workingPlan && plan_id) {
           const { data: planResult, error: planError } = await callEdgeFunction("mcp-data", { action: "get-content-plan", plan_id });
@@ -5509,23 +5924,59 @@ Created with Social Neuron`;
             posts: postsFromPayload
           };
           effectivePlanId = stored.id;
-          effectiveProjectId = stored.project_id ?? void 0;
+          if (effectiveProjectId && stored.project_id && effectiveProjectId !== stored.project_id) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `project_id ${effectiveProjectId} does not own plan ${plan_id}.`
+                }
+              ],
+              isError: true
+            };
+          }
+          effectiveProjectId = stored.project_id ?? effectiveProjectId;
         }
         if (!workingPlan) {
           return {
             content: [
               {
                 type: "text",
-                text: "Provide either `plan` (inline) or `plan_id` (persisted) to schedule content."
+                text: "Provide either `plan` (inline) or `plan_id` (persisted) to schedule content."
+              }
+            ],
+            isError: true
+          };
+        }
+        const planProjectId = workingPlan.project_id;
+        if (effectiveProjectId && typeof planProjectId === "string" && planProjectId.length > 0 && effectiveProjectId !== planProjectId) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Conflicting project_id values were supplied for the plan (${planProjectId}) and request (${effectiveProjectId}).`
               }
             ],
             isError: true
           };
         }
+        if (!effectiveProjectId && typeof planProjectId === "string" && planProjectId.length > 0) {
+          effectiveProjectId = planProjectId;
+        }
         if (!effectiveProjectId) {
-          const planProjectId = workingPlan.project_id;
-          if (typeof planProjectId === "string" && planProjectId.length > 0) {
-            effectiveProjectId = planProjectId;
+          const projectResolution = await resolveProjectForConnectedAccountTool();
+          effectiveProjectId = projectResolution.projectId;
+          projectAutoResolvedNote = projectResolution.autoResolvedNote;
+          if (!effectiveProjectId) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: projectResolution.error ?? "A project_id is required to schedule a content plan. Configure an explicit project or use an API key scoped to exactly one project."
+                }
+              ],
+              isError: true
+            };
           }
         }
         if (effectivePlanId) {
@@ -5744,6 +6195,61 @@ Created with Social Neuron`;
             isError: false
           };
         }
+        const embeddedAccountIds = workingPlan.account_ids ?? {};
+        for (const [platform3, accountId] of Object.entries(account_ids ?? {})) {
+          if (embeddedAccountIds[platform3] && embeddedAccountIds[platform3] !== accountId) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `Conflicting account_ids values were supplied for ${platform3}.`
+                }
+              ],
+              isError: true
+            };
+          }
+        }
+        const requestedPlanAccountIds = {
+          ...embeddedAccountIds,
+          ...account_ids ?? {}
+        };
+        for (const post of workingPlan.posts) {
+          if (!post.connected_account_id) continue;
+          const key = post.platform.toLowerCase() === "x" ? "twitter" : post.platform.toLowerCase();
+          const existing = requestedPlanAccountIds[key];
+          if (existing && existing !== post.connected_account_id) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `Plan contains conflicting connected_account_id values for ${post.platform}. Use separate plans when scheduling the same platform through different accounts.`
+                }
+              ],
+              isError: true
+            };
+          }
+          requestedPlanAccountIds[key] = post.connected_account_id;
+        }
+        const planPlatforms = Array.from(
+          new Set(workingPlan.posts.map((post) => post.platform))
+        );
+        const planRouting = await resolveConnectedAccountRouting({
+          projectId: effectiveProjectId,
+          platforms: planPlatforms,
+          requestedAccountIds: requestedPlanAccountIds
+        });
+        if (planRouting.error || !planRouting.connectedAccountIds) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Cannot schedule plan \u2014 ${planRouting.error ?? "exact connected-account routing could not be established."}`
+              }
+            ],
+            isError: true
+          };
+        }
+        const verifiedPlanAccountIds = planRouting.connectedAccountIds;
         let scheduled = 0;
         let failed = 0;
         const results = [];
@@ -5772,7 +6278,7 @@ Created with Social Neuron`;
               retryable: false
             };
           }
-          const normalizedPlatform = PLATFORM_CASE_MAP[post.platform.toLowerCase()] ?? post.platform;
+          const normalizedPlatform = PLATFORM_CASE_MAP2[post.platform.toLowerCase()] ?? post.platform;
           const idempotencyKey = buildIdempotencyKey(post);
           const { data, error } = await callEdgeFunction(
             "schedule-post",
@@ -5783,6 +6289,13 @@ Created with Social Neuron`;
               mediaUrl: post.media_url,
               scheduledAt: post.schedule_at,
               hashtags: post.hashtags,
+              ...effectiveProjectId ? {
+                projectId: effectiveProjectId,
+                project_id: effectiveProjectId
+              } : {},
+              connectedAccountIds: {
+                [normalizedPlatform]: verifiedPlanAccountIds[normalizedPlatform]
+              },
               ...effectivePlanId ? { planId: effectivePlanId } : {},
               idempotencyKey
             },
@@ -5841,7 +6354,7 @@ Created with Social Neuron`;
         const platformBatches = Array.from(grouped.entries()).map(
           async ([platform3, platformPosts]) => {
             const platformResults = [];
-            const batches = chunk(platformPosts, batch_size);
+            const batches = chunk(platformPosts, effectiveBatchSize);
             for (const batch of batches) {
               const settled = await Promise.allSettled(
                 batch.map((post) => scheduleOne(post))
@@ -5902,7 +6415,8 @@ Created with Social Neuron`;
                       total_posts: workingPlan.posts.length,
                       scheduled,
                       failed
-                    }
+                    },
+                    ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
                   }),
                   null,
                   2
@@ -5926,6 +6440,9 @@ Created with Social Neuron`;
         lines.push(
           `Scheduled: ${scheduled}/${workingPlan.posts.length} | Failed: ${failed}/${workingPlan.posts.length}`
         );
+        if (projectAutoResolvedNote) {
+          lines.push("", `Note: ${projectAutoResolvedNote}`);
+        }
         return {
           content: [{ type: "text", text: lines.join("\n") }],
           isError: failed > 0
@@ -5945,7 +6462,7 @@ Created with Social Neuron`;
     }
   );
 }
-var PLATFORM_CASE_MAP, TIKTOK_AUDIT_APPROVED, MCP_NOT_LIVE_FOR_POSTING, VIDEO_FILE_EXTENSIONS, IMAGE_FILE_EXTENSIONS;
+var PLATFORM_CASE_MAP2, TIKTOK_AUDIT_APPROVED, MCP_NOT_LIVE_FOR_POSTING, VIDEO_FILE_EXTENSIONS, IMAGE_FILE_EXTENSIONS;
 var init_distribution = __esm({
   "src/tools/distribution.ts"() {
     "use strict";
@@ -5956,11 +6473,17 @@ var init_distribution = __esm({
     init_supabase();
     init_quality();
     init_version();
-    PLATFORM_CASE_MAP = {
+    init_connected_account_routing();
+    PLATFORM_CASE_MAP2 = {
       youtube: "YouTube",
       tiktok: "TikTok",
       instagram: "Instagram",
       twitter: "Twitter",
+      // 'x' is the platform's current branding but connected_account_routing.ts
+      // (and the DB convention) still key on 'Twitter' — keep both aliases
+      // resolving to the same case so schedule_content_plan's platform:'x' posts
+      // don't fall through to an undefined binding (F8, 2026-07-15).
+      x: "Twitter",
       linkedin: "LinkedIn",
       facebook: "Facebook",
       threads: "Threads",
@@ -6502,15 +7025,35 @@ function registerAnalyticsTools(server2) {
       content_id: z5.string().uuid().optional().describe(
         "Filter to a specific content_history ID to see performance of one piece of content."
