posterly-mcp-server 0.44.0 → 0.45.1

package/dist/lib/tool-runtime.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Per-call context and shared helpers for the npm stdio tools that merge
+ * several old tools (MCP tool consolidation, 0.45.0).
+ *
+ *   - validateArgs(): the registry's per-mode rules (mcp-server/tool-registry.json)
+ *     run before any request, same as the hosted endpoint
+ *   - previewThenConfirm(): preview then confirm for public or destructive
+ *     actions; alias calls (ctx.legacyConfirm) keep their old one-step confirm
+ *     until the alias sunset date
+ *
+ * The context is built per call in index.ts from the transport's request map,
+ * never stored in the arguments or on shared state.
+ */
+import { type ToolRegistry } from './tool-registry.js';
+import type { StdioPreviewTokens } from './preview-token.js';
+export interface ToolContext {
+    /** The name the client called: an alias or the canonical tool. */
+    calledName: string;
+    /** True for alias calls: confirm: true alone still runs preview actions until the sunset date. */
+    legacyConfirm: boolean;
+    registry: ToolRegistry;
+    previews: StdioPreviewTokens;
+    /** The tool sets listed in this process (POSTERLY_TOOLSETS); every set when all is true. */
+    toolsets?: {
+        enabled: string[];
+        all: boolean;
+    };
+}
+/**
+ * Validates a merged tool's args against the registry's per-mode rules and
+ * returns the normalised args and mode. Throws a plain error before any request.
+ */
+export declare function validateArgs(ctx: ToolContext, tool: string, input: unknown): {
+    mode: string | null;
+    args: Record<string, any>;
+};
+/** A shallow copy of args without the given keys. */
+export declare function omitKeys(args: Record<string, any>, keys: string[]): Record<string, any>;
+export interface PreviewStep {
+    tool: string;
+    action: string;
+    /** Validated (normalised) args: the preview and the confirm call must hash identically. */
+    args: Record<string, any>;
+    /** Public writes: a preview_id can be confirmed once only. */
+    nonce: boolean;
+    /** The old tool's refusal when confirm is missing, for alias calls. */
+    legacyRefusal: string;
+    ctx: ToolContext;
+    /** What will change (may make one read request; must not throw). */
+    describe: () => Promise<string>;
+    run: () => Promise<string>;
+}
+/**
+ * Preview then confirm (docs/mcp-tool-design.md section 4). Canonical calls:
+ * no confirm returns a preview and a preview_id bound to this tool, action,
+ * and exact args; confirm needs that preview_id. Alias calls keep the old
+ * contract until the sunset: confirm: true alone runs the action.
+ */
+export declare function previewThenConfirm(step: PreviewStep): Promise<string>;
+/** Runs one read for a preview; a failed read (for example a 403 on a narrower key) falls back to echoing the request. */
+export declare function readForPreview<T>(read: () => Promise<T>): Promise<{
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    error: string;
+}>;
+export declare function readFailedNote(error: string): string;

