posterly-mcp-server 0.45.3 → 0.47.0

package/src/tools/create-signed-upload.ts

@@ -9,13 +9,14 @@ export const createSignedUploadTool = {
     filename: z.string().describe('Filename with extension, e.g. launch-video.mp4'),
     content_type: z.string().describe('MIME type, e.g. video/mp4'),
     size: z.number().int().positive().describe('File size in bytes'),
+    workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
   }),
 
   async execute(
     client: PosterlyClient,
-    input: { filename: string; content_type: string; size: number },
+    input: { filename: string; content_type: string; size: number; workspace_id?: string },
   ) {
-    const signed = await client.getSignedUploadUrl(input.filename, input.content_type, input.size);
+    const signed = await client.getSignedUploadUrl(input.filename, input.content_type, input.size, input.workspace_id);
     return [
       'Signed upload created.',
       `• Upload URL: ${signed.upload_url}`,

package/src/tools/delete-post.ts

@@ -6,6 +6,7 @@ import { previewThenConfirm, validateArgs, type ToolContext } from '../lib/tool-
 type DeletePostInput = {
   post_id?: number;
   group_id?: string;
+  confirm_published?: boolean;
   confirm?: boolean;
   preview_id?: string;
 };
@@ -13,10 +14,14 @@ type DeletePostInput = {
 export const deletePostTool = {
   name: 'delete_post',
   description:
-    'Delete posts. DESTRUCTIVE and IRREVERSIBLE: deleted posts and captions cannot be recovered, and published or currently publishing posts are never deleted. post_id: delete one scheduled or draft post; fetch it with `get_post` first, show the user what will be deleted (caption, account, scheduled time), and pass confirm=true only after explicit confirmation ("yes delete it", "remove it"). group_id: delete every draft, scheduled, failed, or paused post matching a caller-defined group_id, post_group_id, api_group_id, or release_id; preview then confirm: call without confirm to get a preview and preview_id, show it, then call again with confirm=true and that preview_id. Never delete several posts one by one without listing each and confirming the full list.',
+    'Delete posts. DESTRUCTIVE and IRREVERSIBLE: deleted posts and captions cannot be recovered. post_id: delete one post; fetch it with `get_post` first, show the user what will be deleted (caption, account, scheduled time), and pass confirm=true only after explicit confirmation ("yes delete it", "remove it"). A post that is currently publishing is never deleted. A published post is taken down only when the user also explicitly confirms the live removal and you pass confirm_published=true. Instagram and Facebook are attempted when the stored id and token allow it. Every other platform, or a live URL with no id, returns platform_delete_unsupported and the posterly row is kept. A published post with no live URL and no platform id is removed from posterly only. group_id: delete every draft, scheduled, failed, or paused post matching a caller-defined group_id, post_group_id, api_group_id, or release_id. A group delete never removes published posts. Preview then confirm: call without confirm to get a preview and preview_id, show it, then call again with confirm=true and that preview_id. Never delete several posts one by one without listing each and confirming the full list.',
   inputSchema: z.object({
     post_id: z.number().optional().describe('Delete this one post.'),
-    group_id: z.string().min(1).max(160).optional().describe('Delete every unpublished post in this group or release instead.'),
+    group_id: z.string().min(1).max(160).optional().describe('Delete every unpublished post in this group or release instead. Never deletes published posts.'),
+    confirm_published: z
+      .boolean()
+      .optional()
+      .describe('With post_id only. True only after the user explicitly confirms taking a live Instagram or Facebook post down. Without it, a published post is refused and kept.'),
     confirm: z
       .boolean()
       .optional()
@@ -44,7 +49,7 @@ export const deletePostTool = {
         // GET /api/v1/posts has no group filter, so the preview says in plain
         // words which posts match instead of listing them.
         describe: async () => [
-          `Deletes every draft, scheduled, failed, or paused post whose group_id, post_group_id, api_group_id, or release_id is ${code(args.group_id)}. Published posts are never deleted. This cannot be undone.`,
+          `Deletes every draft, scheduled, failed, or paused post whose group_id, post_group_id, api_group_id, or release_id is ${code(args.group_id)}. A group delete never removes published posts. This cannot be undone.`,
           'To see the posts first, call list_posts and check each post\'s group or release ID.',
         ].join('\n\n'),
         run: async () => {
@@ -53,17 +58,21 @@ export const deletePostTool = {
         },
       });
     }
-    return deleteOne(client, args as { post_id: number; confirm?: boolean });
+    return deleteOne(client, args as { post_id: number; confirm?: boolean; confirm_published?: boolean });
   },
 };
 