       ),
-      project_id: z5.string().optional().describe("Project ID. Defaults to the active project context."),
+      project_id: z5.string().uuid().optional().describe("Project ID. Defaults to the active project context."),
       limit: z5.number().min(1).max(100).optional().describe("Maximum number of posts to return. Defaults to 20."),
       response_format: z5.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ platform: platform3, days, content_id, project_id, limit, response_format }) => {
+    async ({
+      platform: platform3,
+      days,
+      content_id,
+      project_id,
+      limit,
+      response_format
+    }) => {
       const format = response_format ?? "text";
       const lookbackDays = days ?? 30;
       const maxPosts = limit ?? 20;
-      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      const projectResolution = await resolveProjectStrict(project_id);
+      if (!projectResolution.projectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: projectResolution.error ?? "A project_id is required to fetch analytics. Configure an explicit project or use an API key scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolvedProjectId = projectResolution.projectId;
+      const projectAutoResolvedNote = projectResolution.autoResolvedNote;
       const { data: result, error: efError } = await callEdgeFunction("mcp-data", {
         action: "analytics",
         platform: platform3,
@@ -6521,11 +7064,17 @@ function registerAnalyticsTools(server2) {
         limit: Math.min(maxPosts * 5, 100),
         latestOnly: true,
         contentId: content_id,
-        ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId
       });
       if (efError) {
         return {
-          content: [{ type: "text", text: `Failed to fetch analytics: ${efError}` }],
+          content: [
+            {
+              type: "text",
+              text: `Failed to fetch analytics: ${efError}`
+            }
+          ],
           isError: true
         };
       }
@@ -6545,7 +7094,8 @@ function registerAnalyticsTools(server2) {
             totalViews: 0,
             totalEngagement: 0,
             postCount: 0,
-            posts: []
+            posts: [],
+            ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
           });
           return {
             structuredContent,
@@ -6561,7 +7111,9 @@ function registerAnalyticsTools(server2) {
           content: [
             {
               type: "text",
-              text: `No analytics data found for the last ${lookbackDays} days${platform3 ? ` on ${platform3}` : ""}.`
+              text: `No analytics data found for the last ${lookbackDays} days${platform3 ? ` on ${platform3}` : ""}.` + (projectAutoResolvedNote ? `
+
+Note: ${projectAutoResolvedNote}` : "")
             }
           ]
         };
@@ -6593,20 +7145,27 @@ function registerAnalyticsTools(server2) {
         postCount: posts.length,
         posts
       };
-      return formatAnalytics(summary, lookbackDays, format);
+      return formatAnalytics(
+        summary,
+        lookbackDays,
+        format,
+        projectAutoResolvedNote
+      );
     }
   );
   server2.tool(
     "refresh_platform_analytics",
     "Queue analytics refresh jobs for posts from the last 7 days in one project across its connected platforms. Call this before fetch_analytics if you need fresh data. Returns immediately \u2014 data updates asynchronously over the next 1-5 minutes.",
     {
-      project_id: z5.string().optional().describe("Project ID. Defaults to the active project context."),
+      project_id: z5.string().uuid().optional().describe("Project ID. Defaults to the active project context."),
       response_format: z5.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
     async ({ project_id, response_format }) => {
       const format = response_format ?? "text";
       const userId = await getDefaultUserId();
-      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      const projectResolution = await resolveProjectStrict(project_id);
+      const resolvedProjectId = projectResolution.projectId;
+      const projectAutoResolvedNote = projectResolution.autoResolvedNote;
       const rateLimit = checkRateLimit(
         "posting",
         `refresh_platform_analytics:${userId}:${resolvedProjectId ?? "default"}`
@@ -6622,25 +7181,48 @@ function registerAnalyticsTools(server2) {
           isError: true
         };
       }
+      if (!resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: projectResolution.error ?? "A project_id is required to refresh analytics. Configure an explicit project or use an API key scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
       const { data, error } = await callEdgeFunction("fetch-analytics", {
         userId,
-        ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error refreshing analytics: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Error refreshing analytics: ${error}`
+            }
+          ],
           isError: true
         };
       }
       const result = data;
       if (!result.success) {
         return {
-          content: [{ type: "text", text: "Analytics refresh failed." }],
+          content: [
+            { type: "text", text: "Analytics refresh failed." }
+          ],
           isError: true
         };
       }
-      const queued = (result.results ?? []).filter((r) => r.status === "queued").length;
-      const errored = (result.results ?? []).filter((r) => r.status === "error").length;
+      const queued = (result.results ?? []).filter(
+        (r) => r.status === "queued"
+      ).length;
+      const errored = (result.results ?? []).filter(
+        (r) => r.status === "error"
+      ).length;
       const lines = [
         `Analytics refresh triggered successfully.`,
         `  Posts processed: ${result.postsProcessed}`,
@@ -6649,13 +7231,17 @@ function registerAnalyticsTools(server2) {
       if (errored > 0) {
         lines.push(`  Errors: ${errored}`);
       }
+      if (projectAutoResolvedNote) {
+        lines.push("", `Note: ${projectAutoResolvedNote}`);
+      }
       if (format === "json") {
         const structuredContent = asEnvelope4({
           success: true,
           postsProcessed: result.postsProcessed,
           queued,
           errored,
-          projectId: resolvedProjectId ?? null
+          projectId: resolvedProjectId ?? null,
+          ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
         });
         return {
           structuredContent,
@@ -6671,12 +7257,21 @@ function registerAnalyticsTools(server2) {
     }
   );
 }
-function formatAnalytics(summary, days, format) {
-  const structuredContent = asEnvelope4({ ...summary, days });
+function formatAnalytics(summary, days, format, projectAutoResolvedNote) {
+  const structuredContent = asEnvelope4({
+    ...summary,
+    days,
+    ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
+  });
   if (format === "json") {
     return {
       structuredContent,
-      content: [{ type: "text", text: JSON.stringify(structuredContent, null, 2) }]
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(structuredContent, null, 2)
+        }
+      ]
     };
   }
   const lines = [
@@ -6700,6 +7295,9 @@ function formatAnalytics(summary, days, format) {
       lines.push(line);
     }
   }
+  if (projectAutoResolvedNote) {
+    lines.push("", `Note: ${projectAutoResolvedNote}`);
+  }
   return {
     structuredContent,
     content: [{ type: "text", text: lines.join("\n") }]
@@ -8129,15 +8727,64 @@ function registerYouTubeAnalyticsTools(server2) {
       start_date: z10.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("Start date in YYYY-MM-DD format."),
       end_date: z10.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("End date in YYYY-MM-DD format."),
       video_id: z10.string().optional().describe('YouTube video ID. Required when action is "video".'),
-      max_results: z10.number().min(1).max(50).optional().describe('Max videos to return for "topVideos" action. Defaults to 10.'),
+      max_results: z10.number().min(1).max(50).optional().describe(
+        'Max videos to return for "topVideos" action. Defaults to 10.'
+      ),
+      connected_account_id: z10.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: z10.string().uuid().optional().describe(
+        "Exact brand/project ID. Defaults only when the authenticated user has one project."
+      ),
       response_format: z10.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ action, start_date, end_date, video_id, max_results, response_format }) => {
+    async ({
+      action,
+      start_date,
+      end_date,
+      video_id,
+      max_results,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
       if (action === "video" && !video_id) {
         return {
           content: [
-            { type: "text", text: 'Error: video_id is required when action is "video".' }
+            {
+              type: "text",
+              text: 'Error: video_id is required when action is "video".'
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      if (!resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "project_id is required. Configure an explicit project or use an API key scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
+      const routing = await resolveConnectedAccountRouting({
+        projectId: resolvedProjectId,
+        platforms: ["youtube"],
+        requestedAccountIds: connected_account_id ? { youtube: connected_account_id } : void 0
+      });
+      const resolvedAccountId = routing.connectedAccountIds?.YouTube;
+      if (routing.error || !resolvedAccountId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: routing.error ?? "YouTube: exact connected-account routing could not be established."
+            }
           ],
           isError: true
         };
@@ -8147,11 +8794,19 @@ function registerYouTubeAnalyticsTools(server2) {
         startDate: start_date,
         endDate: end_date,
         videoId: video_id,
-        maxResults: max_results ?? 10
+        maxResults: max_results ?? 10,
+        projectId: resolvedProjectId,
+        project_id: resolvedProjectId,
+        connectedAccountId: resolvedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `YouTube Analytics error: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `YouTube Analytics error: ${error}`
+            }
+          ],
           isError: true
         };
       }
@@ -8164,7 +8819,12 @@ function registerYouTubeAnalyticsTools(server2) {
               {
                 type: "text",
                 text: JSON.stringify(
-                  asEnvelope7({ action, startDate: start_date, endDate: end_date, analytics: a }),
+                  asEnvelope7({
+                    action,
+                    startDate: start_date,
+                    endDate: end_date,
+                    analytics: a
+                  }),
                   null,
                   2
                 )
@@ -8191,7 +8851,10 @@ function registerYouTubeAnalyticsTools(server2) {
         if (days.length === 0) {
           return {
             content: [
-              { type: "text", text: "No daily analytics data found for this period." }
+              {
+                type: "text",
+                text: "No daily analytics data found for this period."
