diff --git a/.env.example b/.env.example
index 6d137ca6..b26ac170 100644
--- a/.env.example
+++ b/.env.example
@@ -443,6 +443,34 @@ TWILIO_CALLER_ID=
 # spoken disclaimer plays. Ontario is one-party consent; keep the disclaimer.
 TWILIO_RECORD_CALLS=
 
+# ── SMS outreach (admin → /admin/sms, Twilio Messages API) ──────────────────
+# Reuses TWILIO_ACCOUNT_SID / TWILIO_AUTH_TOKEN above. Needs an SMS SENDER —
+# a Messaging Service (MGxxxx, preferred: A2P 10DLC + native opt-out) OR a plain
+# SMS-capable number. Separate from TWILIO_CALLER_ID (Voice-only).
+TWILIO_MESSAGING_SERVICE_SID=
+TWILIO_SMS_FROM=
+# SAFETY: dry-run until explicitly false. Dry-run logs + prices without sending.
+SMS_DRY_RUN=true
+# Cost planning: your Twilio per-segment price (CA long-code ≈ 0.0079 USD).
+SMS_PRICE_PER_SEGMENT=0.0079
+SMS_CURRENCY=USD
+# CTA link + label placed in every message (defaults to NEXT_PUBLIC_SITE_URL/onboarding).
+SMS_CTA_URL=
+SMS_CTA_LABEL=Get started
+# Throttle + quiet hours (recipient local time — TCPA/CASL friendly).
+SMS_RATE_PER_SEC=1
+SMS_QUIET_START_HOUR=9
+SMS_QUIET_END_HOUR=21
+SMS_TIMEZONE=America/Toronto
+SMS_ENFORCE_QUIET_HOURS=true
+# Groq model for AI personalization (defaults to GROQ_MODEL / llama-3.1-8b-instant).
+GROQ_SMS_MODEL=
+# Where Twilio POSTs delivery receipts + STOP replies. Defaults to NEXT_PUBLIC_SITE_URL.
+# In dev, set to a tunnel (ngrok/cloudflared) so the webhook is reachable.
+SMS_WEBHOOK_BASE_URL=
+# Set false only if TLS/proxy termination prevents Twilio signature verification.
+SMS_VALIDATE_SIGNATURE=true
+
 # ── Web Push (device notifications, VAPID) ──────────────────────────────────
 # Device push as an extra channel on createNotification (high-value types only).
 # Generate a keypair: node -e "console.log(require('web-push').generateVAPIDKeys())"
diff --git a/.gitignore b/.gitignore
index e077f412..80c59230 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,6 +19,10 @@ Urban Company EnE.pdf
 # Local MCP config (may hold a Supabase access token)
 .mcp.json
 
+# SMS outreach starter list — PII (real names + phone numbers). Loaded at runtime
+# by /api/admin/sms/seed; must never be committed.
+data/sms-seed-taskers.csv
+
 # playwright-cli scratch (snapshots/screenshots)
 .playwright-cli/
 verify-wizard.png
diff --git a/app/(admin)/admin/AdminShell.tsx b/app/(admin)/admin/AdminShell.tsx
index 9a036f1e..2b4ea893 100644
--- a/app/(admin)/admin/AdminShell.tsx
+++ b/app/(admin)/admin/AdminShell.tsx
@@ -36,6 +36,7 @@ import {
   Coins,
   Newspaper,
   Globe,
+  Send,
 } from 'lucide-react';
 import { cn } from '@/lib/utils';
 import NotificationsDropdown from '@/components/customer/NotificationsDropdown';
@@ -95,6 +96,12 @@ const NAV: ReadonlyArray<NavSection> = [
       { href: '/admin/pages', label: 'Pages', icon: Globe },
     ],
   },
+  {
+    title: 'Growth',
+    items: [
+      { href: '/admin/sms', label: 'SMS outreach', icon: Send },
+    ],
+  },
   {
     title: 'Analytics',
     items: [
diff --git a/app/(admin)/admin/sms/page.tsx b/app/(admin)/admin/sms/page.tsx
new file mode 100644
index 00000000..51ed8bfe
--- /dev/null
+++ b/app/(admin)/admin/sms/page.tsx
@@ -0,0 +1,444 @@
+'use client';
+
+// Admin → SMS outreach. Paste/upload a list (or load the starter taskers / approved
+// providers), preview AI-personalized messages, see the cost, then dry-run or send
+// live. The send is client-orchestrated in chunks so it never hits a function
+// timeout; each chunk POSTs to /api/admin/sms/send and streams results back.
+
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { Button, Card, Textarea, Badge } from '@/components/ui';
+import { parseRecipients } from '@/lib/sms/recipients';
+import { composeBody, type Recipient } from '@/lib/sms/message';
+import { isValidE164 } from '@/lib/sms/segments';
+
+const CHUNK = 25;
+
+interface SummaryConfig {
+  dryRun: boolean;
+  pricePerSegment: number;
+  currency: string;
+  ctaUrl: string;
+  ctaLabel: string;
+  quietHours: string;
+  ratePerSec: number;
+  smsConfigured: boolean;
+  sender: string | null;
+}
+interface Stats {
+  totalAttempts: number;
+  liveSent: number;
+  delivered: number;
+  failed: number;
+  optedOut: number;
+  spend: number;
+  currency: string;
+}
+interface LogRow {
+  phone: string;
+  name: string | null;
+  status: string;
+  segments: number | null;
+  price: number | null;
+  currency: string;
+  error: string | null;
+  dry_run: boolean;
+  created_at: string;
+}
+interface Preview {
+  name: string;
+  phone: string;
+  body: string;
+  segments: number;
+  encoding: string;
+  source: string;
+  cost: number;
+}
+interface SendItem {
+  phone: string;
+  name?: string;
+  status: 'sent' | 'dry-run' | 'failed' | 'skipped';
+  reason?: string;
+}
+
+function money(n: number | null | undefined, c = 'USD') {
+  const v = Number(n || 0);
+  return (c === 'USD' ? '$' : '') + v.toFixed(4) + (c && c !== 'USD' ? ' ' + c : '');
+}
+
+export default function SmsOutreachPage() {
+  const [config, setConfig] = useState<SummaryConfig | null>(null);
+  const [stats, setStats] = useState<Stats | null>(null);
+  const [log, setLog] = useState<LogRow[]>([]);
+  const [raw, setRaw] = useState('');
+  const [dryRun, setDryRun] = useState(true);
+  const [previews, setPreviews] = useState<Preview[]>([]);
+  const [busy, setBusy] = useState<string>('');
+  const [progress, setProgress] = useState<{ done: number; total: number } | null>(null);
+  const [runResults, setRunResults] = useState<SendItem[]>([]);
+  const [err, setErr] = useState('');
+
+  const loadSummary = useCallback(async () => {
+    try {
+      const r = await fetch('/api/admin/sms/summary').then((x) => x.json());
+      setConfig(r.config);
+      setStats(r.stats);
+      setDryRun(r.config?.dryRun ?? true);
+    } catch (e) {
+      setErr(String(e));
+    }
+  }, []);
+  const loadLog = useCallback(async () => {
+    try {
+      const r = await fetch('/api/admin/sms/log?limit=100').then((x) => x.json());
+      setLog(r.rows || []);
+    } catch {
+      /* ignore */
+    }
+  }, []);
+
+  useEffect(() => {
+    loadSummary();
+    loadLog();
+  }, [loadSummary, loadLog]);
+
+  // Parse + estimate happen entirely client-side (shared pure lib).
+  const parsed = useMemo(() => parseRecipients(raw), [raw]);
+  const estimate = useMemo(() => {
+    if (!config) return null;
+    let segments = 0;
+    for (const r of parsed.recipients) {
+      const c = composeBody(r, null, { ctaUrl: config.ctaUrl, ctaLabel: config.ctaLabel });
+      segments += c.segments;
+    }
+    return {
+      count: parsed.recipients.length,
+      segments,
+      cost: +(segments * config.pricePerSegment).toFixed(4),
+    };
+  }, [parsed, config]);
+
+  async function loadSeed() {
+    setBusy('seed');
+    setErr('');
+    try {
+      const r = await fetch('/api/admin/sms/seed').then((x) => x.json());
+      if (r.available) setRaw(r.csv);
+      else setErr(r.note || 'No starter list available.');
+    } catch (e) {
+      setErr(String(e));
+    } finally {
+      setBusy('');
+    }
+  }
+
+  async function loadProviders() {
+    setBusy('providers');
+    setErr('');
+    try {
+      const r = await fetch('/api/admin/sms/providers').then((x) => x.json());
+      const lines = ['name,phone,city,category'];
+      for (const rec of r.recipients as Recipient[]) {
+        lines.push([csv(rec.name), rec.phone, csv(rec.city), csv(rec.category)].join(','));
+      }
+      setRaw(lines.join('\n'));
+      if (r.withoutPhone) setErr(`${r.withoutPhone} approved providers skipped (no phone on file).`);
+    } catch (e) {
+      setErr(String(e));
+    } finally {
+      setBusy('');
+    }
+  }
+
+  async function onFile(e: React.ChangeEvent<HTMLInputElement>) {
+    const file = e.target.files?.[0];
+    if (!file) return;
+    setRaw(await file.text());
+  }
+
+  async function preview() {
+    setBusy('preview');
+    setErr('');
+    try {
+      const r = await fetch('/api/admin/sms/preview', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ recipients: parsed.recipients.slice(0, 5) }),
+      }).then((x) => x.json());
+      setPreviews(r.previews || []);
+    } catch (e) {
+      setErr(String(e));
+    } finally {
+      setBusy('');
+    }
+  }
+
+  async function run() {
+    const recipients = parsed.recipients.filter((r) => isValidE164(r.phone));
+    if (recipients.length === 0) {
+      setErr('No valid recipients to send.');
+      return;
+    }
+    if (!dryRun) {
+      const ok = window.confirm(
+        `LIVE SEND to ${recipients.length} numbers. This sends real SMS via Twilio and charges the account. ` +
+          `Only contact people you have a lawful basis to message. Continue?`,
+      );
+      if (!ok) return;
+    }
+    setBusy('send');
+    setErr('');
+    setRunResults([]);
+    setProgress({ done: 0, total: recipients.length });
+    const acc: SendItem[] = [];
+    try {
+      for (let i = 0; i < recipients.length; i += CHUNK) {
+        const chunk = recipients.slice(i, i + CHUNK);
+        const res = await fetch('/api/admin/sms/send', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ recipients: chunk, dryRun }),
+        });
+        const j = await res.json();
+        if (!res.ok) {
+          setErr(j.error || `Send failed (${res.status})`);
+          break;
+        }
+        acc.push(...(j.results as SendItem[]));
+        setRunResults([...acc]);
+        setProgress({ done: Math.min(i + CHUNK, recipients.length), total: recipients.length });
+      }
+    } catch (e) {
+      setErr(String(e));
+    } finally {
+      setBusy('');
+      loadSummary();
+      loadLog();
+    }
+  }
+
+  async function syncStatuses() {
+    setBusy('sync');
+    setErr('');
+    try {
+      const r = await fetch('/api/admin/sms/sync', { method: 'POST' }).then((x) => x.json());
+      if (r.error) setErr(r.error);
+      await Promise.all([loadLog(), loadSummary()]);
+    } catch (e) {
+      setErr(String(e));
+    } finally {
+      setBusy('');
+    }
+  }
+
+  const runSummary = useMemo(() => {
+    const sent = runResults.filter((r) => r.status === 'sent' || r.status === 'dry-run').length;
+    const failed = runResults.filter((r) => r.status === 'failed').length;
+    const skipped = runResults.filter((r) => r.status === 'skipped').length;
+    return { sent, failed, skipped };
+  }, [runResults]);
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between gap-3 flex-wrap">
+        <div>
+          <h1 className="font-display text-2xl font-800 tracking-[-0.02em]">SMS outreach</h1>
+          <p className="text-warm-gray text-sm mt-1">
+            Personalized bulk SMS via Twilio{config?.sender ? ` · ${config.sender}` : ''}.