package/dist/lib/tool-runtime.js

@@ -0,0 +1,85 @@
+/**
+ * Per-call context and shared helpers for the npm stdio tools that merge
+ * several old tools (MCP tool consolidation, 0.45.0).
+ *
+ *   - validateArgs(): the registry's per-mode rules (mcp-server/tool-registry.json)
+ *     run before any request, same as the hosted endpoint
+ *   - previewThenConfirm(): preview then confirm for public or destructive
+ *     actions; alias calls (ctx.legacyConfirm) keep their old one-step confirm
+ *     until the alias sunset date
+ *
+ * The context is built per call in index.ts from the transport's request map,
+ * never stored in the arguments or on shared state.
+ */
+import { canonicalArgs, validateMode } from './tool-registry.js';
+import { previewFailureMessage } from './preview-token-core.js';
+import { code, mdSection, mdTitle } from './format.js';
+/** The local process serves one user; preview tokens are bound to this process's key anyway. */
+const STDIO_PREVIEW_USER = 'stdio-local';
+/**
+ * Validates a merged tool's args against the registry's per-mode rules and
+ * returns the normalised args and mode. Throws a plain error before any request.
+ */
+export function validateArgs(ctx, tool, input) {
+    const validated = validateMode(ctx.registry, tool, input);
+    if (!validated.ok)
+        throw new Error(validated.error);
+    return { mode: validated.mode, args: validated.args };
+}
+/** A shallow copy of args without the given keys. */
+export function omitKeys(args, keys) {
+    const out = {};
+    for (const [key, value] of Object.entries(args || {})) {
+        if (!keys.includes(key))
+            out[key] = value;
+    }
+    return out;
+}
+function formatPreview(body, previewId, tool) {
+    return [
+        mdTitle('Preview only: nothing has changed yet'),
+        body,
+        mdSection('Preview ID', `${code(previewId)} (expires in 10 minutes)`),
+        mdSection('Next step', `Show this preview to the user. Only after they explicitly approve, call ${tool} again with the same fields plus confirm: true and this preview_id.`),
+    ].filter(Boolean).join('\n\n');
+}
+/**
+ * Preview then confirm (docs/mcp-tool-design.md section 4). Canonical calls:
+ * no confirm returns a preview and a preview_id bound to this tool, action,
+ * and exact args; confirm needs that preview_id. Alias calls keep the old
+ * contract until the sunset: confirm: true alone runs the action.
+ */
+export async function previewThenConfirm(step) {
+    const { ctx, args } = step;
+    if (ctx.legacyConfirm) {
+        if (args.confirm !== true)
+            throw new Error(step.legacyRefusal);
+        return step.run();
+    }
+    const binding = { userId: STDIO_PREVIEW_USER, tool: step.tool, action: step.action, args: canonicalArgs(args) };
+    if (args.confirm !== true) {
+        const previewId = ctx.previews.create(binding);
+        return formatPreview(await step.describe(), previewId, step.tool);
+    }
+    const token = args.preview_id;
+    if (typeof token !== 'string' || !token)
+        throw new Error(previewFailureMessage('missing'));
+    const verified = ctx.previews.verify(token, binding);
+    if (!verified.ok)
+        throw new Error(previewFailureMessage(verified.reason));
+    if (step.nonce && !ctx.previews.claimOnce(token, verified.exp))
+        throw new Error(previewFailureMessage('used'));
+    return step.run();
+}
+/** Runs one read for a preview; a failed read (for example a 403 on a narrower key) falls back to echoing the request. */
+export async function readForPreview(read) {
+    try {
+        return { ok: true, data: await read() };
+    }
+    catch (error) {
+        return { ok: false, error: error?.message || String(error) };
+    }
+}
+export function readFailedNote(error) {
+    return `_posterly could not read the current item (${error}), so the preview shows the request as given._`;
+}

package/dist/lib/version.d.ts

@@ -1 +1 @@
-export declare const POSTERLY_MCP_VERSION = "0.44.0";
+export declare const POSTERLY_MCP_VERSION = "0.45.1";

package/dist/lib/version.js

@@ -5,4 +5,4 @@
 // tool set (minus the intentional pre-auth signup tools that only this stdio
 // package exposes). `npm run check:mcp-parity` enforces both the version match
 // and the tool-list match, and runs in the pre-commit hook.
-export const POSTERLY_MCP_VERSION = '0.44.0';
+export const POSTERLY_MCP_VERSION = '0.45.1';

package/dist/tools/audit-google-business-profile.js

@@ -5,7 +5,7 @@ export const auditGoogleBusinessProfileTool = {
     inputSchema: z.object({
         workspace_id: z.string().optional().describe('Filter to a workspace ID from whoami.'),
         account_id: z.number().int().positive().optional().describe('Google Business account ID from list_accounts.'),
-        location_id: z.string().optional().describe('Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer account_id.'),
+        location_id: z.string().optional().describe('Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID from list_google_business_reviews view=review_link. Prefer account_id.'),
     }),
     async execute(client, input) {
         const result = await client.auditGoogleBusinessProfile(input);