+              }
             ]
           };
         }
@@ -8214,7 +8877,10 @@ function registerYouTubeAnalyticsTools(server2) {
             ]
           };
         }
-        const lines = [`YouTube Daily Analytics (${start_date} to ${end_date}):`, ""];
+        const lines = [
+          `YouTube Daily Analytics (${start_date} to ${end_date}):`,
+          ""
+        ];
         for (const d of days) {
           lines.push(
             `  ${d.date}: ${d.views.toLocaleString()} views, ${d.watchTimeMinutes.toLocaleString()} min watch, +${d.subscribersGained} subs, ${d.likes} likes, ${d.comments} comments`
@@ -8261,7 +8927,12 @@ function registerYouTubeAnalyticsTools(server2) {
         const videos = result.topVideos ?? [];
         if (videos.length === 0) {
           return {
-            content: [{ type: "text", text: "No top videos found for this period." }]
+            content: [
+              {
+                type: "text",
+                text: "No top videos found for this period."
+              }
+            ]
           };
         }
         if (format === "json") {
@@ -8283,7 +8954,10 @@ function registerYouTubeAnalyticsTools(server2) {
             ]
           };
         }
-        const lines = [`Top ${videos.length} YouTube Videos (${start_date} to ${end_date}):`, ""];
+        const lines = [
+          `Top ${videos.length} YouTube Videos (${start_date} to ${end_date}):`,
+          ""
+        ];
         for (let i = 0; i < videos.length; i++) {
           const v = videos[i];
           lines.push(
@@ -8296,11 +8970,18 @@ function registerYouTubeAnalyticsTools(server2) {
       }
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope7(result), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope7(result), null, 2)
+            }
+          ]
         };
       }
       return {
-        content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        content: [
+          { type: "text", text: JSON.stringify(result, null, 2) }
+        ]
       };
     }
   );
@@ -8309,6 +8990,8 @@ var init_youtube_analytics = __esm({
   "src/tools/youtube-analytics.ts"() {
     "use strict";
     init_edge_function();
+    init_supabase();
+    init_connected_account_routing();
     init_version();
   }
 });
@@ -8324,6 +9007,29 @@ function asEnvelope8(data) {
     data
   };
 }
+async function exactYouTubeRoute(projectId, connectedAccountId) {
+  const resolvedProjectId = projectId ?? await getDefaultProjectId() ?? void 0;
+  if (!resolvedProjectId) {
+    return {
+      error: "project_id is required. Configure an explicit project or use an API key scoped to exactly one project."
+    };
+  }
+  const routing = await resolveConnectedAccountRouting({
+    projectId: resolvedProjectId,
+    platforms: ["youtube"],
+    requestedAccountIds: connectedAccountId ? { youtube: connectedAccountId } : void 0
+  });
+  const resolvedAccountId = routing.connectedAccountIds?.YouTube;
+  if (routing.error || !resolvedAccountId) {
+    return {
+      error: routing.error ?? "YouTube: exact connected-account routing could not be established."
+    };
+  }
+  return {
+    projectId: resolvedProjectId,
+    connectedAccountId: resolvedAccountId
+  };
+}
 function registerCommentsTools(server2) {
   server2.tool(
     "list_comments",
@@ -8336,19 +9042,42 @@ function registerCommentsTools(server2) {
       page_token: z11.string().optional().describe(
         "Pagination cursor from previous list_comments response nextPageToken field. Omit for first page of results."
       ),
+      connected_account_id: z11.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: PROJECT_ID_SCHEMA,
       response_format: z11.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ video_id, max_results, page_token, response_format }) => {
+    async ({
+      video_id,
+      max_results,
+      page_token,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
+      const route = await exactYouTubeRoute(project_id, connected_account_id);
+      if ("error" in route) {
+        return {
+          content: [{ type: "text", text: route.error }],
+          isError: true
+        };
+      }
       const { data, error } = await callEdgeFunction("youtube-comments", {
         action: "list",
         videoId: video_id,
         maxResults: max_results ?? 50,
-        pageToken: page_token
+        pageToken: page_token,
+        projectId: route.projectId,
+        project_id: route.projectId,
+        connectedAccountId: route.connectedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error listing comments: ${error}` }],
+          content: [
+            { type: "text", text: `Error listing comments: ${error}` }
+          ],
           isError: true
         };
       }
@@ -8360,7 +9089,10 @@ function registerCommentsTools(server2) {
             {
               type: "text",
               text: JSON.stringify(
-                asEnvelope8({ comments, nextPageToken: result.nextPageToken ?? null }),
+                asEnvelope8({
+                  comments,
+                  nextPageToken: result.nextPageToken ?? null
+                }),
                 null,
                 2
               )
@@ -8397,12 +9129,31 @@ function registerCommentsTools(server2) {
     "reply_to_comment",
     "Reply to a YouTube comment. Get the parent_id from list_comments results. Reply appears as the authenticated channel. Use for community engagement after checking list_comments for questions or feedback.",
     {
-      parent_id: z11.string().describe("The ID of the parent comment to reply to (from list_comments)."),
+      parent_id: z11.string().describe(
+        "The ID of the parent comment to reply to (from list_comments)."
+      ),
       text: z11.string().min(1).describe("The reply text."),
+      connected_account_id: z11.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: PROJECT_ID_SCHEMA,
       response_format: z11.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ parent_id, text, response_format }) => {
+    async ({
+      parent_id,
+      text,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
+      const route = await exactYouTubeRoute(project_id, connected_account_id);
+      if ("error" in route) {
+        return {
+          content: [{ type: "text", text: route.error }],
+          isError: true
+        };
+      }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("posting", `reply_to_comment:${userId}`);
       if (!rateLimit.allowed) {
@@ -8419,18 +9170,31 @@ function registerCommentsTools(server2) {
       const { data, error } = await callEdgeFunction("youtube-comments", {
         action: "reply",
         parentId: parent_id,
-        text
+        text,
+        projectId: route.projectId,
+        project_id: route.projectId,
+        connectedAccountId: route.connectedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error replying to comment: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Error replying to comment: ${error}`
+            }
+          ],
           isError: true
         };
       }
       const result = data;
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope8(result), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope8(result), null, 2)
+            }
+          ]
         };
       }
       return {
@@ -8451,10 +9215,27 @@ function registerCommentsTools(server2) {
     {
       video_id: z11.string().describe("The YouTube video ID to comment on."),
       text: z11.string().min(1).describe("The comment text."),
+      connected_account_id: z11.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: PROJECT_ID_SCHEMA,
       response_format: z11.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ video_id, text, response_format }) => {
+    async ({
+      video_id,
+      text,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
+      const route = await exactYouTubeRoute(project_id, connected_account_id);
+      if ("error" in route) {
+        return {
+          content: [{ type: "text", text: route.error }],
+          isError: true
+        };
+      }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("posting", `post_comment:${userId}`);
       if (!rateLimit.allowed) {
@@ -8471,18 +9252,28 @@ function registerCommentsTools(server2) {
       const { data, error } = await callEdgeFunction("youtube-comments", {
         action: "post",
         videoId: video_id,
-        text
+        text,
+        projectId: route.projectId,
+        project_id: route.projectId,
+        connectedAccountId: route.connectedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error posting comment: ${error}` }],
+          content: [
+            { type: "text", text: `Error posting comment: ${error}` }
+          ],
           isError: true
         };
       }
       const result = data;
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope8(result), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope8(result), null, 2)
+            }
+          ]
         };
       }
       return {
@@ -8503,10 +9294,27 @@ function registerCommentsTools(server2) {
     {
       comment_id: z11.string().describe("The comment ID to moderate."),
       moderation_status: z11.enum(["published", "rejected"]).describe('"published" to approve, "rejected" to hide.'),
+      connected_account_id: z11.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: PROJECT_ID_SCHEMA,
       response_format: z11.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ comment_id, moderation_status, response_format }) => {
+    async ({
+      comment_id,
+      moderation_status,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
+      const route = await exactYouTubeRoute(project_id, connected_account_id);
+      if ("error" in route) {
+        return {
+          content: [{ type: "text", text: route.error }],
+          isError: true
+        };
+      }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("posting", `moderate_comment:${userId}`);
       if (!rateLimit.allowed) {
@@ -8523,11 +9331,19 @@ function registerCommentsTools(server2) {
       const { error } = await callEdgeFunction("youtube-comments", {
         action: "moderate",
         commentId: comment_id,
-        moderationStatus: moderation_status
+        moderationStatus: moderation_status,
+        projectId: route.projectId,
+        project_id: route.projectId,
+        connectedAccountId: route.connectedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error moderating comment: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Error moderating comment: ${error}`
+            }
+          ],
           isError: true
         };
       }
@@ -8564,10 +9380,26 @@ function registerCommentsTools(server2) {
     "Delete a YouTube comment. Only works for comments owned by the authenticated channel.",
     {
       comment_id: z11.string().describe("The comment ID to delete."),
+      connected_account_id: z11.string().uuid().optional().describe(
+        "Exact YouTube connected-account ID from list_connections. Optional when exactly one active YouTube account is bound to the resolved project \u2014 auto-resolved. Required (with a clear list of candidates) when the project has multiple YouTube accounts."