+          </p>
+        </div>
+        <Badge className={config?.dryRun ? 'bg-gold/15 text-gold-dark' : 'bg-destructive/15 text-destructive'}>
+          {config?.dryRun ? 'DRY-RUN MODE' : 'LIVE MODE'}
+        </Badge>
+      </div>
+
+      {config && !config.smsConfigured && (
+        <Card variant="outline" className="text-sm text-warm-gray">
+          ⚠ Twilio SMS isn&apos;t configured. Set <code>TWILIO_MESSAGING_SERVICE_SID</code> (or{' '}
+          <code>TWILIO_SMS_FROM</code>) with <code>TWILIO_ACCOUNT_SID</code> / <code>TWILIO_AUTH_TOKEN</code>. Dry-run
+          and preview work without it.
+        </Card>
+      )}
+
+      {/* Stats */}
+      <div className="grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-6 gap-3">
+        <Stat label="Live sent" value={stats?.liveSent ?? 0} />
+        <Stat label="Delivered" value={stats?.delivered ?? 0} />
+        <Stat label="Failed" value={stats?.failed ?? 0} />
+        <Stat label="Opted out" value={stats?.optedOut ?? 0} />
+        <Stat label="Spend" value={money(stats?.spend, stats?.currency)} />
+        <Stat label="Attempts" value={stats?.totalAttempts ?? 0} />
+      </div>
+
+      {/* Recipients */}
+      <Card className="space-y-3">
+        <div className="flex items-center justify-between gap-2 flex-wrap">
+          <h2 className="font-display text-lg font-700">Recipients</h2>
+          <div className="flex gap-2 flex-wrap">
+            <Button variant="secondary" size="sm" onClick={loadSeed} loading={busy === 'seed'}>
+              Load starter taskers
+            </Button>
+            <Button variant="secondary" size="sm" onClick={loadProviders} loading={busy === 'providers'}>
+              Load approved providers
+            </Button>
+            <label className="inline-flex items-center h-9 px-4 rounded-full text-[13px] font-600 border border-rich-black/[0.12] bg-card hover:bg-cream-dark cursor-pointer">
+              Upload CSV
+              <input type="file" accept=".csv,text/csv,text/plain" className="hidden" onChange={onFile} />
+            </label>
+          </div>
+        </div>
+        <Textarea
+          rows={7}
+          placeholder={'Paste numbers (one per line) or CSV with a header: name,phone,city,category'}
+          value={raw}
+          onChange={(e) => setRaw(e.target.value)}
+          className="font-mono text-[12px]"
+        />
+        <div className="text-sm text-warm-gray flex flex-wrap gap-x-4 gap-y-1">
+          <span>
+            <strong className="text-ink">{parsed.recipients.length}</strong> valid
+          </span>
+          {parsed.duplicates > 0 && <span>{parsed.duplicates} duplicates removed</span>}
+          {parsed.invalid.length > 0 && <span>{parsed.invalid.length} invalid</span>}
+          {estimate && config && (
+            <span>
+              est. <strong className="text-ink">{money(estimate.cost, config.currency)}</strong> · {estimate.segments}{' '}
+              segments · quiet hours {config.quietHours}
+            </span>
+          )}
+        </div>
+      </Card>
+
+      {/* Preview + send */}
+      <Card className="space-y-4">
+        <div className="flex items-center justify-between gap-3 flex-wrap">
+          <h2 className="font-display text-lg font-700">Preview &amp; send</h2>
+          <div className="flex items-center gap-3 flex-wrap">
+            <Button
+              variant="ghost"
+              size="sm"
+              onClick={preview}
+              loading={busy === 'preview'}
+              disabled={parsed.recipients.length === 0}
+            >
+              Preview AI messages
+            </Button>
+            <label className="inline-flex items-center gap-2 text-sm text-warm-gray">
+              <input type="checkbox" checked={dryRun} onChange={(e) => setDryRun(e.target.checked)} />
+              Dry run (no messages sent)
+            </label>
+            <Button
+              variant={dryRun ? 'primary' : 'destructive'}
+              size="sm"
+              onClick={run}
+              loading={busy === 'send'}
+              disabled={parsed.recipients.length === 0}
+            >
+              {dryRun ? 'Test send (dry-run)' : `Send live to ${parsed.recipients.length}`}
+            </Button>
+          </div>
+        </div>
+
+        {previews.length > 0 && (
+          <div className="space-y-2">
+            {previews.map((p, i) => (
+              <div key={i} className="rounded-lg bg-canvas-soft p-3 text-[13px]">
+                <div className="text-warm-gray text-[11px] mb-1">
+                  {p.name} · {p.segments} seg · {p.encoding} · {p.source}
+                </div>
+                {p.body}
+              </div>
+            ))}
+          </div>
+        )}
+
+        {progress && (
+          <div>
+            <div className="h-2 rounded-full bg-canvas-soft overflow-hidden">
+              <div
+                className="h-full bg-rich-black transition-all"
+                style={{ width: `${Math.round((100 * progress.done) / Math.max(1, progress.total))}%` }}
+              />
+            </div>
+            <div className="text-sm text-warm-gray mt-2">
+              {progress.done}/{progress.total} · sent {runSummary.sent} · failed {runSummary.failed} · skipped{' '}
+              {runSummary.skipped} {dryRun ? '(dry-run)' : ''}
+            </div>
+          </div>
+        )}
+
+        {err && <div className="text-sm text-destructive">{err}</div>}
+      </Card>
+
+      {/* Recent messages */}
+      <Card pad="none" className="overflow-hidden">
+        <div className="flex items-center justify-between px-5 py-3 border-b border-rich-black/[0.06]">
+          <h2 className="font-display text-lg font-700">Recent messages</h2>
+          <div className="flex items-center gap-2">
+            <Button
+              variant="secondary"
+              size="sm"
+              onClick={syncStatuses}
+              loading={busy === 'sync'}
+              title="Pull real delivered/failed status from Twilio for pending rows"
+            >
+              Sync from Twilio
+            </Button>
+            <Button variant="ghost" size="sm" onClick={loadLog}>
+              Refresh
+            </Button>
+          </div>
+        </div>
+        {log.length === 0 ? (
+          <div className="px-5 py-6 text-warm-gray text-sm">No messages yet.</div>
+        ) : (
+          <div className="overflow-x-auto">
+            <table className="w-full text-[13px]">
+              <thead>
+                <tr className="text-warm-gray text-left">
+                  <th className="px-4 py-2 font-600">Time</th>
+                  <th className="px-4 py-2 font-600">To</th>
+                  <th className="px-4 py-2 font-600">Name</th>
+                  <th className="px-4 py-2 font-600">Status</th>
+                  <th className="px-4 py-2 font-600">Seg</th>
+                  <th className="px-4 py-2 font-600">Cost</th>
+                  <th className="px-4 py-2 font-600">Note</th>
+                </tr>
+              </thead>
+              <tbody>
+                {log.map((m, i) => (
+                  <tr key={i} className="border-t border-rich-black/[0.05]">
+                    <td className="px-4 py-2 text-warm-gray whitespace-nowrap">
+                      {(m.created_at || '').replace('T', ' ').slice(5, 19)}
+                    </td>
+                    <td className="px-4 py-2 whitespace-nowrap">{m.phone}</td>
+                    <td className="px-4 py-2">{m.name || ''}</td>
+                    <td className="px-4 py-2">
+                      <Badge className="text-[11px]">{m.status}</Badge>
+                    </td>
+                    <td className="px-4 py-2">{m.segments ?? ''}</td>
+                    <td className="px-4 py-2">{m.price != null ? money(m.price, m.currency) : ''}</td>
+                    <td className="px-4 py-2 text-warm-gray">{m.error || (m.dry_run ? 'dry-run' : '')}</td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
+        )}
+      </Card>
+    </div>
+  );
+}
+
+function Stat({ label, value }: { label: string; value: string | number }) {
+  return (
+    <Card pad="sm">
+      <div className="text-warm-gray text-[11px] uppercase tracking-[0.04em]">{label}</div>
+      <div className="font-display text-xl font-800 mt-1">{value}</div>
+    </Card>
+  );
+}
+
+function csv(v?: string) {
+  const s = String(v ?? '').trim();
+  return s.includes(',') || s.includes('"') ? `"${s.replaceAll('"', '""')}"` : s;
+}
diff --git a/app/(provider)/provider/profile/public/page.tsx b/app/(provider)/provider/profile/public/page.tsx
index 66c99831..57481d40 100644
--- a/app/(provider)/provider/profile/public/page.tsx
+++ b/app/(provider)/provider/profile/public/page.tsx
@@ -110,6 +110,11 @@ export default function PublicProfileEditor() {
   const [resumeText, setResumeText] = useState('');
   const resumeFileRef = useRef<HTMLInputElement>(null);
   const [portfolio, setPortfolio] = useState<PortfolioItem[]>([]);
+  // "Import from Facebook" — collapsed until asked for; most taskers upload.
+  const [fbOpen, setFbOpen] = useState(false);
+  const [fbUrl, setFbUrl] = useState('');
+  const [fbImporting, setFbImporting] = useState(false);
+  const [fbNote, setFbNote] = useState<string | null>(null);
   const [projects, setProjects] = useState<ProfileProject[]>([]);
   const [projectUrl, setProjectUrl] = useState('');
   const [projectUploading, setProjectUploading] = useState(false);
@@ -655,6 +660,54 @@ export default function PublicProfileEditor() {
     }
   };
 
+  // Pull work photos straight off a Facebook page. The route re-hosts them in
+  // our own bucket (Facebook's CDN links expire in days) and returns the URLs;
+  // saving is the same Save button as everything else on this screen, so an
+  // imported photo can be captioned or cut before it ever lands on the profile.
+  const importFromFacebook = async () => {
+    const link = fbUrl.trim();
+    const slots = 16 - portfolio.length;
+    if (!link || fbImporting || slots <= 0) return;
+    setFbImporting(true);
+    setFbNote(null);
+    setErr(null);
+    try {
+      const res = await fetch('/api/provider/portfolio/import', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ url: link, slots }),
+      });
+      const j = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        const copy: Record<string, string> = {
+          unsupported_link: 'Paste a Facebook page or profile link.',
+          import_unavailable: 'Photo import is off right now — add photos manually below.',
+          portfolio_full: 'Your work samples are full — remove one first.',
+          timeout: 'Facebook took too long. Try again in a moment.',
+          extraction_failed: 'Couldn’t read that page’s photos.',
+        };
+        const key = res.status === 429 ? 'rate' : String(j.error ?? '');
+        setErr(key === 'rate' ? 'Too many imports. Give it a minute.' : (copy[key] ?? copy.extraction_failed));
+        return;
+      }
+      const got: string[] = Array.isArray(j.urls) ? j.urls : [];
+      if (!got.length) {
+        setFbNote('No photos we could read on that page — add them manually below.');
+        return;
+      }
+      setPortfolio((prev) => [
+        ...prev,
+        ...got.slice(0, 16 - prev.length).map((url: string) => ({ url, caption: '' })),
+      ]);
+      setFbNote(`Added ${got.length} photo${got.length === 1 ? '' : 's'}. Caption or cut any of them, then Save.`);
+      setFbUrl('');
+    } catch {
+      setErr('Couldn’t reach Facebook. Try again in a moment.');
+    } finally {
+      setFbImporting(false);
+    }
+  };
+
   // Projects & links — paste a video/website link (kind auto-detected) or upload
   // a PDF. Shown as a "Featured work" section on the public profile.