package/dist/tools/connect-account.d.ts

@@ -20,13 +20,13 @@ export declare const connectAccountTool: {
         workspace_id: z.ZodOptional<z.ZodString>;
         connect_session_id: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        platform: "telegram" | "bluesky" | "discord" | "devto" | "hashnode" | "wordpress" | "lemmy";
+        platform: "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy";
         username?: string | undefined;
         workspace_id?: string | undefined;
         connect_session_id?: string | undefined;
-        handle?: string | undefined;
         bot_token?: string | undefined;
         chat_id?: string | undefined;
+        handle?: string | undefined;
         app_password?: string | undefined;
         webhook_url?: string | undefined;
         site_url?: string | undefined;
@@ -35,13 +35,13 @@ export declare const connectAccountTool: {
         instance?: string | undefined;
         password?: string | undefined;
     }, {
-        platform: "telegram" | "bluesky" | "discord" | "devto" | "hashnode" | "wordpress" | "lemmy";
+        platform: "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy";
         username?: string | undefined;
         workspace_id?: string | undefined;
         connect_session_id?: string | undefined;
-        handle?: string | undefined;
         bot_token?: string | undefined;
         chat_id?: string | undefined;
+        handle?: string | undefined;
         app_password?: string | undefined;
         webhook_url?: string | undefined;
         site_url?: string | undefined;

package/dist/tools/connect-account.js

@@ -26,7 +26,7 @@ const PLATFORM_CREDENTIAL_FIELDS = {
 };
 export const connectAccountTool = {
     name: 'connect_account',
-    description: 'Connect a credential-based social account (telegram, bluesky, discord, wordpress, devto, hashnode, lemmy) directly, without a browser session. Call get_connect_link first to discover the exact credential fields the platform needs. Prefer scoped secrets: app passwords (Bluesky, WordPress), bot tokens (Telegram), webhook URLs (Discord), and API tokens (Dev.to, Hashnode) over primary passwords. Warn the user that any credential they share passes through this conversation. For OAuth platforms (Instagram, X, LinkedIn, ...) use create_connect_session instead.',
+    description: 'Connect a credential-based social account (telegram, bluesky, discord, wordpress, devto, hashnode, lemmy) directly, without a browser session. Call list_platforms with view=connect_link first to discover the exact credential fields the platform needs. Prefer scoped secrets: app passwords (Bluesky, WordPress), bot tokens (Telegram), webhook URLs (Discord), and API tokens (Dev.to, Hashnode) over primary passwords. Warn the user that any credential they share passes through this conversation. For OAuth platforms (Instagram, X, LinkedIn, ...) use create_connect_session instead.',
     inputSchema: z.object({
         platform: z
             .enum(CREDENTIAL_PLATFORMS)
@@ -56,7 +56,7 @@ export const connectAccountTool = {
         }
         const missing = allowedFields.filter((field) => !(field in credentials));
         if (missing.length > 0) {
-            return `Missing credential field(s) for ${input.platform}: ${missing.join(', ')}. Call get_connect_link with platform=${input.platform} to see field descriptions.`;
+            return `Missing credential field(s) for ${input.platform}: ${missing.join(', ')}. Call list_platforms with view=connect_link and target=${input.platform} to see field descriptions.`;
         }
         const result = await client.connectAccountCredentials({
             platform: input.platform,

package/dist/tools/create-connect-session.d.ts

@@ -9,12 +9,12 @@ export declare const createConnectSessionTool: {
         auto_start: z.ZodOptional<z.ZodBoolean>;
         debug: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        platform: "meta" | "instagram_direct" | "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "medium" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "reddit" | "skool" | "whop" | "gmb" | "google-business" | "google_business_profile" | "linkedin_page" | "facebook_instagram" | "facebook_pages" | "linkedin-company" | "linkedin-page" | "linkedin_company" | "linkedin_personal" | "meta_business" | "x_twitter";
+        platform: "meta" | "instagram_direct" | "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "medium" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "reddit" | "skool" | "whop" | "gmb" | "google-business" | "google_business_profile" | "linkedin_page" | "facebook_instagram" | "facebook_pages" | "linkedin-company" | "linkedin-page" | "linkedin_company" | "linkedin_personal" | "meta_business" | "x_twitter";
         workspace_id?: string | undefined;
         auto_start?: boolean | undefined;
         debug?: boolean | undefined;
     }, {
-        platform: "meta" | "instagram_direct" | "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "medium" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "reddit" | "skool" | "whop" | "gmb" | "google-business" | "google_business_profile" | "linkedin_page" | "facebook_instagram" | "facebook_pages" | "linkedin-company" | "linkedin-page" | "linkedin_company" | "linkedin_personal" | "meta_business" | "x_twitter";
+        platform: "meta" | "instagram_direct" | "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "medium" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "reddit" | "skool" | "whop" | "gmb" | "google-business" | "google_business_profile" | "linkedin_page" | "facebook_instagram" | "facebook_pages" | "linkedin-company" | "linkedin-page" | "linkedin_company" | "linkedin_personal" | "meta_business" | "x_twitter";
         workspace_id?: string | undefined;
         auto_start?: boolean | undefined;
         debug?: boolean | undefined;