+      ),
+      project_id: PROJECT_ID_SCHEMA,
       response_format: z11.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
-    async ({ comment_id, response_format }) => {
+    async ({
+      comment_id,
+      connected_account_id,
+      project_id,
+      response_format
+    }) => {
       const format = response_format ?? "text";
+      const route = await exactYouTubeRoute(project_id, connected_account_id);
+      if ("error" in route) {
+        return {
+          content: [{ type: "text", text: route.error }],
+          isError: true
+        };
+      }
       const userId = await getDefaultUserId();
       const rateLimit = checkRateLimit("posting", `delete_comment:${userId}`);
       if (!rateLimit.allowed) {
@@ -8583,11 +9415,16 @@ function registerCommentsTools(server2) {
       }
       const { error } = await callEdgeFunction("youtube-comments", {
         action: "delete",
-        commentId: comment_id
+        commentId: comment_id,
+        projectId: route.projectId,
+        project_id: route.projectId,
+        connectedAccountId: route.connectedAccountId
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error deleting comment: ${error}` }],
+          content: [
+            { type: "text", text: `Error deleting comment: ${error}` }
+          ],
           isError: true
         };
       }
@@ -8596,24 +9433,38 @@ function registerCommentsTools(server2) {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope8({ success: true, commentId: comment_id }), null, 2)
+              text: JSON.stringify(
+                asEnvelope8({ success: true, commentId: comment_id }),
+                null,
+                2
+              )
             }
           ]
         };
       }
       return {
-        content: [{ type: "text", text: `Comment ${comment_id} deleted successfully.` }]
+        content: [
+          {
+            type: "text",
+            text: `Comment ${comment_id} deleted successfully.`
+          }
+        ]
       };
     }
   );
 }
+var PROJECT_ID_SCHEMA;
 var init_comments = __esm({
   "src/tools/comments.ts"() {
     "use strict";
     init_edge_function();
     init_rate_limit();
     init_supabase();
+    init_connected_account_routing();
     init_version();
+    PROJECT_ID_SCHEMA = z11.string().uuid().optional().describe(
+      "Exact brand/project ID. Defaults only when the authenticated user has one project."
+    );
   }
 });
 
@@ -11324,6 +12175,14 @@ var init_plan_approvals = __esm({
 
 // src/tools/discovery.ts
 import { z as z23 } from "zod";
+function isHostedTransport() {
+  return process.env.MCP_TRANSPORT === "http";
+}
+function isPubliclyDiscoverable(tool) {
+  if (tool.internal || tool.hiddenFromPublicCount) return false;
+  if (tool.localOnly && isHostedTransport()) return false;
+  return true;
+}
 function toolKnowledgeDocument(tool) {
   const lines = [
     `Tool: ${tool.name}`,
@@ -11334,7 +12193,8 @@ function toolKnowledgeDocument(tool) {
   if (tool.task_intent) lines.push(`Task intent: ${tool.task_intent}`);
   if (tool.use_when) lines.push(`Use when: ${tool.use_when}`);
   if (tool.avoid_when) lines.push(`Avoid when: ${tool.avoid_when}`);
-  if (tool.next_tools?.length) lines.push(`Common next tools: ${tool.next_tools.join(", ")}`);
+  if (tool.next_tools?.length)
+    lines.push(`Common next tools: ${tool.next_tools.join(", ")}`);
   return {
     id: `tool:${tool.name}`,
     title: `MCP tool: ${tool.name}`,
@@ -11351,9 +12211,7 @@ function toolKnowledgeDocument(tool) {
 function getKnowledgeDocuments() {
   return [
     ...STATIC_KNOWLEDGE_DOCUMENTS,
-    ...TOOL_CATALOG.filter((t) => !t.internal && !t.hiddenFromPublicCount).map(
-      toolKnowledgeDocument
-    )
+    ...TOOL_CATALOG.filter(isPubliclyDiscoverable).map(toolKnowledgeDocument)
   ];
 }
 function tokenize(input) {
@@ -11407,7 +12265,9 @@ function registerDiscoveryTools(server2) {
       };
       return {
         structuredContent,
-        content: [{ type: "text", text: JSON.stringify(structuredContent) }]
+        content: [
+          { type: "text", text: JSON.stringify(structuredContent) }
+        ]
       };
     }
   );
@@ -11428,10 +12288,14 @@ function registerDiscoveryTools(server2) {
       }
     },
     async ({ id }) => {
-      const doc = getKnowledgeDocuments().find((candidate) => candidate.id === id);
+      const doc = getKnowledgeDocuments().find(
+        (candidate) => candidate.id === id
+      );
       if (!doc) {
         return {
-          content: [{ type: "text", text: `Document not found: ${id}` }],
+          content: [
+            { type: "text", text: `Document not found: ${id}` }
+          ],
           isError: true
         };
       }
@@ -11444,7 +12308,9 @@ function registerDiscoveryTools(server2) {
       };
       return {
         structuredContent,
-        content: [{ type: "text", text: JSON.stringify(structuredContent) }]
+        content: [
+          { type: "text", text: JSON.stringify(structuredContent) }
+        ]
       };
     }
   );
@@ -11453,7 +12319,9 @@ function registerDiscoveryTools(server2) {
     'Search available tools by name, description, module, or scope. Use "name" detail (~50 tokens) for quick lookup, "summary" (~500 tokens) for descriptions, "full" for complete input schemas. Start here if unsure which tool to call \u2014 filter by module (e.g. "planning", "content", "analytics") to narrow results.',
     {
       query: z23.string().optional().describe("Search query to filter tools by name or description"),
-      module: z23.string().optional().describe('Filter by module name (e.g. "planning", "content", "analytics")'),
+      module: z23.string().optional().describe(
+        'Filter by module name (e.g. "planning", "content", "analytics")'
+      ),
       scope: z23.string().optional().describe('Filter by required scope (e.g. "mcp:read", "mcp:write")'),
       detail: z23.enum(["name", "summary", "full"]).default("summary").describe(
         'Detail level: "name" for just tool names, "summary" for names + descriptions, "full" for complete info including scope and module'
@@ -11470,14 +12338,18 @@ function registerDiscoveryTools(server2) {
       if (query) {
         results = searchTools(query);
       }
-      results = results.filter((t) => !t.internal && !t.hiddenFromPublicCount);
+      results = results.filter(isPubliclyDiscoverable);
       if (module) {
         const moduleTools = getToolsByModule(module);
-        results = results.filter((t) => moduleTools.some((mt) => mt.name === t.name));
+        results = results.filter(
+          (t) => moduleTools.some((mt) => mt.name === t.name)
+        );
       }
       if (scope) {
         const scopeTools = getToolsByScope(scope);
-        results = results.filter((t) => scopeTools.some((st) => st.name === t.name));
+        results = results.filter(
+          (t) => scopeTools.some((st) => st.name === t.name)
+        );
       }
       if (available_only) {
         results = results.filter(isAvailable);
@@ -11515,7 +12387,12 @@ function registerDiscoveryTools(server2) {
             text: JSON.stringify(
               {
                 toolCount: results.length,
-                ...hasKnownScopes ? { scopes: { available: currentScopes, unavailable_matches: unavailableCount } } : {},
+                ...hasKnownScopes ? {
+                  scopes: {
+                    available: currentScopes,
+                    unavailable_matches: unavailableCount
+                  }
+                } : {},
                 tools: output
               },
               null,
@@ -11606,7 +12483,10 @@ var init_discovery = __esm({
 import { z as z24 } from "zod";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function asEnvelope20(data) {
-  return { _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
+  return {
+    _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+    data
+  };
 }
 function registerPipelineTools(server2) {
   server2.tool(
@@ -11629,7 +12509,10 @@ function registerPipelineTools(server2) {
             action: "pipeline-readiness",
             platforms,
             estimated_posts,
-            ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+            ...resolvedProjectId ? {
+              projectId: resolvedProjectId,
+              project_id: resolvedProjectId
+            } : {}
           },
           { timeoutMs: 15e3 }
         );
@@ -11647,16 +12530,24 @@ function registerPipelineTools(server2) {
         const blockers = [];
         const warnings = [];
         if (!isUnlimited && credits < estimatedCost) {
-          blockers.push(`Insufficient credits: ${credits} available, ~${estimatedCost} needed`);
+          blockers.push(
+            `Insufficient credits: ${credits} available, ~${estimatedCost} needed`
+          );
         }
         if (missingPlatforms.length > 0) {
-          blockers.push(`Missing connected accounts: ${missingPlatforms.join(", ")}`);
+          blockers.push(
+            `Missing connected accounts: ${missingPlatforms.join(", ")}`
+          );
         }
         if (!hasBrand) {
-          warnings.push("No brand profile found. Content will use generic voice.");
+          warnings.push(
+            "No brand profile found. Content will use generic voice."