   const addProjectLink = () => {
@@ -1219,6 +1272,53 @@ export default function PublicProfileEditor() {
             )}
           </div>
           <input ref={fileRef} type="file" accept="image/*" multiple className="hidden" onChange={(e) => onUpload(e.target.files)} />
+
+          {/* Facebook import — a shortcut for taskers who already have a page,
+              never a step for the ones who don't. */}
+          {portfolio.length < 16 && (
+            fbOpen ? (
+              <div className="mt-3 rounded-xl border border-rich-black/[0.10] bg-cream-dark/30 p-3">
+                <div className="flex items-center justify-between gap-2">
+                  <p className="font-sans text-[12.5px] font-620 text-rich-black">Import from your Facebook page</p>
+                  <button
+                    onClick={() => { setFbOpen(false); setFbNote(null); }}
+                    aria-label="Close import"
+                    className="grid h-5 w-5 place-items-center rounded-full text-rich-black/60 hover:bg-rich-black/[0.06] hover:text-rich-black transition-colors cursor-pointer"
+                  >
+                    <X className="w-3 h-3" strokeWidth={3} />
+                  </button>
+                </div>
+                <div className="mt-2 flex flex-col sm:flex-row gap-2">
+                  <input
+                    value={fbUrl}
+                    onChange={(e) => { setFbUrl(e.target.value.slice(0, 2048)); setFbNote(null); }}
+                    onKeyDown={(e) => { if (e.key === 'Enter') { e.preventDefault(); importFromFacebook(); } }}
+                    disabled={fbImporting}
+                    placeholder="facebook.com/your-page"
+                    className="flex-1 bg-card border border-rich-black/[0.10] rounded-full px-4 py-2.5 font-sans text-[13.5px] font-500 text-rich-black placeholder:text-rich-black/60 focus:outline-none focus:border-rich-black/40 transition-colors disabled:opacity-60"
+                  />
+                  <button
+                    onClick={importFromFacebook}
+                    disabled={fbImporting || !fbUrl.trim()}
+                    className="btn btn-dark shrink-0 disabled:opacity-40 disabled:cursor-not-allowed"
+                  >
+                    {fbImporting ? <Loader2 className="w-4 h-4 animate-spin" /> : 'Import photos'}
+                  </button>
+                </div>
+                <p className="mt-2 font-sans text-[11.5px] leading-snug text-rich-black/60">
+                  {fbNote ?? 'Only import photos of work you did — they show on your public profile as your own.'}
+                </p>
+              </div>
+            ) : (
+              <button
+                onClick={() => setFbOpen(true)}
+                className="mt-3 inline-flex items-center gap-1.5 font-sans text-[12.5px] font-600 text-gold-dark hover:text-gold transition-colors cursor-pointer"
+              >
+                <Link2 className="w-3.5 h-3.5" strokeWidth={2.4} />
+                Import photos from your Facebook page
+              </button>
+            )
+          )}
         </Field>
 
         {/* Projects & links */}
diff --git a/app/api/admin/sms/log/route.ts b/app/api/admin/sms/log/route.ts
new file mode 100644
index 00000000..a4648cf2
--- /dev/null
+++ b/app/api/admin/sms/log/route.ts
@@ -0,0 +1,17 @@
+// GET /api/admin/sms/log?limit=100 — recent send/status rows for the table.
+
+import { NextResponse } from 'next/server';
+import { createClient } from '@/lib/supabase/server';
+import { getAuthedRole } from '@/lib/api/auth';
+import { recentLog } from '@/lib/sms/store';
+
+export async function GET(request: Request) {
+  const supabase = await createClient();
+  const authed = await getAuthedRole(supabase);
+  if (!authed || authed.role !== 'admin') {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+  const limit = Math.min(Number(new URL(request.url).searchParams.get('limit')) || 100, 1000);
+  const rows = await recentLog(limit);
+  return NextResponse.json({ rows }, { headers: { 'Cache-Control': 'no-store' } });
+}
diff --git a/app/api/admin/sms/preview/route.ts b/app/api/admin/sms/preview/route.ts
new file mode 100644
index 00000000..971b80c8
--- /dev/null
+++ b/app/api/admin/sms/preview/route.ts
@@ -0,0 +1,40 @@
+// POST /api/admin/sms/preview — AI-personalize a few recipients so the admin can
+// eyeball the real message + segment count before committing. Capped at 5.
+
+import { NextResponse } from 'next/server';
+import { createClient } from '@/lib/supabase/server';
+import { getAuthedRole } from '@/lib/api/auth';
+import { smsConfig } from '@/lib/sms/config';
+import { generateSmsHook } from '@/lib/sms/personalize';
+import { composeBody, type Recipient } from '@/lib/sms/message';
+import { normalizePhone } from '@/lib/sms/segments';
+
+export async function POST(request: Request) {
+  const supabase = await createClient();
+  const authed = await getAuthedRole(supabase);
+  if (!authed || authed.role !== 'admin') {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const body = (await request.json().catch(() => null)) as { recipients?: Recipient[] } | null;
+  const input = Array.isArray(body?.recipients) ? body!.recipients!.slice(0, 5) : [];
+  const cfg = smsConfig();
+
+  const previews = [];
+  for (const r of input) {
+    const rec: Recipient = { ...r, phone: normalizePhone(r.phone) };
+    const hook = await generateSmsHook(rec, request);
+    const composed = composeBody(rec, hook.text, { ctaUrl: cfg.ctaUrl, ctaLabel: cfg.ctaLabel });
+    previews.push({
+      name: rec.name || rec.phone,
+      phone: rec.phone,
+      body: composed.body,
+      segments: composed.segments,
+      encoding: composed.encoding,
+      source: hook.source,
+      cost: +(composed.segments * cfg.pricePerSegment).toFixed(5),
+    });
+  }
+
+  return NextResponse.json({ previews, currency: cfg.currency });
+}
diff --git a/app/api/admin/sms/providers/route.ts b/app/api/admin/sms/providers/route.ts
new file mode 100644
index 00000000..49734e80
--- /dev/null
+++ b/app/api/admin/sms/providers/route.ts
@@ -0,0 +1,60 @@
+// GET /api/admin/sms/providers — approved taskers as SMS recipients (name, phone,
+// city, category). Reads via service-role so profiles.whatsapp_phone is visible.
+// Two-step (provider_profiles → profiles) to sidestep FK-embed ambiguity.
+
+import { NextResponse } from 'next/server';
+import { createClient } from '@/lib/supabase/server';
+import { getAuthedRole } from '@/lib/api/auth';
+import { createServiceRoleClient } from '@/lib/supabase/admin';
+import { normalizePhone, isValidE164 } from '@/lib/sms/segments';
+import type { Recipient } from '@/lib/sms/message';
+
+export async function GET() {
+  const supabase = await createClient();
+  const authed = await getAuthedRole(supabase);
+  if (!authed || authed.role !== 'admin') {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const db = createServiceRoleClient();
+  const { data: pps } = await db
+    .from('provider_profiles')
+    .select('id, service_areas, region')
+    .eq('status', 'approved')
+    .limit(5000);
+
+  const ids = (pps ?? []).map((p) => p.id as string);
+  if (ids.length === 0) return NextResponse.json({ recipients: [], withoutPhone: 0 });
+
+  const areaById = new Map<string, string>();
+  for (const p of pps ?? []) {
+    const areas = (p.service_areas as string[] | null) ?? [];
+    areaById.set(p.id as string, areas[0] || (p.region as string) || '');
+  }
+
+  const { data: profs } = await db
+    .from('profiles')
+    .select('id, full_name, whatsapp_phone')
+    .in('id', ids);
+
+  const recipients: Recipient[] = [];
+  let withoutPhone = 0;
+  const seen = new Set<string>();
+  for (const pr of profs ?? []) {
+    const phone = normalizePhone(String(pr.whatsapp_phone ?? ''));
+    if (!isValidE164(phone)) {
+      withoutPhone++;
+      continue;
+    }
+    if (seen.has(phone)) continue;
+    seen.add(phone);
+    recipients.push({
+      name: (pr.full_name as string) || '',
+      phone,
+      city: areaById.get(pr.id as string) || '',
+      category: 'home services',
+    });
+  }
+
+  return NextResponse.json({ recipients, withoutPhone });
+}
diff --git a/app/api/admin/sms/seed/route.ts b/app/api/admin/sms/seed/route.ts
new file mode 100644
index 00000000..ebca8663
--- /dev/null
+++ b/app/api/admin/sms/seed/route.ts
@@ -0,0 +1,30 @@
+// GET /api/admin/sms/seed — returns the starter recipient list (the 173 Nextdoor
+// taskers) as raw CSV text for the admin to load into the composer. The file is
+// gitignored (contains PII), so a fresh clone/deploy simply returns available:false.
+
+import { NextResponse } from 'next/server';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { createClient } from '@/lib/supabase/server';
+import { getAuthedRole } from '@/lib/api/auth';
+
+export const runtime = 'nodejs';
+
+export async function GET() {
+  const supabase = await createClient();
+  const authed = await getAuthedRole(supabase);
+  if (!authed || authed.role !== 'admin') {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const file = path.join(process.cwd(), 'data', 'sms-seed-taskers.csv');
+  try {
+    const csv = await fs.readFile(file, 'utf8');
+    return NextResponse.json({ available: true, csv });
+  } catch {
+    return NextResponse.json({
+      available: false,
+      note: 'No data/sms-seed-taskers.csv present. Paste or upload a list instead.',
+    });
+  }
+}
diff --git a/app/api/admin/sms/send/route.ts b/app/api/admin/sms/send/route.ts
new file mode 100644
index 00000000..c1cf9e83
--- /dev/null
+++ b/app/api/admin/sms/send/route.ts
@@ -0,0 +1,180 @@
+// POST /api/admin/sms/send — send ONE chunk of recipients (the client loops over
+// chunks and shows progress). Kept small so it never hits the serverless function
+// timeout. For each recipient: skip opt-outs, skip already-live-sent (idempotent),
+// personalize, then dry-run-log or live-send + log. Live sends also enforce
+// Twilio config + quiet hours.
+
+import { NextResponse } from 'next/server';
+import { createClient } from '@/lib/supabase/server';
+import { getAuthedRole } from '@/lib/api/auth';
+import { smsConfig, withinQuietWindow } from '@/lib/sms/config';
+import { generateSmsHook } from '@/lib/sms/personalize';
+import { composeBody, type Recipient } from '@/lib/sms/message';
+import { normalizePhone, isValidE164 } from '@/lib/sms/segments';
+import { sendSms, smsConfigured } from '@/lib/twilio/client';
+import { readOptOuts, alreadySentLivePhones, recordSend } from '@/lib/sms/store';
+
+export const runtime = 'nodejs';
+
+const MAX_CHUNK = 50;
+const RETRYABLE = new Set([429, 500, 502, 503, 504]);
+
+interface SendItem {
+  phone: string;
+  name?: string;
+  status: 'sent' | 'dry-run' | 'failed' | 'skipped';
+  reason?: string;
+  segments?: number;
+  cost?: number;
+  sid?: string;
+}
+
+function sleep(ms: number) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+export async function POST(request: Request) {
+  const supabase = await createClient();
+  const authed = await getAuthedRole(supabase);
+  if (!authed || authed.role !== 'admin') {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const body = (await request.json().catch(() => null)) as
+    | { recipients?: Recipient[]; dryRun?: boolean }
+    | null;
+  const cfg = smsConfig();
+  const dryRun = body?.dryRun != null ? Boolean(body.dryRun) : cfg.dryRun;
+  const recipients = Array.isArray(body?.recipients) ? body!.recipients!.slice(0, MAX_CHUNK) : [];
+
+  if (recipients.length === 0) {
+    return NextResponse.json({ error: 'No recipients in chunk' }, { status: 400 });
+  }
+
+  // Live-send preconditions — fail the whole chunk fast, before any send.
+  if (!dryRun) {
+    if (!smsConfigured()) {
+      return NextResponse.json({ error: 'Twilio SMS is not configured' }, { status: 400 });
+    }
+    if (!withinQuietWindow(cfg)) {
+      return NextResponse.json(
+        { error: `Outside quiet-hours window (${cfg.quietStartHour}:00–${cfg.quietEndHour}:00 ${cfg.timezone}).` },
+        { status: 400 },
+      );
+    }
+  }
+
+  const [optOuts, alreadyLive] = await Promise.all([readOptOuts(), alreadySentLivePhones()]);
+  const statusCallback = webhookUrl();
+  const results: SendItem[] = [];
+  const delayMs = cfg.ratePerSec > 0 ? Math.ceil(1000 / cfg.ratePerSec) : 0;
+
+  for (const input of recipients) {
+    const phone = normalizePhone(input.phone);
+    const rec: Recipient = { ...input, phone };
+
+    if (!isValidE164(phone)) {
+      results.push({ phone, name: input.name, status: 'skipped', reason: 'invalid number' });
+      continue;
+    }
+    if (optOuts.has(phone)) {
+      results.push({ phone, name: input.name, status: 'skipped', reason: 'opted out' });
+      continue;
+    }
+    if (!dryRun && alreadyLive.has(phone)) {
+      results.push({ phone, name: input.name, status: 'skipped', reason: 'already sent' });
+      continue;
+    }
+
+    const hook = await generateSmsHook(rec, request);
+    const composed = composeBody(rec, hook.text, { ctaUrl: cfg.ctaUrl, ctaLabel: cfg.ctaLabel });
+
+    if (dryRun) {
+      await recordSend({
+        phone,
+        name: rec.name,
+        body: composed.body,
+        segments: composed.segments,
+        price: +(composed.segments * cfg.pricePerSegment).toFixed(5),
+        currency: cfg.currency,
+        status: 'dry-run',
+        dryRun: true,
+        sentBy: authed.userId,
+      });
+      results.push({
+        phone,
+        name: rec.name,
+        status: 'dry-run',
+        segments: composed.segments,
+        cost: +(composed.segments * cfg.pricePerSegment).toFixed(5),
+      });
+      continue;
+    }
+
+    // Live send with a small retry on transient Twilio errors.