-async function deleteOne(client: PosterlyClient, input: { post_id: number; confirm?: boolean }): Promise<string> {
+async function deleteOne(
+  client: PosterlyClient,
+  input: { post_id: number; confirm?: boolean; confirm_published?: boolean },
+): Promise<string> {
   if (input.confirm !== true) {
     throw new Error('Refusing to delete post without confirm=true after explicit user confirmation.');
   }
-  const result = await client.deletePost(input.post_id);
+  const result = await client.deletePost(input.post_id, { confirmPublished: input.confirm_published === true });
+  const platformDelete = result.platform_delete ? ` Platform delete: ${result.platform_delete}.` : '';
   return [
-    `Post #${result.id} deleted successfully.`,
+    `Post #${result.id} deleted successfully.${platformDelete}`,
     'It has been removed from the posterly queue.',
     `View queue in posterly: ${dashboardUrlForPosts()}`,
     '',

package/src/tools/generate-image.ts

@@ -65,6 +65,7 @@ export const generateImageTool = {
       .max(14)
       .optional()
       .describe('Google only. Up to 14 HTTPS image URLs used as references (logo, product, style lock). Same as dashboard reference images.'),
+    workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
     confirm: z.literal(true).describe('Must be true after explicit user confirmation of subject, style, aspect ratio, quality, and credit use.'),
   }),
 
@@ -81,6 +82,7 @@ export const generateImageTool = {
       quality?: 'low' | 'medium' | 'high';
       thinking_level?: 'minimal' | 'high';
       reference_image_urls?: string[];
+      workspace_id?: string;
       confirm: true;
     }
   ) {

package/src/tools/generate-video.ts

@@ -21,6 +21,7 @@ export const generateVideoTool = {
     })).max(3).optional(),
     generate_audio: z.boolean().default(true).optional().describe('Google can disable generated audio. xAI Grok includes audio and requires this to remain true.'),
     source_video_url: z.string().url().optional(),
+    workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
     confirm: z.literal(true).describe('Must be true after explicit user confirmation of prompt, model, duration, resolution, and credit cost.'),
   }),
 

package/src/tools/list-analytics.ts

@@ -29,7 +29,7 @@ type ListAnalyticsInput = {
 export const listAnalyticsTool = {
   name: 'list_analytics',
   description:
-    'Analytics for connected social accounts (Instagram, Facebook, LinkedIn, Google Business Profile, Pinterest, YouTube, and Threads). view=accounts (account_id): daily snapshots and a period summary with platform-native display_metrics labels. view=posts (account_id): per-post likes, comments/replies, reach, impressions/views, saves, shares, reposts, quotes, plays, clicks, and watch time, most recent first, with limit/offset. view=insights: per-post feedback insights with a performance tier (great/good/mixed/poor), diagnosis, next action, and baseline, filtered by account_id, post_id, or checkpoint (1h, 6h, 24h, 72h, 7d); read-only, Pro plan or higher. presentation (accounts and posts): compact for Telegram/mobile, table for Markdown clients, json for custom chart/card renderers.',
+    'Analytics for connected social accounts (Instagram, Facebook, LinkedIn, Google Business Profile, Pinterest, YouTube, and Threads). view=accounts (account_id): daily snapshots and a period summary with platform-native display_metrics labels. Google Business Profile account analytics includes Calls, Website clicks, and Directions along with Profile Views, Search Views, Maps Views, Customer Actions, and Posts. view=posts (account_id): per-post likes, comments/replies, reach, impressions/views, saves, shares, reposts, quotes, plays, clicks, and watch time, most recent first, with limit/offset. view=insights: per-post feedback insights with a performance tier (great/good/mixed/poor), diagnosis, next action, and baseline, filtered by account_id, post_id, or checkpoint (1h, 6h, 24h, 72h, 7d); read-only, Pro plan or higher. presentation (accounts and posts): compact for Telegram/mobile, table for Markdown clients, json for custom chart/card renderers.',
   inputSchema: z.object({
     view: z.enum(['accounts', 'posts', 'insights']).describe('accounts, posts, or insights.'),
     account_id: z
@@ -194,6 +194,9 @@ function accountMetricRows(summary: AccountAnalyticsSummary, platform: string):
       ['Search Views', formatNumber(metrics.search_views ?? summary.total_reach)],
       ['Maps Views', formatNumber(metrics.maps_views ?? summary.total_profile_views)],
       ['Customer Actions', formatNumber(metrics.customer_actions ?? summary.total_accounts_engaged)],
+      ['Calls', formatNumber(metrics.call_clicks ?? summary.total_call_clicks)],
+      ['Directions', formatNumber(metrics.direction_requests ?? summary.total_direction_requests)],
+      ['Website clicks', formatNumber(metrics.website_clicks ?? summary.total_website_clicks)],
       ['Posts', formatNumber(metrics.posts ?? summary.current_media_count)],
     ];
   }