+          );
         }
         if (pendingApprovals > 0) {
-          warnings.push(`${pendingApprovals} pending approval(s) from previous runs.`);
+          warnings.push(
+            `${pendingApprovals} pending approval(s) from previous runs.`
+          );
         }
         if (!insightsFresh) {
           warnings.push(
@@ -11671,7 +12562,10 @@ function registerPipelineTools(server2) {
               estimated_cost: estimatedCost,
               sufficient: credits >= estimatedCost
             },
-            connected_accounts: { platforms: connectedPlatforms, missing: missingPlatforms },
+            connected_accounts: {
+              platforms: connectedPlatforms,
+              missing: missingPlatforms
+            },
             brand_profile: { exists: hasBrand },
             pending_approvals: { count: pendingApprovals },
             insights_available: {
@@ -11685,11 +12579,18 @@ function registerPipelineTools(server2) {
         };
         if (format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope20(result), null, 2) }]
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(asEnvelope20(result), null, 2)
+              }
+            ]
           };
         }
         const lines = [];
-        lines.push(`Pipeline Readiness: ${result.ready ? "READY" : "NOT READY"}`);
+        lines.push(
+          `Pipeline Readiness: ${result.ready ? "READY" : "NOT READY"}`
+        );
         lines.push("=".repeat(40));
         lines.push(
           `Credits: ${credits} available, ~${estimatedCost} needed \u2014 ${credits >= estimatedCost ? "OK" : "BLOCKED"}`
@@ -11697,7 +12598,9 @@ function registerPipelineTools(server2) {
         lines.push(
           `Accounts: ${connectedPlatforms.length} connected${missingPlatforms.length > 0 ? ` (missing: ${missingPlatforms.join(", ")})` : " \u2014 OK"}`
         );
-        lines.push(`Brand: ${hasBrand ? "OK" : "Missing (will use generic voice)"}`);
+        lines.push(
+          `Brand: ${hasBrand ? "OK" : "Missing (will use generic voice)"}`
+        );
         lines.push(`Pending Approvals: ${pendingApprovals}`);
         lines.push(
           `Insights: ${insightsFresh ? "Fresh" : insightAge === null ? "None available" : `${insightAge} days old`}`
@@ -11716,7 +12619,12 @@ function registerPipelineTools(server2) {
       } catch (err) {
         const message = sanitizeError(err);
         return {
-          content: [{ type: "text", text: `Readiness check failed: ${message}` }],
+          content: [
+            {
+              type: "text",
+              text: `Readiness check failed: ${message}`
+            }
+          ],
           isError: true
         };
       }
@@ -11730,6 +12638,9 @@ function registerPipelineTools(server2) {
       topic: z24.string().optional().describe("Content topic (required if no source_url)"),
       source_url: z24.string().optional().describe("URL to extract content from"),
       platforms: z24.array(PLATFORM_ENUM2).min(1).describe("Target platforms"),
+      account_ids: z24.record(z24.string(), z24.string().uuid()).optional().describe(
+        "Exact connected-account ID per target platform. Required when a project has multiple accounts on one platform."
+      ),
       days: z24.number().min(1).max(7).default(5).describe("Days to plan"),
       posts_per_day: z24.number().min(1).max(3).default(1).describe("Posts per platform per day"),
       approval_mode: z24.enum(["auto", "review_all", "review_low_confidence"]).default("review_low_confidence").describe(
@@ -11751,6 +12662,7 @@ function registerPipelineTools(server2) {
       topic,
       source_url,
       platforms,
+      account_ids,
       days,
       posts_per_day,
       approval_mode,
@@ -11768,7 +12680,12 @@ function registerPipelineTools(server2) {
       let creditsUsed = 0;
       if (!topic && !source_url) {
         return {
-          content: [{ type: "text", text: "Either topic or source_url is required." }],
+          content: [
+            {
+              type: "text",
+              text: "Either topic or source_url is required."
+            }
+          ],
           isError: true
         };
       }
@@ -11798,6 +12715,35 @@ function registerPipelineTools(server2) {
       }
       try {
         const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+        if (schedulingRequested && !resolvedProjectId) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: "A project_id is required to schedule pipeline output. Configure an explicit project or use an API key scoped to exactly one project."
+              }
+            ],
+            isError: true
+          };
+        }
+        if (schedulingRequested) {
+          const preflightRouting = await resolveConnectedAccountRouting({
+            projectId: resolvedProjectId,
+            platforms,
+            requestedAccountIds: account_ids
+          });
+          if (preflightRouting.error || !preflightRouting.connectedAccountIds) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `Cannot run publishing pipeline \u2014 ${preflightRouting.error ?? "exact connected-account routing could not be established."} (checked before any credits were spent.)`
+                }
+              ],
+              isError: true
+            };
+          }
+        }
         const estimatedCost = BASE_PLAN_CREDITS + (source_url ? SOURCE_EXTRACTION_CREDITS : 0);
         const { data: budgetData } = await callEdgeFunction(
           "mcp-data",
@@ -11851,7 +12797,13 @@ function registerPipelineTools(server2) {
           "social-neuron-ai",
           {
             type: "generation",
-            prompt: buildPlanPrompt(resolvedTopic, platforms, days, posts_per_day, source_url),
+            prompt: buildPlanPrompt(
+              resolvedTopic,
+              platforms,
+              days,
+              posts_per_day,
+              source_url
+            ),
             model: "gemini-2.5-flash",
             responseFormat: "json",
             ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
@@ -11859,7 +12811,10 @@ function registerPipelineTools(server2) {
           { timeoutMs: 6e4 }
         );
         if (planError || !planData) {
-          errors.push({ stage: "planning", message: planError ?? "No AI response" });
+          errors.push({
+            stage: "planning",
+            message: planError ?? "No AI response"
+          });
           await callEdgeFunction(
             "mcp-data",
             {
@@ -11876,7 +12831,10 @@ function registerPipelineTools(server2) {
           );
           return {
             content: [
-              { type: "text", text: `Planning failed: ${planError ?? "No AI response"}` }
+              {
+                type: "text",
+                text: `Planning failed: ${planError ?? "No AI response"}`
+              }
             ],
             isError: true
           };
@@ -11906,20 +12864,22 @@ function registerPipelineTools(server2) {
         const postsArray = extractJsonArray(rawText);
         const requestedPlatformSet = new Set(platforms);
         const maxPosts = platforms.length * days * posts_per_day;
-        const parsedPosts = (postsArray ?? []).map((p) => ({
-          id: String(p.id ?? randomUUID3().slice(0, 8)),
-          day: Number(p.day ?? 1),
-          date: String(p.date ?? ""),
-          platform: String(p.platform ?? ""),
-          content_type: p.content_type ?? "caption",
-          caption: String(p.caption ?? ""),
-          title: p.title ? String(p.title) : void 0,
-          hashtags: Array.isArray(p.hashtags) ? p.hashtags.map(String) : void 0,
-          hook: String(p.hook ?? ""),
-          angle: String(p.angle ?? ""),
-          visual_direction: p.visual_direction ? String(p.visual_direction) : void 0,
-          media_type: p.media_type ? String(p.media_type) : void 0
-        }));
+        const parsedPosts = (postsArray ?? []).map(
+          (p) => ({
+            id: String(p.id ?? randomUUID3().slice(0, 8)),
+            day: Number(p.day ?? 1),
+            date: String(p.date ?? ""),
+            platform: String(p.platform ?? ""),
+            content_type: p.content_type ?? "caption",
+            caption: String(p.caption ?? ""),
+            title: p.title ? String(p.title) : void 0,
+            hashtags: Array.isArray(p.hashtags) ? p.hashtags.map(String) : void 0,
+            hook: String(p.hook ?? ""),
+            angle: String(p.angle ?? ""),
+            visual_direction: p.visual_direction ? String(p.visual_direction) : void 0,
+            media_type: p.media_type ? String(p.media_type) : void 0
+          })
+        );
         const platformFilteredPosts = parsedPosts.filter(
           (post) => requestedPlatformSet.has(post.platform)
         );
@@ -12002,7 +12962,10 @@ function registerPipelineTools(server2) {
                 estimated_credits: estimatedCost,
                 generated_at: (/* @__PURE__ */ new Date()).toISOString()
               },
-              ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+              ...resolvedProjectId ? {
+                projectId: resolvedProjectId,
+                project_id: resolvedProjectId
+              } : {}
             },
             { timeoutMs: 1e4 }
           );
@@ -12055,6 +13018,22 @@ function registerPipelineTools(server2) {
           }
         }
         let postsScheduled = 0;
+        const pipelineRouting = schedulingRequested && postsApproved > 0 ? await resolveConnectedAccountRouting({
+          projectId: resolvedProjectId,
+          platforms,
+          requestedAccountIds: account_ids
+        }) : void 0;