package/dist/tools/create-connect-session.js

@@ -3,7 +3,7 @@ import { DASHBOARD_CONNECT_URL, formatConnectedAccounts, formatLocalDateTime } f
 import { CONNECT_INPUTS } from '../generated/platform-manifest.js';
 export const createConnectSessionTool = {
     name: 'create_connect_session',
-    description: 'Create a short-lived posterly dashboard handoff session for connecting a social account. Send the secure connection URL to the user, then poll get_connect_session to narrate progress. Do not ask for social media passwords or OAuth codes; posterly handles those browser steps.',
+    description: 'Create a short-lived posterly dashboard handoff session for connecting a social account. Send the secure connection URL to the user, then poll list_accounts with view=connect_session to narrate progress. Do not ask for social media passwords or OAuth codes; posterly handles those browser steps.',
     inputSchema: z.object({
         platform: z
             .enum(CONNECT_INPUTS)
@@ -41,7 +41,7 @@ function formatConnectSession(session, includeRaw) {
         `Expires: ${formatLocalDateTime(session.expires_at)}`,
         `Dashboard connect page: ${DASHBOARD_CONNECT_URL}`,
         '',
-        'Next step for the AI agent: send the secure connection URL to the user, explain that posterly will handle the browser OAuth step, then poll get_connect_session until the account is connected or the session ends.',
+        'Next step for the AI agent: send the secure connection URL to the user, explain that posterly will handle the browser OAuth step, then poll list_accounts with view=connect_session until the account is connected or the session ends.',
         includeRaw ? `\nRaw connect session:\n${JSON.stringify(session, null, 2)}` : '',
     ].filter(Boolean).join('\n');
 }

package/dist/tools/create-post.d.ts

@@ -968,7 +968,7 @@ export declare const createPostPayloadInputSchema: z.ZodObject<{
     }, z.ZodTypeAny, "passthrough">>>;
     workspace_id: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
     username?: string | undefined;
     workspace_id?: string | undefined;
     account_id?: string | undefined;
@@ -1131,7 +1131,7 @@ export declare const createPostPayloadInputSchema: z.ZodObject<{
         ai_generated: z.ZodOptional<z.ZodBoolean>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
 }, {
-    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
     username?: string | undefined;
     workspace_id?: string | undefined;
     account_id?: string | undefined;
@@ -1787,7 +1787,7 @@ export declare const createPostInputSchema: z.ZodObject<{
     confirm: z.ZodLiteral<true>;
 }, "strip", z.ZodTypeAny, {
     confirm: true;
-    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
     username?: string | undefined;
     workspace_id?: string | undefined;
     account_id?: string | undefined;
@@ -1951,7 +1951,7 @@ export declare const createPostInputSchema: z.ZodObject<{
     }, z.ZodTypeAny, "passthrough"> | undefined;
 }, {
     confirm: true;
-    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
     username?: string | undefined;
     workspace_id?: string | undefined;
     account_id?: string | undefined;
@@ -2116,7 +2116,30 @@ export declare const createPostInputSchema: z.ZodObject<{
 }>;
 export type CreatePostInput = z.infer<typeof createPostInputSchema>;
 export type CreatePostPayloadInput = z.infer<typeof createPostPayloadInputSchema>;
-export declare function buildCreatePostPayload(input: CreatePostPayloadInput | CreatePostInput): Parameters<PosterlyClient['createPost']>[0];
+export type AccountPlatformLookup = {
+    found: true;
+    platform: string | null;
+} | {
+    found: false;
+    detail: string;
+};
+export type AccountPlatformResolver = (accountId: string, workspaceId?: string) => Promise<AccountPlatformLookup>;
+/**
+ * Builds a resolver that answers "what platform is this account_id on?" via
+ * client.listAccounts() (there is no GET /accounts/:id), for thread_posts
+ * calls that gave account_id without platform. Caches one in-flight lookup
+ * per workspace_id (including the unscoped list, keyed ''), so
+ * create_posts_batch never issues more than one accounts request per
+ * distinct workspace_id even though every item in the batch calls this
+ * independently: the cache is populated synchronously (before the first
+ * await) on the first call for a given workspace_id, so concurrent
+ * Promise.all callers for the same workspace_id share the one in-flight
+ * request. A failed lookup (non-2xx, missing accounts:read, network error)
+ * is cached too, so it is reported once per workspace_id rather than
+ * surfacing a fresh error per item.
+ */
+export declare function createAccountPlatformResolver(client: PosterlyClient): AccountPlatformResolver;
+export declare function buildCreatePostPayload(input: CreatePostPayloadInput | CreatePostInput, resolvePlatform: AccountPlatformResolver): Promise<Parameters<PosterlyClient['createPost']>[0]>;
 export declare const createPostTool: {
     name: string;
     description: string;
@@ -2613,7 +2636,7 @@ export declare const createPostTool: {
         confirm: z.ZodLiteral<true>;
     }, "strip", z.ZodTypeAny, {
         confirm: true;
-        platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+        platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
         username?: string | undefined;
         workspace_id?: string | undefined;
         account_id?: string | undefined;
@@ -2777,7 +2800,7 @@ export declare const createPostTool: {
         }, z.ZodTypeAny, "passthrough"> | undefined;
     }, {
         confirm: true;
-        platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+        platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
         username?: string | undefined;
         workspace_id?: string | undefined;
         account_id?: string | undefined;