+    let attempt = 0;
+    let backoff = 800;
+    for (;;) {
+      try {
+        const res = await sendSms({ to: phone, body: composed.body, statusCallback });
+        await recordSend({
+          phone,
+          name: rec.name,
+          body: composed.body,
+          segments: res.numSegments ?? composed.segments,
+          price: res.price ?? +(composed.segments * cfg.pricePerSegment).toFixed(5),
+          currency: res.priceUnit ?? cfg.currency,
+          status: res.status,
+          providerSid: res.sid,
+          dryRun: false,
+          sentBy: authed.userId,
+        });
+        results.push({
+          phone,
+          name: rec.name,
+          status: 'sent',
+          segments: res.numSegments ?? composed.segments,
+          sid: res.sid,
+        });
+        break;
+      } catch (e) {
+        const err = e as Error & { httpStatus?: number; code?: number };
+        if (err.httpStatus && RETRYABLE.has(err.httpStatus) && attempt < 3) {
+          attempt++;
+          await sleep(backoff);
+          backoff *= 2;
+          continue;
+        }
+        const message = `${err.message}${err.code ? ` (code ${err.code})` : ''}`;
+        await recordSend({
+          phone,
+          name: rec.name,
+          body: composed.body,
+          segments: composed.segments,
+          status: 'failed',
+          error: message,
+          dryRun: false,
+          sentBy: authed.userId,
+        });
+        results.push({ phone, name: rec.name, status: 'failed', reason: message });
+        break;
+      }
+    }
+
+    if (delayMs) await sleep(delayMs);
+  }
+
+  const summary = {
+    sent: results.filter((r) => r.status === 'sent' || r.status === 'dry-run').length,
+    failed: results.filter((r) => r.status === 'failed').length,
+    skipped: results.filter((r) => r.status === 'skipped').length,
+  };
+  return NextResponse.json({ dryRun, results, summary });
+}
+
+// Where Twilio POSTs delivery receipts. Prefer an explicit webhook base (a tunnel
+// in dev), else the public site URL.
+function webhookUrl(): string | undefined {
+  const base = process.env.SMS_WEBHOOK_BASE_URL || process.env.NEXT_PUBLIC_SITE_URL;
+  return base ? `${base.replace(/\/+$/, '')}/api/webhooks/twilio/sms` : undefined;
+}
diff --git a/app/api/admin/sms/summary/route.ts b/app/api/admin/sms/summary/route.ts
new file mode 100644
index 00000000..49439e5b
--- /dev/null
+++ b/app/api/admin/sms/summary/route.ts
@@ -0,0 +1,21 @@
+// GET /api/admin/sms/summary — dashboard header: config + aggregate stats.
+// Admin-only (authoritative profiles.role via getAuthedRole).
+
+import { NextResponse } from 'next/server';
+import { createClient } from '@/lib/supabase/server';
+import { getAuthedRole } from '@/lib/api/auth';
+import { publicSmsConfig } from '@/lib/sms/config';
+import { campaignStats } from '@/lib/sms/store';
+
+export async function GET() {
+  const supabase = await createClient();
+  const authed = await getAuthedRole(supabase);
+  if (!authed || authed.role !== 'admin') {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+  const stats = await campaignStats();
+  return NextResponse.json(
+    { config: publicSmsConfig(), stats },
+    { headers: { 'Cache-Control': 'no-store' } },
+  );
+}
diff --git a/app/api/admin/sms/sync/route.ts b/app/api/admin/sms/sync/route.ts
new file mode 100644
index 00000000..c162df3c
--- /dev/null
+++ b/app/api/admin/sms/sync/route.ts
@@ -0,0 +1,51 @@
+// POST /api/admin/sms/sync — reconcile pending campaign-log rows with Twilio's
+// real message status. Needed when the delivery-receipt webhook can't reach us
+// (local dev), so the dashboard shows delivered/failed instead of a stale
+// "queued"/"sent". Admin-only. Bounded so it never runs unbounded API calls.
+
+import { NextResponse } from 'next/server';
+import { createClient } from '@/lib/supabase/server';
+import { getAuthedRole } from '@/lib/api/auth';
+import { fetchMessageStatus } from '@/lib/twilio/client';
+import { pendingSids, applyTwilioStatus } from '@/lib/sms/store';
+
+export const runtime = 'nodejs';
+
+const MAX_PER_CALL = 100;
+
+function sleep(ms: number) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+export async function POST() {
+  const supabase = await createClient();
+  const authed = await getAuthedRole(supabase);
+  if (!authed || authed.role !== 'admin') {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const sids = (await pendingSids(500)).slice(0, MAX_PER_CALL);
+  let updated = 0;
+  let stillPending = 0;
+  const counts: Record<string, number> = {};
+
+  for (const sid of sids) {
+    const m = await fetchMessageStatus(sid);
+    if (!m) {
+      stillPending++;
+      continue;
+    }
+    await applyTwilioStatus(sid, {
+      status: m.status,
+      error: m.errorCode ? `Twilio error ${m.errorCode}` : null,
+      price: m.price,
+      currency: m.priceUnit,
+    });
+    counts[m.status] = (counts[m.status] || 0) + 1;
+    if (['delivered', 'undelivered', 'failed', 'canceled'].includes(m.status)) updated++;
+    else stillPending++;
+    await sleep(60); // stay well under Twilio's REST rate limit
+  }
+
+  return NextResponse.json({ checked: sids.length, updated, stillPending, byStatus: counts });
+}
diff --git a/app/api/provider/portfolio/import/route.ts b/app/api/provider/portfolio/import/route.ts
new file mode 100644
index 00000000..94d4851e
--- /dev/null
+++ b/app/api/provider/portfolio/import/route.ts
@@ -0,0 +1,181 @@
+// POST /api/provider/portfolio/import  { url, slots }
+//
+// "Import your photos from Facebook" on the tasker's public profile. Reads the
+// page's photos tab server-side (one authenticated request — see
+// lib/link-import/facebook-photos), downloads each image, and re-hosts it in the
+// same public `portfolio` bucket the manual uploader writes to.
+//
+// Re-hosting is not a nicety: Facebook's CDN URLs are signed and expire in about
+// four days, so storing one in provider_profiles.portfolio would give the tasker
+// a gallery that goes blank by the weekend.
+//
+// Like the manual uploader, this returns URLs and writes NOTHING to the profile.
+// The tasker keeps or cuts each photo and the existing PATCH
+// /api/provider/public-profile saves the array. One write path, and an imported
+// photo is exactly as removable as an uploaded one.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { createClient } from '@/lib/supabase/server';
+import { createServiceRoleClient } from '@/lib/supabase/admin';
+import { isTaskerOrPending } from '@/lib/api/auth';
+import { clientId, rateLimitShared } from '@/lib/api/rate-limit-shared';
+import { normalizeLinkUrl, SourceNotConfiguredError } from '@/lib/link-import';
+import {
+  extractFacebookPhotos, isFbcdnImageUrl, LoginWallError, MAX_IMPORT_PHOTOS,
+} from '@/lib/link-import/facebook-photos';
+
+export const runtime = 'nodejs';
+export const maxDuration = 60; // one page fetch + up to 12 image downloads
+
+const BUCKET = 'portfolio';
+const MAX_BYTES = 6 * 1024 * 1024;      // per image — matches the manual uploader
+const MAX_TOTAL_BYTES = 40 * 1024 * 1024; // whole import, so one call can't run away
+const MAX_SLOTS = 16;                   // the portfolio cap the UI enforces
+const OK_TYPES = new Set(['image/jpeg', 'image/png', 'image/webp', 'image/avif']);
+const EXT: Record<string, string> = {
+  'image/jpeg': 'jpg', 'image/png': 'png', 'image/webp': 'webp', 'image/avif': 'avif',
+};
+
+/** Facebook only — Yelp doesn't expose a gallery we can attribute to the page. */
+function isFacebookPageUrl(raw: string): boolean {
+  try {
+    const u = new URL(raw);
+    if (u.protocol !== 'https:' && u.protocol !== 'http:') return false;
+    return /(^|\.)facebook\.com$|(^|\.)fb\.com$/i.test(u.hostname);
+  } catch {
+    return false;
+  }
+}
+
+/** Download one image, enforcing type and size. null = skip it, never throw. */
+async function fetchImage(
+  url: string,
+  budget: number,
+): Promise<{ bytes: Uint8Array; type: string } | null> {
+  // Re-checked here and not just at parse time: this is the last thing standing
+  // between remote HTML and a server-side fetch.
+  if (!isFbcdnImageUrl(url)) return null;
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 15000);
+  try {
+    // No cookies: the CDN serves these unauthenticated (verified), so the
+    // session never leaves the HTML request.
+    const res = await fetch(url, { signal: controller.signal, redirect: 'follow' });
+    if (!res.ok) return null;
+
+    const type = (res.headers.get('content-type') || '').split(';')[0].trim().toLowerCase();
+    if (!OK_TYPES.has(type)) return null;
+
+    const declared = Number(res.headers.get('content-length') || 0);
+    if (declared > MAX_BYTES || declared > budget) return null;
+
+    const buf = new Uint8Array(await res.arrayBuffer());
+    // Content-Length can lie or be absent — the real length is the one that counts.
+    if (!buf.length || buf.length > MAX_BYTES || buf.length > budget) return null;
+    return { bytes: buf, type };
+  } catch {
+    return null; // timeout / network / abort — one bad photo shouldn't fail the import
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export async function POST(req: NextRequest) {
+  const supabase = await createClient();
+  const { data: { user } } = await supabase.auth.getUser();
+  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  // Authoritative capability check — this route uploads with the service role.
+  if (!(await isTaskerOrPending(supabase, user.id))) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  // Tighter than the text import: each call is a page fetch plus a dozen
+  // downloads and uploads.
+  const limited = await rateLimitShared({
+    key: `portfolio-import:${user.id}:${clientId(req)}`,
+    max: 4,
+    windowSeconds: 600,
+  });
+  if (limited) return limited;
+
+  const body = await req.json().catch(() => null);
+  const raw = typeof body?.url === 'string' ? body.url.trim() : '';
+  if (!raw) return NextResponse.json({ error: 'url required' }, { status: 400 });
+  if (raw.length > 2048) return NextResponse.json({ error: 'unsupported_link' }, { status: 422 });
+
+  // How many portfolio slots are free. Clamped rather than trusted — it only
+  // shrinks the work, but an absurd value shouldn't reach the loop.
+  const slotsRaw = Number(body?.slots);
+  const slots = Number.isFinite(slotsRaw)
+    ? Math.max(0, Math.min(MAX_SLOTS, Math.floor(slotsRaw)))
+    : MAX_SLOTS;
+  if (slots === 0) return NextResponse.json({ error: 'portfolio_full' }, { status: 422 });
+
+  const url = normalizeLinkUrl(raw);
+  if (!isFacebookPageUrl(url)) {
+    return NextResponse.json({ error: 'unsupported_link' }, { status: 422 });
+  }
+
+  const cookies = process.env.FB_COOKIES || '';
+  if (!cookies) return NextResponse.json({ error: 'import_unavailable' }, { status: 503 });
+
+  const admin = createServiceRoleClient();
+  const limit = Math.min(slots, MAX_IMPORT_PHOTOS);
+
+  try {
+    const found = await extractFacebookPhotos(cookies, url, limit);
+    if (!found.length) {
+      return NextResponse.json({ ok: true, found: 0, urls: [] });
+    }
+
+    // Idempotent — the manual uploader creates this too; whichever runs first wins.