package/src/tools/list-posts.ts

@@ -6,7 +6,7 @@ import { SUPPORTED_PLATFORM_INPUTS, SUPPORTED_PLATFORM_IDS } from '../generated/
 export const listPostsTool = {
   name: 'list_posts',
   description:
-    'List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, workspace_id, approval_status, or brand_id. Returns posts in your workspaces, teammates\' too, per your role there (brand-locked seats only see their assigned brands). If workspace_id is omitted, this searches every workspace you belong to.',
+    'List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, workspace_id, approval_status, approval_waiting_on, or brand_id. approval_waiting_on=client is the same queue as approval_status=pending_client. Each post includes approval.pending_client_approval. Returns posts in your workspaces, teammates\' too, per your role there (brand-locked seats only see their assigned brands). If workspace_id is omitted, this searches every workspace you belong to.',
   inputSchema: z.object({
     status: z
       .string()
@@ -34,6 +34,10 @@ export const listPostsTool = {
       .enum(['none', 'pending_client', 'approved', 'changes_requested', 'rejected'])
       .optional()
       .describe('Filter by client review approval status. pending_client means the post is waiting on the client.'),
+    approval_waiting_on: z
+      .enum(['client', 'team'])
+      .optional()
+      .describe('client: approval_status pending_client. team: changes_requested or rejected. Conflicts with a non-overlapping approval_status.'),
     brand_id: z
       .string()
       .optional()
@@ -49,6 +53,7 @@ export const listPostsTool = {
       limit?: number;
       workspace_id?: string;
       approval_status?: string;
+      approval_waiting_on?: 'client' | 'team';
       brand_id?: string;
     }
   ) {

package/src/tools/list-workspace-members.ts

@@ -7,6 +7,19 @@ export function formatBrandIds(value: string[] | null | undefined): string {
   return value.length === 0 ? 'every brand' : value.map((id) => code(id)).join(', ');
 }
 
+/** API and AI app access for one member (issue #1170). */
+export function formatApiAccess(member: { role?: string | null; api_access?: boolean; api_usage?: { key_count: number; last_used_at: string | null; connected_apps: string[] } }): string {
+  if (member.api_access === undefined) return '';
+  const base = member.role === 'owner' ? 'owner' : member.api_access ? 'on' : 'off';
+  const usage = member.api_usage;
+  if (!usage) return base;
+  const parts: string[] = [];
+  if (usage.key_count > 0) parts.push(`${usage.key_count} key${usage.key_count === 1 ? '' : 's'}`);
+  if (usage.connected_apps.length > 0) parts.push(usage.connected_apps.join(', '));
+  if (usage.last_used_at) parts.push(`last used ${usage.last_used_at}`);
+  return parts.length > 0 ? `${base} (${parts.join('; ')})` : base;
+}
+
 function formatWorkspaceMembers(result: WorkspaceMembersResponse): string {
   const members = result.members || [];
   const invites = result.invites || [];
@@ -14,7 +27,7 @@ function formatWorkspaceMembers(result: WorkspaceMembersResponse): string {
     mdTitle(`Team (${members.length} members, ${invites.length} pending invites)`, `Workspace ${result.workspace_id}`),
     mdSection('Members', members.length > 0
       ? mdTable(
-          ['Name', 'Member ID', 'Email', 'Role', 'Status', 'Brands'],
+          ['Name', 'Member ID', 'Email', 'Role', 'Status', 'Brands', 'API access'],
           members.map((member) => [
             member.name || member.email || member.id,
             code(member.id),
@@ -22,6 +35,7 @@ function formatWorkspaceMembers(result: WorkspaceMembersResponse): string {
             member.role,
             member.status,
             formatBrandIds(member.brand_ids),
+            formatApiAccess(member),
           ]),
         )
       : 'No members found.'),
@@ -48,7 +62,7 @@ function formatWorkspaceMembers(result: WorkspaceMembersResponse): string {
 export const listWorkspaceMembersTool = {
   name: 'list_workspace_members',
   description:
-    'List the people in a workspace: members (with role, status and brand access) and pending invites, plus seats in use. Needs an API key with the Manage team permission. Any workspace member can list; brand-limited teammates only see brand ids they can access.',
+    'List the people in a workspace: members (with role, status, brand access and API access) and pending invites, plus seats in use. API access says whether a teammate can use this workspace\'s API plan from their own keys and AI apps; owners and admins also see each member\'s key count, connected AI apps and last use. Needs an API key with the Manage team permission. Any workspace member can list; brand-limited teammates only see brand ids they can access.',
   inputSchema: z.object({
     workspace_id: z.string().describe('Workspace ID (from whoami).'),
   }),