package/dist/tools/create-post.js

@@ -151,7 +151,7 @@ export const createPostPayloadInputSchema = z.object({
         .describe('For X or Threads only: array of 2+ strings, one per post in the thread. The first entry leads, the rest reply in order. When set, the platform must be twitter or threads.'),
     instagram_settings: instagramSettingsSchema
         .optional()
-        .describe('Instagram-specific settings. If “tag” is ambiguous, distinguish caption @mentions (put @username in caption), native media tags (user_tags), and co-author invitations (collaborators). Native media tags work with eligible direct or Meta-linked accounts; collaborators require an eligible Meta-linked account. Call get_platform_schema(account_id) first.'),
+        .describe('Instagram-specific settings. If “tag” is ambiguous, distinguish caption @mentions (put @username in caption), native media tags (user_tags), and co-author invitations (collaborators). Native media tags work with eligible direct or Meta-linked accounts; collaborators require an eligible Meta-linked account. Call list_platforms with view=schema and account_id first.'),
     platform_settings: platformSettingsSchema
         .optional()
         .describe('Platform-specific settings for the selected account. Use this for non-Instagram settings and prefer it over raw metadata.'),
@@ -163,17 +163,83 @@ export const createPostPayloadInputSchema = z.object({
 export const createPostInputSchema = createPostPayloadInputSchema.extend({
     confirm: z.literal(true).describe('Must be true after explicit user confirmation of the post/account/workspace/schedule.'),
 });
-export function buildCreatePostPayload(input) {
+/**
+ * Builds a resolver that answers "what platform is this account_id on?" via
+ * client.listAccounts() (there is no GET /accounts/:id), for thread_posts
+ * calls that gave account_id without platform. Caches one in-flight lookup
+ * per workspace_id (including the unscoped list, keyed ''), so
+ * create_posts_batch never issues more than one accounts request per
+ * distinct workspace_id even though every item in the batch calls this
+ * independently: the cache is populated synchronously (before the first
+ * await) on the first call for a given workspace_id, so concurrent
+ * Promise.all callers for the same workspace_id share the one in-flight
+ * request. A failed lookup (non-2xx, missing accounts:read, network error)
+ * is cached too, so it is reported once per workspace_id rather than
+ * surfacing a fresh error per item.
+ */
+export function createAccountPlatformResolver(client) {
+    const cache = new Map();
+    const lookupForWorkspace = (workspaceKey) => {
+        let pending = cache.get(workspaceKey);
+        if (!pending) {
+            pending = (async () => {
+                try {
+                    const accounts = await client.listAccounts(workspaceKey ? { workspace_id: workspaceKey } : undefined);
+                    const platforms = new Map();
+                    for (const account of accounts) {
+                        if (account && typeof account.platform === 'string' && account.id !== undefined && account.id !== null) {
+                            platforms.set(String(account.id), account.platform);
+                        }
+                    }
+                    return { ok: true, platforms };
+                }
+                catch (error) {
+                    return { ok: false, detail: error?.message || 'accounts lookup failed' };
+                }
+            })();
+            cache.set(workspaceKey, pending);
+        }
+        return pending;
+    };
+    return async (accountId, workspaceId) => {
+        const workspaceKey = workspaceId || '';
+        const lookup = await lookupForWorkspace(workspaceKey);
+        if (!lookup.ok)
+            return { found: false, detail: lookup.detail };