+        if (pipelineRouting?.error || schedulingRequested && postsApproved > 0 && !pipelineRouting?.connectedAccountIds) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Cannot run publishing pipeline \u2014 ${pipelineRouting?.error ?? "exact connected-account routing could not be established."}`
+              }
+            ],
+            isError: true
+          };
+        }
         if (!dry_run && !skipSet.has("schedule") && postsApproved > 0) {
           const approvedPosts = posts.filter((p) => p.status === "approved");
           const scheduleBase = /* @__PURE__ */ new Date();
@@ -12062,10 +13041,27 @@ function registerPipelineTools(server2) {
           const scheduleBaseMs = scheduleBase.getTime();
           for (const post of approvedPosts) {
             if (creditsUsed >= creditLimit) {
-              errors.push({ stage: "schedule", message: "Credit limit reached" });
+              errors.push({
+                stage: "schedule",
+                message: "Credit limit reached"
+              });
               break;
             }
-            const scheduledAt = post.schedule_at ?? new Date(scheduleBaseMs + (Math.max(1, post.day) - 1) * 864e5).toISOString();
+            const scheduledAt = post.schedule_at ?? new Date(
+              scheduleBaseMs + (Math.max(1, post.day) - 1) * 864e5
+            ).toISOString();
+            const route = Object.entries(
+              pipelineRouting.connectedAccountIds
+            ).find(
+              ([platform3]) => platform3.toLowerCase() === post.platform.toLowerCase()
+            );
+            if (!route) {
+              errors.push({
+                stage: "schedule",
+                message: `No verified connected account route for ${post.platform}`
+              });
+              continue;
+            }
             try {
               const { error: schedError } = await callEdgeFunction(
                 "schedule-post",
@@ -12078,7 +13074,11 @@ function registerPipelineTools(server2) {
                   scheduledAt,
                   planId,
                   idempotencyKey: `pipeline-${planId}-${post.id}`,
-                  ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+                  ...resolvedProjectId ? {
+                    projectId: resolvedProjectId,
+                    project_id: resolvedProjectId
+                  } : {},
+                  connectedAccountIds: { [route[0]]: route[1] }
                 },
                 { timeoutMs: 15e3 }
               );
@@ -12144,12 +13144,17 @@ function registerPipelineTools(server2) {
         if (response_format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope20(resultPayload), null, 2) }
+              {
+                type: "text",
+                text: JSON.stringify(asEnvelope20(resultPayload), null, 2)
+              }
             ]
           };
         }
         const lines = [];
-        lines.push(`Pipeline ${pipelineId.slice(0, 8)}... ${finalStatus.toUpperCase()}`);
+        lines.push(
+          `Pipeline ${pipelineId.slice(0, 8)}... ${finalStatus.toUpperCase()}`
+        );
         lines.push("=".repeat(40));
         lines.push(`Posts generated: ${posts.length}`);
         lines.push(`Posts approved: ${postsApproved}`);
@@ -12188,7 +13193,9 @@ function registerPipelineTools(server2) {
         } catch {
         }
         return {
-          content: [{ type: "text", text: `Pipeline failed: ${message}` }],
+          content: [
+            { type: "text", text: `Pipeline failed: ${message}` }
+          ],
           isError: true
         };
       }
@@ -12225,7 +13232,12 @@ function registerPipelineTools(server2) {
       }
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope20(data), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope20(data), null, 2)
+            }
+          ]
         };
       }
       const lines = [];
@@ -12265,10 +13277,19 @@ function registerPipelineTools(server2) {
     },
     async ({ plan_id, quality_threshold, response_format }) => {
       try {
-        const { data: loadResult, error: loadError } = await callEdgeFunction("mcp-data", { action: "auto-approve-plan", plan_id }, { timeoutMs: 1e4 });
+        const { data: loadResult, error: loadError } = await callEdgeFunction(
+          "mcp-data",
+          { action: "auto-approve-plan", plan_id },
+          { timeoutMs: 1e4 }
+        );
         if (loadError) {
           return {
-            content: [{ type: "text", text: `Failed to load plan: ${loadError}` }],
+            content: [
+              {
+                type: "text",
+                text: `Failed to load plan: ${loadError}`
+              }
+            ],
             isError: true
           };
         }
@@ -12276,7 +13297,10 @@ function registerPipelineTools(server2) {
         if (!stored?.plan_payload) {
           return {
             content: [
-              { type: "text", text: `No content plan found for plan_id=${plan_id}` }
+              {
+                type: "text",
+                text: `No content plan found for plan_id=${plan_id}`
+              }
             ],
             isError: true
           };
@@ -12303,7 +13327,11 @@ function registerPipelineTools(server2) {
               blockers: []
             };
             autoApproved++;
-            details.push({ post_id: post.id, action: "approved", score: quality.total });
+            details.push({
+              post_id: post.id,
+              action: "approved",
+              score: quality.total
+            });
           } else if (quality.total >= quality_threshold - 5) {
             post.status = "needs_edit";
             post.quality = {
@@ -12313,7 +13341,11 @@ function registerPipelineTools(server2) {
               blockers: quality.blockers
             };
             flagged++;
-            details.push({ post_id: post.id, action: "flagged", score: quality.total });
+            details.push({
+              post_id: post.id,
+              action: "flagged",
+              score: quality.total
+            });
           } else {
             post.status = "rejected";
             post.quality = {
@@ -12323,7 +13355,11 @@ function registerPipelineTools(server2) {
               blockers: quality.blockers
             };
             rejected++;
-            details.push({ post_id: post.id, action: "rejected", score: quality.total });
+            details.push({
+              post_id: post.id,
+              action: "rejected",
+              score: quality.total
+            });
           }
         }
         const newStatus = flagged === 0 && rejected === 0 ? "approved" : "in_review";
@@ -12359,7 +13395,10 @@ function registerPipelineTools(server2) {
         if (response_format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope20(resultPayload), null, 2) }
+              {
+                type: "text",
+                text: JSON.stringify(asEnvelope20(resultPayload), null, 2)
+              }
             ]
           };
         }
@@ -12380,7 +13419,9 @@ function registerPipelineTools(server2) {
       } catch (err) {
         const message = sanitizeError(err);
         return {
-          content: [{ type: "text", text: `Auto-approve failed: ${message}` }],
+          content: [
+            { type: "text", text: `Auto-approve failed: ${message}` }
+          ],
           isError: true
         };
       }
@@ -12414,6 +13455,7 @@ var init_pipeline = __esm({
     init_quality();
     init_version();
     init_parse_utils();
+    init_connected_account_routing();
     PLATFORM_ENUM2 = z24.enum([
       "youtube",
       "tiktok",
@@ -13941,25 +14983,39 @@ function registerCarouselTools(server2) {
       ]).optional().describe("Carousel template. Default: hormozi-authority."),
       slide_count: z28.number().min(3).max(10).optional().describe("Number of slides (3-10). Default: 7."),
       aspect_ratio: z28.enum(["1:1", "4:5", "9:16"]).optional().describe("Aspect ratio for both carousel and images. Default: 1:1."),
-      style: z28.enum(["minimal", "bold", "professional", "playful", "hormozi"]).optional().describe("Visual style. Default: hormozi for hormozi-authority template."),
+      style: z28.enum(["minimal", "bold", "professional", "playful", "hormozi"]).optional().describe(
+        "Visual style. Default: hormozi for hormozi-authority template."
+      ),
       image_style_suffix: z28.string().max(500).optional().describe(
         'Style suffix appended to every image prompt for visual consistency across slides. Example: "dark moody lighting, cinematic, 35mm film grain".'
       ),
       hook: z28.string().max(300).optional().describe(
         "Explicit hook/opener for slide 1. Overrides any hook derived from topic. Keep under 15 words for strongest scroll-stop."
       ),
-      hook_family: z28.enum(["curiosity", "authority", "pain_point", "contrarian", "data_driven"]).optional().describe(
+      hook_family: z28.enum([
+        "curiosity",
+        "authority",
+        "pain_point",
+        "contrarian",
+        "data_driven"
+      ]).optional().describe(
         "Hook family tag. Recorded on the carousel so downstream analytics can attribute engagement to hook pattern."
       ),
-      cta_text: z28.string().max(200).optional().describe("Explicit CTA copy for the final slide. If omitted, derived from topic."),
-      cta_url: z28.string().url().optional().describe("URL promoted on the CTA slide. Defaults to the project landing page."),
+      cta_text: z28.string().max(200).optional().describe(
+        "Explicit CTA copy for the final slide. If omitted, derived from topic."