package/src/tools/manage-workspace-member.ts

@@ -5,7 +5,7 @@ import type {
   WorkspaceMemberRole,
 } from '../lib/api-client.js';
 import { code, mdKeyValue, mdSection, mdTitle } from '../lib/format.js';
-import { formatBrandIds } from './list-workspace-members.js';
+import { formatApiAccess, formatBrandIds } from './list-workspace-members.js';
 
 const ACTIONS = ['invite', 'update', 'remove'] as const;
 const ROLES = ['publisher', 'editor', 'viewer'] as const;
@@ -19,6 +19,7 @@ export type ManageWorkspaceMemberInput = {
   resend?: boolean;
   member_id?: string;
   invite_id?: string;
+  api_access?: boolean;
   confirm?: boolean;
   preview_id?: string;
 };
@@ -49,6 +50,9 @@ function formatChange(result: WorkspaceMemberChangeResponse): string {
         ['Seats', preview.counts_toward_seats && preview.seat_limit != null
           ? `${preview.seats_used} in use of ${preview.seat_limit === -1 ? 'unlimited' : preview.seat_limit}`
           : ''],
+        ['API access', typeof preview.api_access === 'boolean'
+          ? `${preview.previous_api_access ? 'on' : 'off'} -> ${preview.api_access ? 'on' : 'off'}`
+          : ''],
       ])),
       mdSection('Preview ID', `${code(result.preview_id || '')} (expires ${result.preview_expires_at || 'soon'})`),
       mdSection('Next step', 'Show this preview to the user. Only after they explicitly approve, call manage_workspace_member again with the same fields plus confirm: true and this preview_id.'),
@@ -64,6 +68,7 @@ function formatChange(result: WorkspaceMemberChangeResponse): string {
       ['Role', subject?.role],
       ['Status', subject?.status],
       ['Brands', subject?.brand_ids ? formatBrandIds(subject.brand_ids) : ''],
+      ['API access', result.member ? formatApiAccess(result.member) : ''],
       ['Invite email sent', typeof result.email_sent === 'boolean' ? (result.email_sent ? 'yes' : 'no, ask them to check spam or resend later') : ''],
       ['Workspace owner notified', result.owner_notified ? 'yes' : ''],
     ])),
@@ -88,14 +93,19 @@ export function validateManageWorkspaceMemberInput(input: ManageWorkspaceMemberI
     if (!has(raw, 'email') || !has(raw, 'role')) return 'action=invite needs email and role (publisher, editor or viewer).';
     return null;
   }
-  const notAllowed = input.action === 'update' ? ['email', 'resend'] : ['email', 'resend', 'role', 'brand_ids'];
+  const notAllowed = input.action === 'update' ? ['email', 'resend'] : ['email', 'resend', 'role', 'brand_ids', 'api_access'];
   const extra = notAllowed.filter((key) => has(raw, key));
   if (extra.length) return `action=${input.action} does not take ${extra.join(', ')}.`;
   if (has(raw, 'member_id') === has(raw, 'invite_id')) {
     return `action=${input.action} needs exactly one of member_id or invite_id (from list_workspace_members).`;
   }
+  if (input.action === 'update' && has(raw, 'api_access')) {
+    if (has(raw, 'invite_id')) return 'api_access can only be set on a member (member_id), not a pending invite.';
+    if (has(raw, 'role') || has(raw, 'brand_ids')) return 'Change api_access in its own call, without role or brand_ids.';
+    return null;
+  }
   if (input.action === 'update' && !has(raw, 'role') && !has(raw, 'brand_ids')) {
-    return 'action=update needs role, brand_ids, or both.';
+    return 'action=update needs role, brand_ids, or both; or api_access on its own.';
   }
   return null;
 }
@@ -103,7 +113,7 @@ export function validateManageWorkspaceMemberInput(input: ManageWorkspaceMemberI
 export const manageWorkspaceMemberTool = {
   name: 'manage_workspace_member',
   description:
-    'Invite, update, or remove a workspace colleague. This SENDS EMAILS and CHANGES WHO CAN ACCESS the workspace. Needs an API key with the Manage team permission, and the caller must be a workspace owner or admin. ALWAYS preview first: call without confirm, show the returned preview summary to the user, and only call again with confirm: true plus the returned preview_id after the user explicitly approves. action=invite: email and role required (publisher, editor or viewer), optional brand_ids and resend; always sends a pending invite email, never adds anyone instantly. action=update: member_id or invite_id (from list_workspace_members) plus role and/or brand_ids. action=remove: member_id (removes the teammate and revokes their API keys for this workspace) or invite_id (cancels a pending invite). Admin seats can only be granted in the posterly dashboard. The workspace owner is emailed about every change.',
+    'Invite, update, or remove a workspace colleague. This SENDS EMAILS and CHANGES WHO CAN ACCESS the workspace. Needs an API key with the Manage team permission, and the caller must be a workspace owner or admin. ALWAYS preview first: call without confirm, show the returned preview summary to the user, and only call again with confirm: true plus the returned preview_id after the user explicitly approves. action=invite: email and role required (publisher, editor or viewer), optional brand_ids and resend; always sends a pending invite email, never adds anyone instantly. action=update: member_id or invite_id (from list_workspace_members) plus role and/or brand_ids; or member_id plus api_access (true or false, on its own) to turn API and AI app access on or off for that teammate, which lets them use the workspace API plan from their own keys and AI apps (off by default; you cannot change your own; only the owner can change it for an admin; turning it off stops their keys, AI app connections and webhooks for this workspace). action=remove: member_id (removes the teammate and revokes their API keys for this workspace) or invite_id (cancels a pending invite). Admin seats can only be granted in the posterly dashboard. The workspace owner is emailed about every change.',
   inputSchema: z.object({
     action: z.enum(ACTIONS).describe('invite, update, or remove.'),
     workspace_id: z.string().describe('Workspace ID (from whoami).'),
@@ -113,6 +123,7 @@ export const manageWorkspaceMemberTool = {
     resend: z.boolean().optional().describe('action=invite only: email an unchanged pending invite again.'),
     member_id: z.string().optional().describe('action=update or action=remove: a member ID from list_workspace_members.'),
     invite_id: z.string().optional().describe('action=update or action=remove: a pending invite ID from list_workspace_members.'),
+    api_access: z.boolean().optional().describe('action=update with member_id only, on its own: true lets the teammate use this workspace\'s API plan from their own keys and AI apps; false turns it off.'),
     confirm: z.boolean().optional().describe('Leave out to get a preview. Set true only after the user explicitly approved the preview, together with preview_id.'),
     preview_id: z.string().optional().describe('The preview_id returned by the preview call. Required with confirm: true.'),
   }),
@@ -141,6 +152,7 @@ export const manageWorkspaceMemberTool = {
       result = await client.updateWorkspaceMember(workspaceId, target, {
         ...(input.role !== undefined ? { role: input.role } : {}),
         ...(input.brand_ids !== undefined ? { brand_ids: input.brand_ids } : {}),
+        ...(input.api_access !== undefined ? { api_access: input.api_access } : {}),
         ...confirmFields,
       });
     } else {