+        return { found: true, platform: lookup.platforms.get(String(accountId)) ?? null };
+    };
+}
+export async function buildCreatePostPayload(input, resolvePlatform) {
     const { confirm: _confirm, thread_posts, caption, post_type, instagram_settings, platform_settings, ...rest } = input;
     if (thread_posts && thread_posts.length > 0) {
         if (thread_posts.length < 2) {
             throw new Error('thread_posts must contain at least 2 entries');
         }
         const platformHint = (input.platform || '').toLowerCase();
-        const isTwitter = platformHint === 'twitter' || platformHint === 'x';
-        const isThreads = platformHint === 'threads';
-        if (!isTwitter && !isThreads && !input.account_id) {
-            throw new Error('thread_posts requires `platform` to be "twitter" or "threads", or pass `account_id` for an X/Threads account.');
+        let isTwitter = platformHint === 'twitter' || platformHint === 'x';
+        let isThreads = platformHint === 'threads';
+        if (!isTwitter && !isThreads) {
+            if (!input.account_id) {
+                throw new Error('thread_posts requires `platform` to be "twitter" or "threads", or pass `account_id` for an X/Threads account.');
+            }
+            // No platform hint: never guess X. Resolve the account's real platform
+            // first, so a Threads account_id builds a threads_thread, not an
+            // x_thread that the server then rejects.
+            const lookup = await resolvePlatform(input.account_id, input.workspace_id);
+            if (!lookup.found) {
+                throw new Error(`thread_posts could not resolve account_id's platform (${lookup.detail}). Pass \`platform\` explicitly.`);
+            }
+            else if (lookup.platform === 'threads') {
+                isThreads = true;
+            }
+            else if (lookup.platform === 'twitter') {
+                isTwitter = true;
+            }
+            else {
+                throw new Error(lookup.platform
+                    ? `thread_posts requires an X/Twitter or Threads account; account_id resolved to platform "${lookup.platform}".`
+                    : 'thread_posts requires `platform` to be "twitter" or "threads", or an `account_id` that exists in list_accounts. Pass `platform` explicitly.');
+            }
         }
         const arrayKey = isThreads ? 'threads_thread_posts' : 'x_thread_tweets';
         const totalKey = isThreads ? 'threads_thread_total' : 'x_thread_total';
@@ -218,16 +284,16 @@ export const createPostTool = {
         '4. If scheduling multiple posts in one turn, list every post first and confirm the batch as a whole, then prefer `create_posts_batch` so they are created in one API request.\n\n' +
         'AFTER CALLING: Tell the user the post was created, include the posterly dashboard link returned by the tool, and offer the next natural action. Do not narrate raw HTTP, curl, or API plumbing.\n\n' +
         'Provide either account_id OR username+platform to identify the account. If scheduled_at is omitted, the post publishes immediately. If workspace_id is omitted, the server resolves one from the social account, falling back to the caller\'s default (personal) workspace - pass workspace_id explicitly if the user has more than one workspace.\n\n' +
-        'MEDIA URLS: Posterly storage URLs are used as-is. Third-party HTTP(S) media URLs are copied into posterly storage before the post is saved, so API-created posts do not later fail on expired signed URLs. Short-lived signed URLs must still be live when this tool runs. You can also call `upload_media_from_url` first if you want to upload once and reuse the returned posterly URL across posts.\n\n' +