+      ),
+      cta_url: z28.string().url().optional().describe(
+        "URL promoted on the CTA slide. Defaults to the project landing page."
+      ),
       tone: z28.string().max(200).optional().describe(
         'Voice/tone override. Composes with the brand profile voice when present. Example: "educational, confident, not arrogant".'
       ),
       constraints: z28.string().max(500).optional().describe(
         'Content constraints applied at generation time. Example: "No fabricated statistics. Sentence case only. No ALL CAPS."'
       ),
-      platform: z28.enum(["linkedin", "instagram", "tiktok", "x"]).optional().describe("Target platform. Affects tone conventions and slide-count guardrails."),
+      platform: z28.enum(["linkedin", "instagram", "tiktok", "x"]).optional().describe(
+        "Target platform. Affects tone conventions and slide-count guardrails."
+      ),
       brand_id: z28.string().optional().describe(
         "Brand/project ID to pull visual context from (colors, logo, mood). Falls back to project_id, then default project."
       ),
@@ -13991,7 +15047,9 @@ function registerCarouselTools(server2) {
       const slideCount = slide_count ?? 7;
       const ratio = aspect_ratio ?? "1:1";
       let brandContext = null;
-      const brandProjectId = brand_id || project_id || await getDefaultProjectId();
+      const defaultProjectId = await getDefaultProjectId();
+      const brandProjectId = brand_id || project_id || defaultProjectId;
+      const resolvedProjectId = project_id || defaultProjectId;
       if (brandProjectId) {
         brandContext = await fetchBrandVisualContext(brandProjectId);
       }
@@ -14000,10 +15058,7 @@ function registerCarouselTools(server2) {
       const totalEstimatedCost = carouselTextCost + slideCount * perImageCost;
       const budgetCheck = checkCreditBudget(totalEstimatedCost);
       if (!budgetCheck.ok) {
-        return {
-          content: [{ type: "text", text: budgetCheck.message }],
-          isError: true
-        };
+        return budgetCheck.error;
       }
       const assetBudget = checkAssetBudget(slideCount);
       if (!assetBudget.ok) {
@@ -14013,7 +15068,10 @@ function registerCarouselTools(server2) {
         };
       }
       const userId = await getDefaultUserId();
-      const rateLimit = checkRateLimit("generation", `create_carousel:${userId}`);
+      const rateLimit = checkRateLimit(
+        "generation",
+        `create_carousel:${userId}`
+      );
       if (!rateLimit.allowed) {
         return {
           content: [
@@ -14033,7 +15091,7 @@ function registerCarouselTools(server2) {
           slideCount,
           aspectRatio: ratio,
           style: resolvedStyle,
-          projectId: project_id,
+          projectId: resolvedProjectId,
           hook,
           hookFamily: hook_family,
           ctaText: cta_text,
@@ -14047,7 +15105,12 @@ function registerCarouselTools(server2) {
       if (carouselError || !carouselData?.carousel) {
         const errMsg = carouselError ?? "No carousel data returned";
         return {
-          content: [{ type: "text", text: `Carousel text generation failed: ${errMsg}` }],
+          content: [
+            {
+              type: "text",
+              text: `Carousel text generation failed: ${errMsg}`
+            }
+          ],
           isError: true
         };
       }
@@ -14076,7 +15139,8 @@ function registerCarouselTools(server2) {
               {
                 prompt: imagePrompt,
                 model: image_model,
-                aspectRatio: ratio
+                aspectRatio: ratio,
+                ...resolvedProjectId && { projectId: resolvedProjectId }
               },
               { timeoutMs: 3e4 }
             );
@@ -14133,14 +15197,19 @@ function registerCarouselTools(server2) {
               type: "text",
               text: JSON.stringify(
                 {
-                  _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+                  _meta: {
+                    version: MCP_VERSION,
+                    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+                  },
                   data: {
                     carouselId: carousel.id,
                     templateId,
                     style: resolvedStyle,
                     slideCount: carousel.slides.length,
                     slides: carousel.slides.map((s) => {
-                      const job = imageJobs.find((j) => j.slideNumber === s.slideNumber);
+                      const job = imageJobs.find(
+                        (j) => j.slideNumber === s.slideNumber
+                      );
                       return {
                         ...s,
                         imageJobId: job?.jobId ?? null,
@@ -14167,9 +15236,17 @@ function registerCarouselTools(server2) {
                     credits: {
                       textGeneration: textCredits,
                       imagesEstimated: successfulJobs.length * perImageCost,
-                      imagesCharged: imageJobs.reduce((sum, job) => sum + (job.creditsCharged ?? 0), 0),
-                      imagesRefunded: imageJobs.reduce((sum, job) => sum + (job.creditsRefunded ?? 0), 0),
-                      billingUnknownSlides: imageJobs.filter((job) => job.billingStatus === "unknown").length,
+                      imagesCharged: imageJobs.reduce(
+                        (sum, job) => sum + (job.creditsCharged ?? 0),
+                        0
+                      ),
+                      imagesRefunded: imageJobs.reduce(
+                        (sum, job) => sum + (job.creditsRefunded ?? 0),
+                        0
+                      ),
+                      billingUnknownSlides: imageJobs.filter(
+                        (job) => job.billingStatus === "unknown"
+                      ).length,
                       totalEstimated: textCredits + successfulJobs.length * perImageCost
                     }
                   }
@@ -14197,7 +15274,9 @@ function registerCarouselTools(server2) {
       for (const slide of carousel.slides) {
         const job = imageJobs.find((j) => j.slideNumber === slide.slideNumber);
         const status = job?.jobId ? `image: ${job.jobId}` : `image FAILED: ${job?.error}`;
-        lines.push(`  ${slide.slideNumber}. ${slide.headline || "(no headline)"} [${status}]`);
+        lines.push(
+          `  ${slide.slideNumber}. ${slide.headline || "(no headline)"} [${status}]`
+        );
       }
       if (failedJobs.length > 0) {
         lines.push("");
@@ -14208,7 +15287,9 @@ function registerCarouselTools(server2) {
       const jobIdList = successfulJobs.map((j) => j.jobId).join(", ");
       lines.push("");
       lines.push("Next steps:");
-      lines.push(`  1. Poll each job: check_status with job_id for each of: ${jobIdList}`);
+      lines.push(
+        `  1. Poll each job: check_status with job_id for each of: ${jobIdList}`
+      );
       lines.push(
         "  2. When all complete: schedule_post with job_ids=[...] and media_type=CAROUSEL_ALBUM"
       );
@@ -15078,28 +16159,33 @@ var init_analytics_pulse = __esm({
 
 // src/tools/connections.ts
 import { z as z33 } from "zod";
-function findActiveAccount(accounts, platform3) {
+function findActiveAccounts(accounts, platform3, projectId) {
   const target = platform3.toLowerCase();
-  return accounts.find((a) => {
+  return accounts.filter((a) => {
     const effectiveStatus = a.effective_status || a.status;
-    return a.platform.toLowerCase() === target && (effectiveStatus === "active" || effectiveStatus === "expires_soon");
-  }) ?? null;
+    return a.platform.toLowerCase() === target && a.project_id === projectId && (effectiveStatus === "active" || effectiveStatus === "expires_soon");
+  });
 }
 function registerConnectionTools(server2) {
   server2.tool(
     "start_platform_connection",
     "Begin connecting a social platform (Instagram, TikTok, YouTube, etc.). Returns a single-use deep link the user opens in a browser to complete the one-time OAuth handshake on socialneuron.com. This is NOT another OAuth in Claude \u2014 platform connections require a browser session because the social platforms (Meta, Google, TikTok) only accept callbacks on socialneuron.com. After the user clicks the link and approves on the platform, call `wait_for_connection` to detect completion. Link expires in 2 minutes; mint a new one if needed. Use `list_connected_accounts` first to check whether the platform is already connected before calling this.",
     {
-      platform: z33.enum(PLATFORM_ENUM4).describe("Platform to connect. Lower-case: instagram, tiktok, youtube, etc."),
-      project_id: z33.string().optional().describe(
-        "Brand/project ID to bind the new social account to. Use this when connecting a brand-specific account."
+      platform: z33.enum(PLATFORM_ENUM4).describe(
+        "Platform to connect. Lower-case: instagram, tiktok, youtube, etc."
+      ),
+      project_id: z33.string().uuid().optional().describe(
+        "Brand/project ID to bind the new social account to. Required when the account has multiple brands."
       ),
       response_format: z33.enum(["text", "json"]).optional().describe("Response format. Default: text.")