package/src/tools/update-post.ts

@@ -127,12 +127,15 @@ type UpdatePostInput = EditInput & {
   status?: 'scheduled' | 'paused' | 'draft';
   release_id?: string;
   group_id?: string;
+  approval_action?: 'request' | 'approve' | 'request_changes' | 'reject';
+  approval_axis?: 'asset' | 'caption';
+  approval_note?: string;
 };
 
 export const updatePostTool = {
   name: 'update_post',
   description:
-    'Change a scheduled or draft post. DESTRUCTIVE WRITE. Edit (default): caption, media, schedule, post_type, or settings; overwrites the existing post; cannot edit published or currently publishing posts; if a client has already approved the post, a caption edit reopens caption approval, a media or thumbnail edit reopens asset approval, and a reschedule, account change or settings change reopens both. status (scheduled, paused, or draft, with scheduled_at when scheduling a draft): pause, resume, or move back to draft; send it on its own. release_id (with optional group_id): set or repair external release/group IDs; send it on its own.\n\n' +
+    'Change a scheduled or draft post. DESTRUCTIVE WRITE. Edit (default): caption, media, schedule, post_type, or settings; overwrites the existing post; cannot edit published or currently publishing posts; if a client has already approved the post, a caption edit reopens caption approval, a media or thumbnail edit reopens asset approval, and a reschedule, account change or settings change reopens both. status (scheduled, paused, or draft, with scheduled_at when scheduling a draft): pause, resume, or move back to draft; send it on its own. release_id (with optional group_id): set or repair external release/group IDs; send it on its own. approval_action (request, approve, request_changes, or reject): change client approval. Only a workspace owner or admin may do this. The actor is the API key user, never a brand guest. request emails the brand reviewers. approve, request_changes, and reject are team-side decisions. request_changes needs approval_note. Optional approval_axis is asset or caption; omit it for both. Send approval_action on its own.\n\n' +
     'REQUIRED BEFORE CALLING: Show the user a side-by-side of the CURRENT post (caption, scheduled time, media, status) and the PROPOSED change, and get explicit confirmation ("yes update it", "apply those changes") before calling. Do not auto-edit posts based on a general instruction - each change needs its own confirmation.',
   inputSchema: z.object({
     post_id: z.number().describe('The post ID to update'),
@@ -170,6 +173,18 @@ export const updatePostTool = {
       .optional()
       .describe('Set an external release ID instead of editing the post. Send with post_id and optional group_id only.'),
     group_id: z.string().min(1).max(160).optional().describe('With release_id only: an external group/campaign ID.'),
+    approval_action: z
+      .enum(['request', 'approve', 'request_changes', 'reject'])
+      .optional()
+      .describe('Change client approval instead of editing the post. Owner or admin only. The actor is the API key user, never a brand guest. Send on its own.'),
+    approval_axis: z
+      .enum(['asset', 'caption'])
+      .optional()
+      .describe('With approval_action approve, request_changes, or reject: which axis to decide. Omit for both. Not allowed with request.'),
+    approval_note: z
+      .string()
+      .optional()
+      .describe('Note stored with the approval change. Required for request_changes.'),
     confirm: z.literal(true).describe('Must be true after explicit user confirmation of the proposed change.'),
   }),
 
@@ -193,6 +208,15 @@ export const updatePostTool = {
     const { mode, args } = validateArgs(ctx, 'update_post', input);
     if (mode === 'status') return updateStatus(client, args as { post_id: number; status: 'scheduled' | 'paused' | 'draft'; scheduled_at?: string; confirm: boolean });
     if (mode === 'release_id') return updateReleaseId(client, args as { post_id: number; release_id: string; group_id?: string; confirm: true });
+    if (mode === 'approval') {
+      return updateApproval(client, args as {
+        post_id: number;
+        approval_action: 'request' | 'approve' | 'request_changes' | 'reject';
+        approval_axis?: 'asset' | 'caption';
+        approval_note?: string;
+        confirm: true;
+      });
+    }
     return editPost(client, args as EditInput);
   },
 };
@@ -241,6 +265,27 @@ async function updateStatus(
   return `Post #${input.post_id} status changed from ${transition.old_status || 'unknown'} to ${transition.new_status || input.status}.`;
 }
 