+    const { error: bucketErr } = await admin.storage.createBucket(BUCKET, {
+      public: true,
+      fileSizeLimit: MAX_BYTES,
+      allowedMimeTypes: Array.from(OK_TYPES),
+    });
+    if (bucketErr && !/exist/i.test(bucketErr.message)) {
+      console.error('[portfolio.import] createBucket', bucketErr);
+      return NextResponse.json({ error: 'storage_unavailable' }, { status: 500 });
+    }
+
+    const urls: string[] = [];
+    let spent = 0;
+    for (const src of found) {
+      if (urls.length >= limit) break;
+      const img = await fetchImage(src, MAX_TOTAL_BYTES - spent);
+      if (!img) continue;
+      spent += img.bytes.length;
+
+      const path = `${user.id}/fb-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${EXT[img.type]}`;
+      const { error: upErr } = await admin.storage
+        .from(BUCKET)
+        .upload(path, img.bytes, { contentType: img.type, upsert: false });
+      if (upErr) {
+        console.error('[portfolio.import] upload', upErr.message);
+        continue; // a failed photo is a smaller import, not a failed one
+      }
+      urls.push(admin.storage.from(BUCKET).getPublicUrl(path).data.publicUrl);
+    }
+
+    return NextResponse.json({ ok: true, found: found.length, urls });
+  } catch (err) {
+    // A stale FB_COOKIES value returns a login wall at HTTP 200. Saying so beats
+    // telling the tasker their own page is unreadable.
+    if (err instanceof LoginWallError) {
+      console.error('[portfolio.import] FB session cookie is stale — refresh FB_COOKIES');
+      return NextResponse.json({ error: 'import_unavailable' }, { status: 503 });
+    }
+    if (err instanceof SourceNotConfiguredError) {
+      return NextResponse.json({ error: 'import_unavailable' }, { status: 503 });
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    const timedOut = /timeout|aborted/i.test(msg);
+    console.error('[portfolio.import] failed:', msg);
+    return NextResponse.json(
+      { error: timedOut ? 'timeout' : 'extraction_failed' },
+      { status: timedOut ? 504 : 502 },
+    );
+  }
+}
diff --git a/app/api/webhooks/twilio/sms/route.ts b/app/api/webhooks/twilio/sms/route.ts
new file mode 100644
index 00000000..19654778
--- /dev/null
+++ b/app/api/webhooks/twilio/sms/route.ts
@@ -0,0 +1,70 @@
+// POST /api/webhooks/twilio/sms — the single Twilio Messaging webhook.
+//   • Inbound SMS (has Body): honor STOP / START / HELP keywords, reply via TwiML.
+//   • Status callback (has MessageStatus): update the campaign log by Message SID.
+// Public endpoint, so every request is verified with the Twilio signature.
+
+import { NextResponse } from 'next/server';
+import { validateTwilioSignature } from '@/lib/twilio/client';
+import { normalizePhone } from '@/lib/sms/segments';
+import { addOptOut, removeOptOut, updateStatusBySid } from '@/lib/sms/store';
+
+export const runtime = 'nodejs';
+
+const STOP = new Set(['stop', 'stopall', 'unsubscribe', 'cancel', 'end', 'quit', 'revoke', 'optout']);
+const START = new Set(['start', 'unstop', 'resume', 'optin']);
+const HELP = new Set(['help', 'info']);
+
+function escapeXml(s: string): string {
+  return s.replace(/[<>&'"]/g, (c) => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;', "'": '&apos;', '"': '&quot;' })[c]!);
+}
+
+function twiml(message?: string): NextResponse {
+  const xml = message
+    ? `<?xml version="1.0" encoding="UTF-8"?><Response><Message>${escapeXml(message)}</Message></Response>`
+    : `<?xml version="1.0" encoding="UTF-8"?><Response></Response>`;
+  return new NextResponse(xml, { headers: { 'Content-Type': 'text/xml' } });
+}
+
+export async function POST(request: Request) {
+  const form = await request.formData();
+  const params: Record<string, string> = {};
+  for (const [k, v] of form.entries()) params[k] = typeof v === 'string' ? v : '';
+
+  // Reconstruct the exact URL Twilio signed (host can differ behind a proxy).
+  const base = process.env.SMS_WEBHOOK_BASE_URL || process.env.NEXT_PUBLIC_SITE_URL || new URL(request.url).origin;
+  const url = `${base.replace(/\/+$/, '')}/api/webhooks/twilio/sms`;
+  const signature = request.headers.get('X-Twilio-Signature');
+  const skipVerify = String(process.env.SMS_VALIDATE_SIGNATURE ?? 'true').toLowerCase() === 'false';
+
+  if (!skipVerify && !validateTwilioSignature(url, params, signature)) {
+    return new NextResponse('Invalid signature', { status: 403 });
+  }
+
+  // Delivery-receipt update.
+  if (params.MessageStatus && params.MessageSid) {
+    await updateStatusBySid(
+      params.MessageSid,
+      params.MessageStatus,
+      params.ErrorCode ? `Twilio error ${params.ErrorCode}` : null,
+    );
+    return new NextResponse(null, { status: 204 });
+  }
+
+  // Inbound message — keyword handling.
+  const from = normalizePhone(params.From || '');
+  const word = String(params.Body || '').trim().toLowerCase().replace(/[^a-z]/g, '');
+  const site = process.env.NEXT_PUBLIC_SITE_URL || 'https://taskly.ca';
+
+  if (STOP.has(word)) {
+    if (from) await addOptOut(from, 'Replied STOP', 'inbound_stop');
+    return twiml("You're unsubscribed from Taskly and won't get more messages. Reply START to resubscribe.");
+  }
+  if (START.has(word)) {
+    if (from) await removeOptOut(from);
+    return twiml(`Welcome back! Get started with Taskly: ${site}/onboarding`);
+  }
+  if (HELP.has(word)) {
+    return twiml('Taskly connects local pros with clients. Reply here for support. Reply STOP to opt out.');
+  }
+  return twiml(`Thanks! Continue here to get set up: ${site}/onboarding`);
+}
diff --git a/lib/link-import/facebook-photos.ts b/lib/link-import/facebook-photos.ts
new file mode 100644
index 00000000..58b7d8c0
--- /dev/null
+++ b/lib/link-import/facebook-photos.ts
@@ -0,0 +1,133 @@
+// Facebook page-photo extractor — the gallery behind "Import your photos" on
+// the tasker's public profile (app/api/provider/portfolio/import).
+//
+// Sibling of facebook.ts, which reads the About tab for text. This one reads the
+// PHOTOS tab and returns image URLs only.
+//
+// Two things make this safe to point a downloader at, and both were verified
+// against a live page rather than assumed:
+//
+// 1. ONLY `viewer_image` / `photo_image` hold the page's own gallery. The same
+//    HTML also carries `profilePicLarge|Medium|Small`, `quick_switch_picture`,
+//    `switcher_profile_picture`, `settings_dropdown_profile_picture` and
+//    `profile_picture_for_sticky_bar` — those belong to the SIGNED-IN ACCOUNT,
+//    i.e. ours. Importing by "every fbcdn URL on the page" would paste our own
+//    service avatar into a tasker's portfolio. So this allowlists the two
+//    gallery keys instead of filtering the noise, which fails closed when
+//    Facebook adds a key we've never seen.
+//
+// 2. The URLs are SIGNED AND EXPIRE (~4 days, the `oe=` param). They cannot be
+//    stored in provider_profiles.portfolio — the caller must download and
+//    re-host them, which is exactly what the import route does.
+//
+// The image URLs come out of remote HTML, so treating them as trusted fetch
+// targets would be an SSRF hole. isFbcdnImageUrl() is the gate, and the route
+// applies it to every URL before it fetches anything.
+
+import { fetchFacebookHtml } from './http';
+
+/** JSON keys that hold the PAGE's own photos. Allowlist — see the header. */
+const GALLERY_KEYS = ['viewer_image', 'photo_image'] as const;
+
+/** What one import may pull, before the caller's own free-slot limit. */
+export const MAX_IMPORT_PHOTOS = 12;
+
+/** Undo the backslash-escaping Facebook applies to URLs inside its JSON blobs. */
+const unescapeUri = (s: string) => s.replace(/\\\//g, '/').replace(/\\u0026/gi, '&');
+
+/**
+ * True for a URL we're willing to fetch server-side. The candidates are parsed
+ * out of a third party's HTML, so this is a security boundary, not a tidy-up:
+ * https only, hostname must really end at `.fbcdn.net` (not `fbcdn.net.evil.com`),
+ * and no embedded credentials.
+ */
+export function isFbcdnImageUrl(raw: string): boolean {
+  let u: URL;
+  try {
+    u = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (u.protocol !== 'https:') return false;
+  if (u.username || u.password) return false;
+  return u.hostname === 'fbcdn.net' || u.hostname.endsWith('.fbcdn.net');
+}
+
+/**
+ * Facebook embeds the photo's id in the filename (`<hash>_<photoid>_<hash>_n.jpg`),
+ * and the same photo appears at several crops on one page. Dedupe on that id so
+ * one photo imports once; fall back to the path when it isn't there.
+ */
+function photoKey(url: string): string {
+  try {
+    const path = new URL(url).pathname;
+    return (path.match(/\/\d+_(\d{10,})_/) || [])[1] || path;
+  } catch {
+    return url;
+  }
+}
+
+/**
+ * A Facebook login wall is served with HTTP 200, so a dead cookie looks like a
+ * successful fetch of a page with no photos. Naming it lets the route say
+ * "re-auth needed" instead of blaming the tasker's page.
+ */
+export function isLoginWall(html: string): boolean {
+  const title = (html.match(/<title[^>]*>([^<]*)<\/title>/i) || [])[1] || '';
+  // "Log in to Facebook" and "Log into Facebook" are both served. Anchored at
+  // the start so a business called "Logan Plumbing" stays readable.
+  return /^\s*(?:log\s?in(?:to)?\b|sign\s?up\b)/i.test(title.trim());
+}
+
+/** Gallery image URLs in page order, deduped and capped. Pure — unit-tested. */
+export function parsePhotoUrls(html: string, limit = MAX_IMPORT_PHOTOS): string[] {
+  const keys = GALLERY_KEYS.join('|');
+  const re = new RegExp(`"(?:${keys})":\\{"uri":"(https:[^"]+?)"`, 'g');
+
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const m of html.matchAll(re)) {
+    const url = unescapeUri(m[1]);
+    if (!isFbcdnImageUrl(url)) continue;
+    const k = photoKey(url);
+    if (seen.has(k)) continue;
+    seen.add(k);
+    out.push(url);
+    if (out.length >= limit) break;
+  }
+  return out;
+}
+
+/**
+ * The photos tab for a profile/page URL. `?sk=photos_by` is what a page's own
+ * uploads live behind; a plain profile URL renders the timeline, where a photo
+ * may be someone else's post.
+ */
+export function photosTabUrl(raw: string): string {
+  const u = new URL(raw);
+  const id = u.searchParams.get('id');
+  if (id) return `https://www.facebook.com/profile.php?id=${encodeURIComponent(id)}&sk=photos_by`;
+  const vanity = u.pathname.replace(/^\/+|\/+$/g, '');
+  if (!vanity || vanity.includes('/')) throw new Error(`Unrecognized Facebook URL: ${raw}`);
+  return `https://www.facebook.com/${vanity}/photos`;
+}
+
+export class LoginWallError extends Error {
+  constructor() {
+    super('Facebook returned a login wall — the session cookie is stale.');
+    this.name = 'LoginWallError';
+  }
+}
+
+/** Fetch the photos tab and return its gallery image URLs. */
+export async function extractFacebookPhotos(
+  cookies: string,
+  url: string,
+  limit = MAX_IMPORT_PHOTOS,
+): Promise<string[]> {
+  const html = await fetchFacebookHtml(photosTabUrl(url), cookies, {
+    headers: { referer: 'https://www.facebook.com/' },
+  });
+  if (isLoginWall(html)) throw new LoginWallError();
+  return parsePhotoUrls(html, limit);
+}
diff --git a/lib/sms/config.ts b/lib/sms/config.ts
new file mode 100644
index 00000000..89211512
--- /dev/null
+++ b/lib/sms/config.ts
@@ -0,0 +1,76 @@
+import 'server-only';
+
+// SMS outreach configuration — all SMS_* / CTA env in one place. Server-only
+// (some of it gates live sends), with publicSmsConfig() exposing the safe subset
+// the admin dashboard needs to render.