+        'MEDIA URLS: Posterly storage URLs are used as-is. Third-party HTTP(S) media URLs are copied into posterly storage before the post is saved, so API-created posts do not later fail on expired signed URLs. Short-lived signed URLs must still be live when this tool runs. You can also call `upload_media` with `url` first if you want to upload once and reuse the returned posterly URL across posts.\n\n' +
         'THREADS: Pass `thread_posts` (an array of 2+ strings) to schedule a multi-post thread on X (Twitter) or Threads (Meta). The first entry is the lead post; the rest are published as replies in the same chain. X entries are capped at 280 characters each (4000 for verified, 25000 for organization accounts); Threads entries are capped at 500 characters each. When `thread_posts` is set, `caption` is ignored.\n\n' +
-        'PLATFORM SETTINGS: Pass `platform_settings` for composer-equivalent controls: Facebook story/reel/backgrounds, YouTube title/privacy/thumbnail/brandPartner, LinkedIn document titles/mentions/polls/content_call_to_action_label (including BUY_NOW and SHOP_NOW), TikTok direct-post privacy/toggles/commercial disclosure, Pinterest board/title/link/product_tags, GBP event/offer/CTA/recurrence, X reply settings/polls/paid_partnership, Threads reply controls/text attachments/ghost posts/spoilers/reply approvals/GIPHY, Telegram polls/buttons/video cover/live photo, Slack markdown/blocks, Mastodon visibility/quote/poll (media+poll allowed), and Instagram feed/story/reel/carousel/native media tags/collaborators/first comments/trial Reels/is_ai_generated/audio_id. For Instagram, @username in caption is only a caption mention; `user_tags` creates native media tags and `collaborators` sends co-author invitations only when the selected Meta-linked account reports those capabilities. Call `get_platform_schema` with the account ID first. `instagram_settings` remains as a backwards-compatible alias.\n\n' +
+        'PLATFORM SETTINGS: Pass `platform_settings` for composer-equivalent controls: Facebook story/reel/backgrounds, YouTube title/privacy/thumbnail/brandPartner, LinkedIn document titles/mentions/polls/content_call_to_action_label (including BUY_NOW and SHOP_NOW), TikTok direct-post privacy/toggles/commercial disclosure, Pinterest board/title/link/product_tags, GBP event/offer/CTA/recurrence, X reply settings/polls/paid_partnership, Threads reply controls/text attachments/ghost posts/spoilers/reply approvals/GIPHY, Telegram polls/buttons/video cover/live photo, Slack markdown/blocks, Mastodon visibility/quote/poll (media+poll allowed), and Instagram feed/story/reel/carousel/native media tags/collaborators/first comments/trial Reels/is_ai_generated/audio_id. For Instagram, @username in caption is only a caption mention; `user_tags` creates native media tags and `collaborators` sends co-author invitations only when the selected Meta-linked account reports those capabilities. Call `list_platforms` with `view: "schema"` and the account ID first. `instagram_settings` remains as a backwards-compatible alias.\n\n' +
         'TIKTOK MEDIA: TikTok supports a single video or a photo slideshow of 1 to 35 images, never multiple videos. Image media auto-detects as a slideshow, so you usually do not set post_type or media_type for photos and every image is posted. Pass `platform_settings.media_type: "PHOTO"` to force a slideshow explicitly.',
     inputSchema: createPostInputSchema,
     async execute(client, input) {
         if (input.confirm !== true) {
             throw new Error('Refusing to create post without confirm=true after explicit user confirmation.');
         }
-        const payload = buildCreatePostPayload(input);
+        const payload = await buildCreatePostPayload(input, createAccountPlatformResolver(client));
         const { thread_posts, instagram_settings, platform_settings } = input;
         const result = await client.createPost(payload);
         const p = result.post;