     },
     async ({ platform: platform3, project_id, response_format }) => {
       const format = response_format ?? "text";
       const userId = await getDefaultUserId();
-      const rl = checkRateLimit("posting", `start_platform_connection:${userId}`);
+      const rl = checkRateLimit(
+        "posting",
+        `start_platform_connection:${userId}`
+      );
       if (!rl.allowed) {
         return {
           content: [
@@ -15111,12 +16197,27 @@ function registerConnectionTools(server2) {
           isError: true
         };
       }
+      const projectResolution = await resolveProjectStrict(project_id);
+      if (!projectResolution.projectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: projectResolution.error ?? "A project_id is required to connect a platform. Configure an explicit project or use an API key scoped to exactly one project."
+            }
+          ],
+          isError: true
+        };
+      }
+      const resolvedProjectId = projectResolution.projectId;
+      const projectAutoResolvedNote = projectResolution.autoResolvedNote;
       const { data, error } = await callEdgeFunction(
         "mcp-data",
         {
           action: "mint-connection-nonce",
           platform: platform3,
-          ...project_id ? { projectId: project_id, project_id } : {}
+          projectId: resolvedProjectId,
+          project_id: resolvedProjectId
         },
         { timeoutMs: 1e4 }
       );
@@ -15132,6 +16233,17 @@ function registerConnectionTools(server2) {
           isError: true
         };
       }
+      if (data.project_id !== resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "Connection link project attestation failed. No OAuth link was returned."
+            }
+          ],
+          isError: true
+        };
+      }
       if (format === "json") {
         return {
           content: [
@@ -15140,10 +16252,11 @@ function registerConnectionTools(server2) {
               text: JSON.stringify(
                 {
                   platform: data.platform,
-                  project_id: project_id ?? null,
+                  project_id: resolvedProjectId,
                   deep_link: data.deep_link,
                   expires_at: data.expires_at,
-                  next_step: "Open deep_link in a browser, approve on the platform, then call wait_for_connection."
+                  next_step: "Open deep_link in a browser, approve on the platform, then call wait_for_connection.",
+                  ...projectAutoResolvedNote ? { project_auto_resolved: projectAutoResolvedNote } : {}
                 },
                 null,
                 2
@@ -15159,7 +16272,7 @@ function registerConnectionTools(server2) {
             type: "text",
             text: [
               `${data.platform} connection ready.`,
-              ...project_id ? [`Brand/project: ${project_id}`] : [],
+              `Brand/project: ${resolvedProjectId}`,
               "",
               'Ask the user to open this link in a browser and click "Connect" on the platform:',
               `  ${data.deep_link}`,
@@ -15167,7 +16280,8 @@ function registerConnectionTools(server2) {
               `Link expires at: ${data.expires_at} (~2 minutes).`,
               "",
               "After they approve, call `wait_for_connection` with the same platform to confirm.",
-              "This is a one-time browser setup \u2014 not another OAuth flow inside Claude."
+              "This is a one-time browser setup \u2014 not another OAuth flow inside Claude.",
+              ...projectAutoResolvedNote ? ["", `Note: ${projectAutoResolvedNote}`] : []
             ].join("\n")
           }
         ],
@@ -15180,14 +16294,20 @@ function registerConnectionTools(server2) {
     "Poll until a platform connection becomes active. Use after `start_platform_connection` while the user completes the browser OAuth flow. Returns when the account row appears with status=active, or when the timeout elapses. Default timeout 120s, max 600s.",
     {
       platform: z33.enum(PLATFORM_ENUM4).describe("Platform to wait for."),
-      project_id: z33.string().optional().describe(
+      project_id: z33.string().uuid().optional().describe(
         "Brand/project ID to scope the connection poll. Use the same project_id passed to start_platform_connection."
       ),
       timeout_s: z33.number().min(5).max(600).optional().describe("How long to wait, in seconds. Default 120."),
       poll_interval_s: z33.number().min(2).max(30).optional().describe("Poll interval in seconds. Default 5."),
       response_format: z33.enum(["text", "json"]).optional().describe("Response format. Default: text.")
     },
-    async ({ platform: platform3, project_id, timeout_s, poll_interval_s, response_format }) => {
+    async ({
+      platform: platform3,
+      project_id,
+      timeout_s,
+      poll_interval_s,
+      response_format
+    }) => {
       const format = response_format ?? "text";
       const startedAt = Date.now();
       const timeoutMs = (timeout_s ?? 120) * 1e3;
@@ -15206,6 +16326,18 @@ function registerConnectionTools(server2) {
           isError: true
         };
       }
+      const resolvedProjectId = project_id ?? await getDefaultProjectId() ?? void 0;
+      if (!resolvedProjectId) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "A project_id is required to wait for a connection. Use the same project_id used to start the OAuth flow."
+            }
+          ],
+          isError: true
+        };
+      }
       const activeWaits = inFlightWaitsByUser.get(userId) ?? 0;
       if (activeWaits >= MAX_CONCURRENT_WAITS_PER_USER) {
         return {
@@ -15227,12 +16359,62 @@ function registerConnectionTools(server2) {
             "mcp-data",
             {
               action: "connected-accounts",
-              ...project_id ? { projectId: project_id, project_id } : {}
+              projectId: resolvedProjectId,
+              project_id: resolvedProjectId
             },
             { timeoutMs: 1e4 }
           );
           if (!error && data?.success) {
-            const found = findActiveAccount(data.accounts ?? [], platform3);
+            const foundAccounts = findActiveAccounts(
+              data.accounts ?? [],
+              platform3,
+              resolvedProjectId
+            );
+            if (foundAccounts.length > 1) {
+              if (format === "json") {
+                return {
+                  content: [
+                    {
+                      type: "text",
+                      text: JSON.stringify(
+                        {
+                          connected: true,
+                          platform: platform3,
+                          project_id: resolvedProjectId,
+                          accounts: foundAccounts.map((a) => ({
+                            id: a.id,
+                            username: a.username,
+                            connected_at: a.created_at
+                          })),
+                          attempts,
+                          message: `${platform3} has ${foundAccounts.length} active accounts for this project. Pass the exact account_id to schedule_post.`
+                        },
+                        null,
+                        2
+                      )
+                    }
+                  ],
+                  isError: false
+                };
+              }
+              return {
+                content: [
+                  {
+                    type: "text",
+                    text: [
+                      `${platform3} is connected \u2014 ${foundAccounts.length} active accounts found for project ${resolvedProjectId}:`,
+                      ...foundAccounts.map(
+                        (a) => `  ${a.username || "(unnamed)"} (id=${a.id})`
+                      ),
+                      "",
+                      "Call schedule_post with the exact account_id (or account_ids) for the one you mean."
+                    ].join("\n")
+                  }
+                ],
+                isError: false
+              };
+            }
+            const found = foundAccounts[0];
             if (found) {
               if (format === "json") {
                 return {
@@ -15243,7 +16425,7 @@ function registerConnectionTools(server2) {
                         {
                           connected: true,
                           platform: found.platform,
-                          project_id: found.project_id ?? project_id ?? null,
+                          project_id: resolvedProjectId,
                           account_id: found.id,
                           username: found.username,
                           connected_at: found.created_at,
@@ -15263,7 +16445,7 @@ function registerConnectionTools(server2) {
                     type: "text",
                     text: [
                       `${found.platform} is connected.`,
-                      ...found.project_id || project_id ? [`Brand/project: ${found.project_id ?? project_id}`] : [],
+                      `Brand/project: ${resolvedProjectId}`,
                       `Account: ${found.username || "(unnamed)"} (id=${found.id})`,
                       `Detected after ${attempts} poll(s) in ${((Date.now() - startedAt) / 1e3).toFixed(1)}s.`,
                       "Ready to call `schedule_post`."
@@ -15276,7 +16458,9 @@ function registerConnectionTools(server2) {
           }
           const remaining = deadline - Date.now();
           if (remaining <= 0) break;
-          await new Promise((resolve3) => setTimeout(resolve3, Math.min(intervalMs, remaining)));
+          await new Promise(
+            (resolve3) => setTimeout(resolve3, Math.min(intervalMs, remaining))
+          );
         }
         const message = `${platform3} did not connect within ${timeout_s ?? 120}s (${attempts} polls). The user may not have completed the browser OAuth yet, or the link expired. Mint a new link with \`start_platform_connection\` and try again, or have the user go directly to socialneuron.com/settings/connections.`;
         if (format === "json") {
@@ -15288,7 +16472,7 @@ function registerConnectionTools(server2) {
                   {
                     connected: false,
                     platform: platform3,
-                    project_id: project_id ?? null,
+                    project_id: resolvedProjectId,
                     attempts,
                     timed_out: true,
                     message