+
+import { smsConfigured, smsSenderLabel } from '@/lib/twilio/client';
+
+export interface SmsConfig {
+  dryRun: boolean;
+  pricePerSegment: number;
+  currency: string;
+  ctaUrl: string;
+  ctaLabel: string;
+  ratePerSec: number;
+  quietStartHour: number;
+  quietEndHour: number;
+  timezone: string;
+  enforceQuietHours: boolean;
+}
+
+export function smsConfig(): SmsConfig {
+  const siteUrl = process.env.NEXT_PUBLIC_SITE_URL || 'https://taskly.ca';
+  return {
+    // SAFETY: defaults to true. Live sends require SMS_DRY_RUN=false explicitly.
+    dryRun: String(process.env.SMS_DRY_RUN ?? 'true').toLowerCase() !== 'false',
+    pricePerSegment: Number(process.env.SMS_PRICE_PER_SEGMENT || '0.0079'),
+    currency: process.env.SMS_CURRENCY || 'USD',
+    ctaUrl: process.env.SMS_CTA_URL || `${siteUrl}/onboarding`,
+    ctaLabel: process.env.SMS_CTA_LABEL || 'Get started',
+    ratePerSec: Number(process.env.SMS_RATE_PER_SEC || '1'),
+    quietStartHour: Number(process.env.SMS_QUIET_START_HOUR || '9'),
+    quietEndHour: Number(process.env.SMS_QUIET_END_HOUR || '21'),
+    timezone: process.env.SMS_TIMEZONE || 'America/Toronto',
+    enforceQuietHours: String(process.env.SMS_ENFORCE_QUIET_HOURS ?? 'true').toLowerCase() !== 'false',
+  };
+}
+
+/** The subset safe to send to the browser (no secrets). */
+export function publicSmsConfig() {
+  const c = smsConfig();
+  return {
+    dryRun: c.dryRun,
+    pricePerSegment: c.pricePerSegment,
+    currency: c.currency,
+    ctaUrl: c.ctaUrl,
+    ctaLabel: c.ctaLabel,
+    quietHours: c.enforceQuietHours
+      ? `${c.quietStartHour}:00–${c.quietEndHour}:00 ${c.timezone}`
+      : 'disabled',
+    ratePerSec: c.ratePerSec,
+    smsConfigured: smsConfigured(),
+    sender: smsSenderLabel(),
+  };
+}
+
+/** Current hour (0-23) in an IANA timezone, via Intl (no deps). */
+function hourInTimezone(timezone: string): number {
+  try {
+    const h = Number(
+      new Intl.DateTimeFormat('en-US', { timeZone: timezone, hour: 'numeric', hour12: false }).format(new Date()),
+    );
+    return h === 24 ? 0 : h;
+  } catch {
+    return new Date().getHours();
+  }
+}
+
+/** True when sending is currently allowed under the quiet-hours window. */
+export function withinQuietWindow(c: SmsConfig = smsConfig()): boolean {
+  if (!c.enforceQuietHours) return true;
+  const h = hourInTimezone(c.timezone);
+  const { quietStartHour: start, quietEndHour: end } = c;
+  if (start <= end) return h >= start && h < end;
+  return h >= start || h < end; // wrap-around window
+}
diff --git a/lib/sms/message.ts b/lib/sms/message.ts
new file mode 100644
index 00000000..f585cddb
--- /dev/null
+++ b/lib/sms/message.ts
@@ -0,0 +1,50 @@
+// Pure message composition — builds the final SMS body from three deterministic
+// parts so the CTA link and the opt-out footer are never left to the AI:
+//
+//   <hook>  +  "<cta label>: <ctaUrl>"  +  "Reply STOP to opt out"
+//
+// Client- and server-safe (no server-only imports). The admin page previews the
+// composed body live; the send route composes the real thing.
+
+import { segmentInfo, toGsmSafe, type SegmentInfo } from './segments';
+
+export const STOP_FOOTER = 'Reply STOP to opt out';
+
+export interface Recipient {
+  name?: string;
+  phone: string;
+  city?: string;
+  category?: string;
+}
+
+export interface ComposeOptions {
+  /** Where the recipient should go — a taskly.ca URL or a wa.me link. */
+  ctaUrl: string;
+  /** Short label before the link, e.g. "Join Taskly" or "Get started". */
+  ctaLabel?: string;
+}
+
+function firstName(name?: string): string {
+  const n = String(name || '').trim();
+  return n ? n.split(/\s+/)[0] : 'there';
+}
+
+// Fallback opener when AI personalization is off/unavailable. Kept GSM-7 + short.
+export function defaultHook(r: Recipient): string {
+  const first = firstName(r.name);
+  const svc = r.category || 'your service';
+  const where = r.city ? ` in ${r.city}` : '';
+  return `Hi ${first}, it's Taskly - saw you offer ${svc}${where}. We connect local pros with vetted clients (weekly pay, flexible hours).`;
+}
+
+export interface ComposedMessage extends SegmentInfo {
+  body: string;
+}
+
+/** Compose the final body + segment/cost info from a hook (AI or template). */
+export function composeBody(r: Recipient, hookText: string | null, opts: ComposeOptions): ComposedMessage {
+  const hook = toGsmSafe((hookText && hookText.trim()) || defaultHook(r));
+  const label = opts.ctaLabel || 'Get started';
+  const body = `${hook} ${label}: ${opts.ctaUrl} ${STOP_FOOTER}`;
+  return { body, ...segmentInfo(body) };
+}
diff --git a/lib/sms/personalize.ts b/lib/sms/personalize.ts
new file mode 100644
index 00000000..d9b96fe1
--- /dev/null
+++ b/lib/sms/personalize.ts
@@ -0,0 +1,65 @@
+import 'server-only';
+
+// AI-personalized SMS opener. Goes through lib/ai/call so every token is priced
+// and shows up on /admin/costs under feature 'sms_outreach'. Returns just the
+// hook sentence — NO link, NO STOP footer (those are appended deterministically
+// by composeBody so the URL never gets mangled). Degrades to the template hook on
+// any failure, so a flaky AI call never blocks a campaign.
+
+import { callGroqChat } from '@/lib/ai/call';
+import { defaultHook, type Recipient } from './message';
+
+const MODEL = process.env.GROQ_SMS_MODEL || process.env.GROQ_MODEL || 'llama-3.1-8b-instant';
+const TIMEOUT_MS = Number(process.env.GROQ_SMS_TIMEOUT_MS) || 9000;
+
+export interface HookResult {
+  text: string;
+  source: 'groq' | 'template';
+}
+
+export async function generateSmsHook(r: Recipient, req?: Request | null): Promise<HookResult> {
+  const key = process.env.GROQ_API_KEY;
+  if (!key) return { text: defaultHook(r), source: 'template' };
+
+  const system = [
+    'You write ONE short SMS opener to a local service provider (cleaner, handyman, mover, PSW, etc.) in Canada.',
+    'Tone: warm, human, neighborly — not corporate, not spammy. No emojis. At most one exclamation mark.',
+    'Mention their first name and their service briefly; mention their city if given.',
+    'Say Taskly connects local pros with vetted clients; mention weekly pay OR flexible hours (pick one).',
+    'DO NOT include any link, URL, phone number, or the word STOP — those are added separately.',
+    'Hard limit: 22 words. Output ONLY JSON: {"text":"..."}',
+  ].join(' ');
+
+  const user = [
+    `Name: ${r.name || 'unknown'}`,
+    `Service: ${r.category || 'home services'}`,
+    `City: ${r.city || 'their area'}`,
+  ].join('\n');
+
+  const res = await callGroqChat({
+    key,
+    model: MODEL,
+    timeoutMs: TIMEOUT_MS,
+    feature: 'sms_outreach',
+    route: '/api/admin/sms/send',
+    req: req ?? null,
+    body: {
+      temperature: 0.6,
+      response_format: { type: 'json_object' },
+      messages: [
+        { role: 'system', content: system },
+        { role: 'user', content: user },
+      ],
+    },
+  });
+
+  if (!res.ok || !res.content) return { text: defaultHook(r), source: 'template' };
+  try {
+    const match = res.content.match(/\{[\s\S]*\}/);
+    const parsed = JSON.parse(match ? match[0] : res.content) as { text?: string };
+    const text = typeof parsed.text === 'string' ? parsed.text.trim() : '';
+    return text ? { text, source: 'groq' } : { text: defaultHook(r), source: 'template' };
+  } catch {
+    return { text: defaultHook(r), source: 'template' };
+  }
+}
diff --git a/lib/sms/recipients.ts b/lib/sms/recipients.ts
new file mode 100644
index 00000000..0bfb1b86
--- /dev/null
+++ b/lib/sms/recipients.ts
@@ -0,0 +1,104 @@
+// Recipient sources for the SMS tool:
+//   1. parseRecipients() — pasted text or an uploaded CSV (client- & server-safe)
+//   2. loadProviderRecipients() — approved taskers from the DB (server-only)
+
+import { normalizePhone, isValidE164 } from './segments';
+import type { Recipient } from './message';
+
+export interface ParseResult {
+  recipients: Recipient[];
+  invalid: string[];
+  duplicates: number;
+}
+
+// Accepts:
+//   • one phone per line (or comma-separated)
+//   • CSV with a header row containing a "phone" column (+ optional
+//     name / location|city / category columns, in any order)
+export function parseRecipients(text: string): ParseResult {
+  const raw = String(text || '').replace(/\r/g, '');
+  const lines = raw.split('\n').map((l) => l.trim()).filter(Boolean);
+  const seen = new Set<string>();
+  const recipients: Recipient[] = [];
+  const invalid: string[] = [];
+  let duplicates = 0;
+
+  // Detect a CSV header (has a "phone" column and at least one comma).
+  const header = lines[0]?.toLowerCase();
+  const isCsv = !!header && header.includes(',') && /(^|,)\s*phone\s*(,|$)/.test(header);
+
+  if (isCsv) {
+    const cols = lines[0].split(',').map((c) => c.trim().toLowerCase());
+    const idx = {
+      name: cols.indexOf('name'),
+      phone: cols.indexOf('phone'),
+      city: cols.indexOf('city') >= 0 ? cols.indexOf('city') : cols.indexOf('location'),
+      category: cols.indexOf('category'),
+    };
+    for (let i = 1; i < lines.length; i++) {
+      const cells = splitCsvLine(lines[i]);
+      const phone = normalizePhone(cells[idx.phone] || '');
+      pushRecipient(
+        {
+          phone,
+          name: idx.name >= 0 ? cells[idx.name] : '',
+          city: idx.city >= 0 ? cells[idx.city] : '',
+          category: idx.category >= 0 ? cells[idx.category] : '',
+        },
+        cells[idx.phone] || lines[i],
+      );
+    }
+  } else {
+    // Plain list: split every line on commas too, so "+1..., +1..." works.
+    for (const line of lines) {
+      for (const token of line.split(',')) {
+        const t = token.trim();
+        if (!t) continue;
+        pushRecipient({ phone: normalizePhone(t) }, t);
+      }
+    }
+  }
+
+  return { recipients, invalid, duplicates };
+
+  function pushRecipient(r: Recipient, original: string) {
+    if (!isValidE164(r.phone)) {
+      if (original) invalid.push(original);
+      return;
+    }
+    if (seen.has(r.phone)) {
+      duplicates++;
+      return;
+    }
+    seen.add(r.phone);
+    recipients.push({
+      phone: r.phone,
+      name: (r.name || '').trim(),
+      city: (r.city || '').trim(),
+      category: (r.category || '').trim(),
+    });
+  }
+}
+
+// Minimal CSV cell splitter (handles simple double-quoted cells).