package/dist/tools/create-posts-batch.d.ts

@@ -495,7 +495,7 @@ export declare const createPostsBatchTool: {
             }, z.ZodTypeAny, "passthrough">>>;
             workspace_id: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+            platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
             username?: string | undefined;
             workspace_id?: string | undefined;
             account_id?: string | undefined;
@@ -658,7 +658,7 @@ export declare const createPostsBatchTool: {
                 ai_generated: z.ZodOptional<z.ZodBoolean>;
             }, z.ZodTypeAny, "passthrough"> | undefined;
         }, {
-            platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+            platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
             username?: string | undefined;
             workspace_id?: string | undefined;
             account_id?: string | undefined;
@@ -825,7 +825,7 @@ export declare const createPostsBatchTool: {
     }, "strip", z.ZodTypeAny, {
         confirm: true;
         posts: {
-            platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+            platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
             username?: string | undefined;
             workspace_id?: string | undefined;
             account_id?: string | undefined;
@@ -991,7 +991,7 @@ export declare const createPostsBatchTool: {
     }, {
         confirm: true;
         posts: {
-            platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+            platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
             username?: string | undefined;
             workspace_id?: string | undefined;
             account_id?: string | undefined;

package/dist/tools/create-posts-batch.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { dashboardUrlForPostList, formatLocalDateTime } from '../lib/format.js';
-import { buildCreatePostPayload, createPostPayloadInputSchema } from './create-post.js';
+import { buildCreatePostPayload, createAccountPlatformResolver, createPostPayloadInputSchema } from './create-post.js';
 export const createPostsBatchTool = {
     name: 'create_posts_batch',
     description: 'Create 1-25 scheduled or immediate social posts in one API request. This is a DESTRUCTIVE WRITE that creates content on the user\'s real social accounts - once scheduled_at passes, posts may go public and cannot be un-posted.\n\n' +
@@ -22,7 +22,19 @@ export const createPostsBatchTool = {
         if (input.confirm !== true) {
             throw new Error('Refusing to create batch posts without confirm=true after explicit user confirmation.');
         }
-        const payloads = input.posts.map((post) => buildCreatePostPayload(post));
+        // One resolver shared across the whole batch: createAccountPlatformResolver
+        // caches its accounts lookup per workspace_id, so N items that all need
+        // thread_posts platform resolution for the same workspace still cost one
+        // listAccounts() call, not N.
+        const resolvePlatform = createAccountPlatformResolver(client);
+        const payloads = await Promise.all(input.posts.map(async (post, index) => {
+            try {
+                return await buildCreatePostPayload(post, resolvePlatform);
+            }
+            catch (error) {
+                throw new Error(`Item ${index}: ${error?.message || 'invalid post input'}`);
+            }
+        }));
         const result = await client.createPostsBatch({ posts: payloads });
         const createdPosts = result.posts.map((item) => item.post);
         const dashboardUrl = dashboardUrlForPostList(createdPosts);

package/dist/tools/create-webhook.d.ts

@@ -15,15 +15,15 @@ export declare const createWebhookTool: {
         url: string;
         description?: string | undefined;
         workspace_id?: string | undefined;
-        events?: ("webhook.test" | "post.created" | "post.updated" | "post.deleted" | "post.publishing" | "post.published" | "post.failed" | "account.disconnected" | "analytics.synced" | "approval.requested" | "approval.approved" | "approval.changes_requested" | "approval.rejected" | "approval.commented")[] | undefined;
         is_active?: boolean | undefined;
+        events?: ("webhook.test" | "post.created" | "post.updated" | "post.deleted" | "post.publishing" | "post.published" | "post.failed" | "account.disconnected" | "analytics.synced" | "approval.requested" | "approval.approved" | "approval.changes_requested" | "approval.rejected" | "approval.commented")[] | undefined;
     }, {
         confirm: true;
         url: string;
         description?: string | undefined;
         workspace_id?: string | undefined;
-        events?: ("webhook.test" | "post.created" | "post.updated" | "post.deleted" | "post.publishing" | "post.published" | "post.failed" | "account.disconnected" | "analytics.synced" | "approval.requested" | "approval.approved" | "approval.changes_requested" | "approval.rejected" | "approval.commented")[] | undefined;
         is_active?: boolean | undefined;
+        events?: ("webhook.test" | "post.created" | "post.updated" | "post.deleted" | "post.publishing" | "post.published" | "post.failed" | "account.disconnected" | "analytics.synced" | "approval.requested" | "approval.approved" | "approval.changes_requested" | "approval.rejected" | "approval.commented")[] | undefined;
     }>;
     execute(client: PosterlyClient, input: {
         url: string;