+async function updateApproval(
+  client: PosterlyClient,
+  input: {
+    post_id: number;
+    approval_action: 'request' | 'approve' | 'request_changes' | 'reject';
+    approval_axis?: 'asset' | 'caption';
+    approval_note?: string;
+    confirm: true;
+  },
+): Promise<string> {
+  if (input.confirm !== true) {
+    throw new Error('Refusing to change client approval without confirm=true after explicit user confirmation. Only a workspace owner or admin can do this, and the actor is the API key user, never a brand guest.');
+  }
+  const result = await client.setPostApproval(input.post_id, {
+    action: input.approval_action,
+    axis: input.approval_axis,
+    note: input.approval_note,
+  });
+  return JSON.stringify(result, null, 2);
+}
+
 async function updateReleaseId(
   client: PosterlyClient,
   input: { post_id: number; release_id: string; group_id?: string; confirm: true },

package/src/tools/upload-media.ts

@@ -9,6 +9,7 @@ type UploadMediaInput = {
   url?: string;
   filename?: string;
   content_type?: string;
+  workspace_id?: string;
 };
 
 export const uploadMediaTool = {
@@ -38,6 +39,7 @@ export const uploadMediaTool = {
       .string()
       .optional()
       .describe('MIME type (auto-detected from filename if omitted)'),
+    workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
   }),
   /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
   legacySchemas: {
@@ -50,7 +52,7 @@ export const uploadMediaTool = {
 
   async execute(client: PosterlyClient, input: UploadMediaInput, ctx: ToolContext) {
     const { mode, args } = validateArgs(ctx, 'upload_media', input);
-    if (mode === 'url') return uploadFromUrl(client, args as { url: string; filename?: string; content_type?: string });
+    if (mode === 'url') return uploadFromUrl(client, args as { url: string; filename?: string; content_type?: string; workspace_id?: string });
     return uploadFile(client, args as UploadMediaInput & { filename: string });
   },
 };
@@ -62,6 +64,7 @@ async function uploadFile(
     base64_data?: string;
     filename: string;
     content_type?: string;
+    workspace_id?: string;
   },
 ): Promise<string> {
   if (!input.file_path && !input.base64_data) {
@@ -73,6 +76,7 @@ async function uploadFile(
     base64Data: input.base64_data,
     filename: input.filename,
     contentType: input.content_type,
+    workspaceId: input.workspace_id,
   });
 
   return mdSuccess('Media uploaded', [
@@ -83,12 +87,13 @@ async function uploadFile(
 
 async function uploadFromUrl(
   client: PosterlyClient,
-  input: { url: string; filename?: string; content_type?: string },
+  input: { url: string; filename?: string; content_type?: string; workspace_id?: string },
 ): Promise<string> {
   const result = await client.uploadMediaFromUrl({
     url: input.url,
     filename: input.filename,
     contentType: input.content_type,
+    workspaceId: input.workspace_id,
   });
   return [
     'Remote media uploaded successfully.',

package/tool-registry.json

@@ -736,6 +736,43 @@
               "type": "string"
             }
           }
+        },
+        "approval": {
+          "label": "Request, approve, request changes, or reject client review",
+          "destructive": true,
+          "idempotent": true,
+          "openWorld": false,
+          "confirm": "confirm",
+          "when": [
+            "approval_action"
+          ],
+          "params": {
+            "post_id": {
+              "type": "integer",
+              "min": 1,
+              "required": true
+            },
+            "approval_action": {
+              "type": "string",
+              "enum": [
+                "request",
+                "approve",
+                "request_changes",
+                "reject"
+              ],
+              "required": true
+            },
+            "approval_axis": {
+              "type": "string",
+              "enum": [
+                "asset",
+                "caption"
+              ]
+            },
+            "approval_note": {
+              "type": "string"
+            }
+          }
         }
       }
     },
@@ -760,6 +797,9 @@
               "type": "integer",
               "min": 1,
               "required": true
+            },
+            "confirm_published": {
+              "type": "boolean"
             }
           }
         },
@@ -823,6 +863,9 @@
             },
             "content_type": {
               "type": "string"
+            },
+            "workspace_id": {
+              "type": "string"
             }
           }
         },
@@ -845,6 +888,9 @@
             },
             "content_type": {
               "type": "string"
+            },
+            "workspace_id": {
+              "type": "string"
             }
           }
         }