+function splitCsvLine(line: string): string[] {
+  const out: string[] = [];
+  let cell = '';
+  let inQuotes = false;
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (inQuotes) {
+      if (c === '"' && line[i + 1] === '"') {
+        cell += '"';
+        i++;
+      } else if (c === '"') inQuotes = false;
+      else cell += c;
+    } else if (c === '"') inQuotes = true;
+    else if (c === ',') {
+      out.push(cell);
+      cell = '';
+    } else cell += c;
+  }
+  out.push(cell);
+  return out.map((s) => s.trim());
+}
diff --git a/lib/sms/segments.ts b/lib/sms/segments.ts
new file mode 100644
index 00000000..bf382941
--- /dev/null
+++ b/lib/sms/segments.ts
@@ -0,0 +1,72 @@
+// Pure SMS helpers — phone normalization, GSM-7 segment math, cost. No imports,
+// no server-only APIs: safe to run in the browser (the admin page computes a live
+// cost estimate) AND on the server (the send route prices each message).
+
+export function normalizePhone(raw: string, defaultCountry = '1'): string {
+  if (!raw) return '';
+  const s = String(raw).trim();
+  if (s.startsWith('+')) {
+    const digits = s.slice(1).replace(/\D/g, '');
+    return digits ? '+' + digits : '';
+  }
+  const digits = s.replace(/\D/g, '');
+  if (!digits) return '';
+  if (digits.length === 10) return '+' + defaultCountry + digits; // bare NANP
+  if (digits.length === 11 && digits.startsWith(defaultCountry)) return '+' + digits;
+  return '+' + digits;
+}
+
+export function isValidE164(phone: string): boolean {
+  return /^\+[1-9]\d{7,14}$/.test(phone || '');
+}
+
+// GSM 03.38 basic + extension tables. Any char outside them forces UCS-2, which
+// halves the per-segment capacity (70 vs 160) — so we keep messages GSM-7.
+const GSM7_BASIC =
+  '@£$¥èéùìòÇ\nØø\rÅåΔ_ΦΓΛΩΠΨΣΘΞ ÆæßÉ !"#¤%&\'()*+,-./0123456789:;<=>?' +
+  '¡ABCDEFGHIJKLMNOPQRSTUVWXYZÄÖÑܧ¿abcdefghijklmnopqrstuvwxyzäöñüà';
+const GSM7_EXT = '^{}\\[~]|€';
+
+function isGsm7(text: string): boolean {
+  for (const ch of text) {
+    if (GSM7_BASIC.indexOf(ch) === -1 && GSM7_EXT.indexOf(ch) === -1) return false;
+  }
+  return true;
+}
+
+export interface SegmentInfo {
+  encoding: 'GSM-7' | 'UCS-2';
+  chars: number;
+  segments: number;
+}
+
+export function segmentInfo(text: string): SegmentInfo {
+  const body = String(text ?? '');
+  const gsm = isGsm7(body);
+  let units: number;
+  if (gsm) {
+    units = 0;
+    for (const ch of body) units += GSM7_EXT.indexOf(ch) !== -1 ? 2 : 1;
+  } else {
+    units = [...body].reduce((n, ch) => n + ((ch.codePointAt(0) ?? 0) > 0xffff ? 2 : 1), 0);
+  }
+  const single = gsm ? 160 : 70;
+  const multi = gsm ? 153 : 67;
+  const segments = units <= single ? 1 : Math.ceil(units / multi);
+  return { encoding: gsm ? 'GSM-7' : 'UCS-2', chars: units, segments: Math.max(1, segments) };
+}
+
+// Transliterate common non-GSM-7 punctuation to ASCII so the whole message stays
+// GSM-7 (em dashes / smart quotes are the usual offenders from AI output).
+export function toGsmSafe(text: string): string {
+  return String(text || '')
+    .replace(/[—–]/g, '-')
+    .replace(/[‘’‛]/g, "'")
+    .replace(/[“”]/g, '"')
+    .replace(/…/g, '...')
+    .replace(/ /g, ' ');
+}
+
+export function segmentCost(segments: number, pricePerSegment: number): number {
+  return +(segments * pricePerSegment).toFixed(5);
+}
diff --git a/lib/sms/store.ts b/lib/sms/store.ts
new file mode 100644
index 00000000..d0f8982a
--- /dev/null
+++ b/lib/sms/store.ts
@@ -0,0 +1,172 @@
+import 'server-only';
+
+// Supabase-backed persistence for SMS outreach (service-role → bypasses RLS).
+// Serverless has no local disk, so send history + opt-outs live in Postgres:
+//   public.sms_optouts, public.sms_campaign_log  (migration 191).
+
+import { createServiceRoleClient } from '@/lib/supabase/admin';
+
+export interface SendRecord {
+  phone: string;
+  name?: string | null;
+  body?: string | null;
+  segments?: number | null;
+  price?: number | null;
+  currency?: string | null;
+  status: string;
+  providerSid?: string | null;
+  error?: string | null;
+  dryRun: boolean;
+  sentBy?: string | null;
+}
+
+export async function readOptOuts(): Promise<Set<string>> {
+  const db = createServiceRoleClient();
+  const { data } = await db.from('sms_optouts').select('phone');
+  return new Set((data ?? []).map((r) => r.phone as string));
+}
+
+export async function addOptOut(
+  phone: string,
+  reason?: string,
+  source: 'inbound_stop' | 'manual' | 'twilio_error' = 'inbound_stop',
+): Promise<void> {
+  const db = createServiceRoleClient();
+  await db.from('sms_optouts').upsert({ phone, reason: reason ?? null, source }, { onConflict: 'phone' });
+}
+
+export async function removeOptOut(phone: string): Promise<void> {
+  const db = createServiceRoleClient();
+  await db.from('sms_optouts').delete().eq('phone', phone);
+}
+
+/** Phones that already received a LIVE message — for idempotency (dry-runs excluded). */
+export async function alreadySentLivePhones(): Promise<Set<string>> {
+  const db = createServiceRoleClient();
+  const { data } = await db
+    .from('sms_campaign_log')
+    .select('phone')
+    .eq('dry_run', false);
+  return new Set((data ?? []).map((r) => r.phone as string));
+}
+
+export async function recordSend(rec: SendRecord): Promise<void> {
+  const db = createServiceRoleClient();
+  await db.from('sms_campaign_log').insert({
+    phone: rec.phone,
+    name: rec.name ?? null,
+    body: rec.body ?? null,
+    segments: rec.segments ?? null,
+    price: rec.price ?? null,
+    currency: rec.currency ?? 'USD',
+    status: rec.status,
+    provider_sid: rec.providerSid ?? null,
+    error: rec.error ?? null,
+    dry_run: rec.dryRun,
+    sent_by: rec.sentBy ?? null,
+  });
+}
+
+/** Delivery-receipt update from the Twilio StatusCallback (keyed by Message SID). */
+export async function updateStatusBySid(sid: string, status: string, error?: string | null): Promise<void> {
+  const db = createServiceRoleClient();
+  await db
+    .from('sms_campaign_log')
+    .update({ status, error: error ?? null, updated_at: new Date().toISOString() })
+    .eq('provider_sid', sid);
+}
+
+// Non-terminal statuses whose rows are worth re-checking against Twilio.
+const TERMINAL = new Set(['delivered', 'undelivered', 'failed', 'canceled', 'dry-run']);
+
+/** SIDs of live rows not yet in a terminal state — the "Sync from Twilio" work list. */
+export async function pendingSids(limit = 500): Promise<string[]> {
+  const db = createServiceRoleClient();
+  const { data } = await db
+    .from('sms_campaign_log')
+    .select('provider_sid, status')
+    .eq('dry_run', false)
+    .not('provider_sid', 'is', null)
+    .order('created_at', { ascending: false })
+    .limit(limit);
+  return (data ?? [])
+    .filter((r) => !TERMINAL.has((r.status as string) || ''))
+    .map((r) => r.provider_sid as string);
+}
+
+/** Reconcile a row from a Twilio fetch: status + error + (final) price. */
+export async function applyTwilioStatus(
+  sid: string,
+  fields: { status: string; error?: string | null; price?: number | null; currency?: string | null },
+): Promise<void> {
+  const db = createServiceRoleClient();
+  const update: Record<string, unknown> = { status: fields.status, updated_at: new Date().toISOString() };
+  if (fields.error !== undefined) update.error = fields.error;
+  if (fields.price != null) update.price = fields.price;
+  if (fields.currency) update.currency = fields.currency;
+  await db.from('sms_campaign_log').update(update).eq('provider_sid', sid);
+}
+
+export interface CampaignStats {
+  totalAttempts: number;
+  liveSent: number;
+  delivered: number;
+  failed: number;
+  optedOut: number;
+  spend: number;
+  currency: string;
+  byStatus: Record<string, number>;
+}
+
+export async function campaignStats(): Promise<CampaignStats> {
+  const db = createServiceRoleClient();
+  const [{ data: rows }, { count: optOutCount }] = await Promise.all([
+    db.from('sms_campaign_log').select('status, price, dry_run, currency').limit(50000),
+    db.from('sms_optouts').select('phone', { count: 'exact', head: true }),
+  ]);
+
+  const byStatus: Record<string, number> = {};
+  let spend = 0;
+  let liveSent = 0;
+  let currency = 'USD';
+  for (const r of rows ?? []) {
+    const status = (r.status as string) || 'unknown';
+    byStatus[status] = (byStatus[status] || 0) + 1;
+    if (r.price != null) spend += Number(r.price);
+    if (r.dry_run === false) liveSent++;
+    if (r.currency) currency = r.currency as string;
+  }
+
+  return {
+    totalAttempts: (rows ?? []).length,
+    liveSent,
+    delivered: byStatus['delivered'] || 0,
+    failed: (byStatus['failed'] || 0) + (byStatus['undelivered'] || 0),
+    optedOut: optOutCount ?? 0,
+    spend: +spend.toFixed(4),
+    currency,
+    byStatus,
+  };
+}
+
+export interface LogRow {
+  phone: string;
+  name: string | null;
+  status: string;
+  segments: number | null;
+  price: number | null;
+  currency: string;
+  error: string | null;
+  dry_run: boolean;
+  created_at: string;
+}
+
+export async function recentLog(limit = 100): Promise<LogRow[]> {
+  const db = createServiceRoleClient();
+  const { data } = await db
+    .from('sms_campaign_log')
+    .select('phone, name, status, segments, price, currency, error, dry_run, created_at')
+    .order('created_at', { ascending: false })
+    .limit(Math.min(limit, 1000));
+  return (data ?? []) as LogRow[];
+}
diff --git a/lib/twilio/client.ts b/lib/twilio/client.ts
index 124a12df..1dfb19bb 100644
--- a/lib/twilio/client.ts
+++ b/lib/twilio/client.ts
@@ -13,6 +13,11 @@ import crypto from 'node:crypto';
 const SID = process.env.TWILIO_ACCOUNT_SID;
 const TOKEN = process.env.TWILIO_AUTH_TOKEN;
 const CALLER_ID = process.env.TWILIO_CALLER_ID;
+// SMS sender — a Messaging Service (MGxxxx, preferred: A2P 10DLC + opt-out
+// handling + number pooling) OR a plain SMS-capable number. Separate from
+// CALLER_ID, which is Voice-only.
+const SMS_MESSAGING_SERVICE_SID = process.env.TWILIO_MESSAGING_SERVICE_SID;
+const SMS_FROM = process.env.TWILIO_SMS_FROM;
 
 export function twilioConfigured(): boolean {
   return !!(SID && TOKEN && CALLER_ID);
@@ -22,6 +27,129 @@ export function twilioCallerId(): string | null {
   return CALLER_ID ?? null;
 }
 
+/** SMS is sendable when we have account creds AND a sender (service SID or number). */
+export function smsConfigured(): boolean {
+  return !!(SID && TOKEN && (SMS_MESSAGING_SERVICE_SID || SMS_FROM));
+}
+
+/** Human-readable sender label for the dashboard ("MessagingService MG…" / "+1…"). */
+export function smsSenderLabel(): string | null {
+  if (SMS_MESSAGING_SERVICE_SID) return `MessagingService ${SMS_MESSAGING_SERVICE_SID}`;
+  if (SMS_FROM) return SMS_FROM;
+  return null;
+}
+
+export interface SendSmsResult {
+  sid: string;
+  status: string;
+  /** Absolute per-message price when Twilio returns it (often null until delivered). */
+  price: number | null;
+  priceUnit: string | null;
+  numSegments: number | null;
+}
+
+/**
+ * Send one SMS via the Messages API. Uses the Messaging Service when configured,
+ * else the plain From number. `statusCallback` (optional) is where Twilio POSTs
+ * delivery-receipt updates. Throws with a Twilio error code on non-2xx so the
+ * caller can log it against the recipient.
+ */
+export async function sendSms(opts: {
+  to: string;
+  body: string;
+  statusCallback?: string;
+}): Promise<SendSmsResult> {
+  if (!smsConfigured()) throw new Error('Twilio SMS is not configured');
+
+  const form = new URLSearchParams({ To: opts.to, Body: opts.body });
+  if (SMS_MESSAGING_SERVICE_SID) form.set('MessagingServiceSid', SMS_MESSAGING_SERVICE_SID);
+  else form.set('From', SMS_FROM!);
+  if (opts.statusCallback) form.set('StatusCallback', opts.statusCallback);
+
+  const res = await fetch(`https://api.twilio.com/2010-04-01/Accounts/${SID}/Messages.json`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Basic ${Buffer.from(`${SID}:${TOKEN}`).toString('base64')}`,
+      'Content-Type': 'application/x-www-form-urlencoded',
+    },
+    body: form,
+  });
+
+  const text = await res.text().catch(() => '');
+  let json: {
+    sid?: string;
+    status?: string;
+    price?: string | null;
+    price_unit?: string | null;
+    num_segments?: string | null;
+    message?: string;
+    code?: number;
+  } = {};
+  try {
+    json = text ? JSON.parse(text) : {};
+  } catch {
+    /* non-JSON body left as {} */
+  }
+
+  if (!res.ok) {
+    const err = new Error(json.message || `Twilio SMS failed: ${res.status}`) as Error & {
+      httpStatus?: number;
+      code?: number;
+    };
+    err.httpStatus = res.status;
+    err.code = json.code;
+    throw err;
+  }
+
+  return {
+    sid: json.sid ?? '',
+    status: json.status ?? 'queued',
+    price: json.price == null ? null : Math.abs(Number(json.price)),
+    priceUnit: json.price_unit ?? null,
+    numSegments: json.num_segments == null ? null : Number(json.num_segments),
+  };
+}
+
+export interface TwilioMessageStatus {
+  sid: string;
+  status: string;
+  errorCode: number | null;
+  price: number | null;
+  priceUnit: string | null;
+}
+
+/**
+ * Fetch one message's current state from Twilio. Used by the "Sync from Twilio"
+ * action to reconcile campaign-log rows when the delivery-receipt webhook can't
+ * reach us (e.g. local dev). Returns null on any error so a bad SID never breaks
+ * the whole sync pass.
+ */
+export async function fetchMessageStatus(sid: string): Promise<TwilioMessageStatus | null> {
+  if (!SID || !TOKEN || !sid) return null;
+  try {
+    const res = await fetch(`https://api.twilio.com/2010-04-01/Accounts/${SID}/Messages/${sid}.json`, {
+      headers: { Authorization: `Basic ${Buffer.from(`${SID}:${TOKEN}`).toString('base64')}` },
+    });
+    if (!res.ok) return null;
+    const j = (await res.json()) as {
+      sid?: string;
+      status?: string;
+      error_code?: number | null;
+      price?: string | null;
+      price_unit?: string | null;
+    };
+    return {
+      sid: j.sid ?? sid,
+      status: j.status ?? 'unknown',
+      errorCode: j.error_code ?? null,
+      price: j.price == null ? null : Math.abs(Number(j.price)),
+      priceUnit: j.price_unit ?? null,
+    };
+  } catch {
+    return null;
+  }
+}
+
 /** Opt-in call recording (off by default). Ontario is one-party consent, but we
  *  still play a recording disclaimer (the whisper) when this is on. */
 export function recordCalls(): boolean {
diff --git a/supabase/migrations/191_sms_outreach.sql b/supabase/migrations/191_sms_outreach.sql
new file mode 100644
index 00000000..42d72aea
--- /dev/null
+++ b/supabase/migrations/191_sms_outreach.sql
@@ -0,0 +1,74 @@
+-- 191_sms_outreach.sql
+--
+-- Admin SMS outreach (Twilio). Two tables, both service-role write / admin read:
+--
+--   sms_optouts      — suppression list. One row per phone that replied STOP.
+--                      Checked before every send; the inbound webhook writes here.
+--   sms_campaign_log — one row per outbound attempt (dry-run or live), plus later
+--                      delivery-status updates from Twilio's StatusCallback. Backs
+--                      the dashboard totals, cost tracking, and idempotency
+--                      (never send a LIVE message to a phone that already has one).
+--
+-- Writes go through the API routes / webhook running service-role (bypasses RLS)
+-- after admin auth or Twilio-signature validation. No anon/authenticated write
+-- policy is exposed, so RLS default-denies direct table access; admins read for
+-- the dashboard. Mirrors the pattern established by 129_leads.sql.
+--
+-- Idempotent (IF NOT EXISTS / DROP POLICY IF EXISTS) so it is safe to re-run —
+-- e.g. applied directly to the DB once, then again via the migration pipeline.
+
+create table if not exists public.sms_optouts (
+  phone       text primary key check (phone ~ '^\+[1-9][0-9]{7,14}$'),
+  reason      text check (length(reason) <= 200),
+  source      text not null default 'inbound_stop'
+                check (source in ('inbound_stop', 'manual', 'twilio_error')),
+  created_at  timestamptz not null default now()
+);
+
+create table if not exists public.sms_campaign_log (
+  id           uuid primary key default gen_random_uuid(),
+  phone        text not null check (phone ~ '^\+[1-9][0-9]{7,14}$'),
+  name         text check (length(name) <= 120),
+  body         text check (length(body) <= 2000),
+  segments     smallint check (segments between 0 and 20),
+  -- Twilio's real per-message price once known; positive dollars in `currency`.
+  price        numeric(10, 5) check (price >= 0),
+  currency     text not null default 'USD' check (length(currency) <= 8),
+  -- Lifecycle: queued/sent/delivered/undelivered/failed (Twilio), or dry-run.
+  status       text not null default 'queued' check (length(status) <= 32),
+  provider_sid text check (length(provider_sid) <= 64),   -- Twilio Message SID
+  error        text check (length(error) <= 500),
+  dry_run      boolean not null default true,
+  -- Which admin kicked off the send (audit trail).
+  sent_by      uuid references public.profiles(id) on delete set null,
+  created_at   timestamptz not null default now(),
+  updated_at   timestamptz not null default now()
+);
+
+-- Idempotency + dashboard queries: the "has this phone already had a LIVE send?"
+-- lookup, and recent-first listing.
+create index if not exists idx_sms_log_phone_live
+  on public.sms_campaign_log (phone)
+  where dry_run = false;
+create index if not exists idx_sms_log_created on public.sms_campaign_log (created_at desc);
+create index if not exists idx_sms_log_sid on public.sms_campaign_log (provider_sid)
+  where provider_sid is not null;
+create index if not exists idx_sms_log_status on public.sms_campaign_log (status, created_at desc);
+
+alter table public.sms_optouts enable row level security;
+alter table public.sms_campaign_log enable row level security;
+
+-- Admin read only. Writes are service-role (API routes / signed Twilio webhook).
+-- Checks profiles.role directly rather than a helper that isn't in every env,
+-- matching 129_leads.sql.
+drop policy if exists "Admins view sms_optouts" on public.sms_optouts;
+create policy "Admins view sms_optouts" on public.sms_optouts
+  for select using (
+    exists (select 1 from public.profiles p where p.id = auth.uid() and p.role = 'admin')
+  );
+
+drop policy if exists "Admins view sms_campaign_log" on public.sms_campaign_log;
+create policy "Admins view sms_campaign_log" on public.sms_campaign_log
+  for select using (
+    exists (select 1 from public.profiles p where p.id = auth.uid() and p.role = 'admin')
+  );
diff --git a/tests/marketplace/portfolio-photo-import.test.ts b/tests/marketplace/portfolio-photo-import.test.ts
new file mode 100644
index 00000000..14c243fb
--- /dev/null
+++ b/tests/marketplace/portfolio-photo-import.test.ts
@@ -0,0 +1,118 @@
+// Facebook photo import → provider_profiles.portfolio.
+//
+// The fixture mirrors the key layout of a real photos tab (verified against a
+// live page): the gallery sits in `viewer_image` / `photo_image`, and the same
+// HTML also carries the SIGNED-IN account's own avatars under half a dozen other
+// keys. Those keys are the reason this parser allowlists instead of filtering —
+// a "take every fbcdn URL" import pastes our service account's avatar into a
+// tasker's portfolio.
+
+import { describe, it, expect } from 'vitest';
+import {
+  parsePhotoUrls, isFbcdnImageUrl, isLoginWall, photosTabUrl, MAX_IMPORT_PHOTOS,
+} from '@/lib/link-import/facebook-photos';
+
+const cdn = (file: string) => `https:\\/\\/scontent.fblr7-1.fna.fbcdn.net\\/v\\/t39.30808-6\\/${file}`;
+
+// Two gallery photos, plus every noise key observed on the live page.
+const PAGE_HTML = `
+  <title>Toole Pawspa</title>
+  {"viewer_image":{"uri":"${cdn('753164195_122120893959357610_5468773425341882043_n.jpg?stp=c0.119.1&oe=68F1A2B3')}"}}
+  {"viewer_image":{"uri":"${cdn('753225312_122120019651357610_5696340567354938327_n.jpg?oe=68F1A2B4')}"}}
+  {"photo_image":{"uri":"${cdn('753164195_122120893959357610_9999999999999999999_n.jpg?stp=c275.0.6&oe=68F1A2B5')}"}}
+  {"profilePicLarge":{"uri":"${cdn('000000001_100000000000001_1111111111111111111_n.jpg')}"}}
+  {"profilePicMedium":{"uri":"${cdn('000000002_100000000000002_1111111111111111112_n.jpg')}"}}
+  {"profilePicSmall":{"uri":"${cdn('000000003_100000000000003_1111111111111111113_n.jpg')}"}}
+  {"quick_switch_picture":{"uri":"${cdn('000000004_100000000000004_1111111111111111114_n.jpg')}"}}
+  {"switcher_profile_picture":{"uri":"${cdn('000000005_100000000000005_1111111111111111115_n.jpg')}"}}
+  {"settings_dropdown_profile_picture":{"uri":"${cdn('000000006_100000000000006_1111111111111111116_n.jpg')}"}}
+  {"profile_picture_for_sticky_bar":{"uri":"${cdn('000000007_100000000000007_1111111111111111117_n.jpg')}"}}
+  {"blurred_image":{"uri":"${cdn('000000008_100000000000008_1111111111111111118_n.jpg')}"}}
+`;
+
+describe('parsePhotoUrls', () => {
+  it('takes the gallery keys and nothing else', () => {
+    const urls = parsePhotoUrls(PAGE_HTML);
+    expect(urls).toHaveLength(2);
+    expect(urls.every((u) => /^https:\/\/scontent\./.test(u))).toBe(true);
+  });
+
+  it('never returns the signed-in account\'s own avatars', () => {
+    const urls = parsePhotoUrls(PAGE_HTML).join(' ');
+    for (const noise of ['100000000000001', '100000000000004', '100000000000005', '100000000000007']) {
+      expect(urls).not.toContain(noise);
+    }
+  });
+
+  it('dedupes the same photo appearing at several crops', () => {
+    // 753164195_1221208939... appears as both viewer_image and photo_image.
+    const urls = parsePhotoUrls(PAGE_HTML);
+    const ids = urls.map((u) => (u.match(/_(\d{10,})_/) || [])[1]);
+    expect(new Set(ids).size).toBe(ids.length);
+  });
+
+  it('unescapes the JSON slash-escaping', () => {
+    expect(parsePhotoUrls(PAGE_HTML)[0]).not.toContain('\\/');
+  });
+
+  it('honours the limit', () => {
+    expect(parsePhotoUrls(PAGE_HTML, 1)).toHaveLength(1);
+    expect(MAX_IMPORT_PHOTOS).toBeLessThanOrEqual(16);
+  });
+
+  it('returns nothing for a page with no gallery, without throwing', () => {
+    expect(parsePhotoUrls('<title>Facebook</title>')).toEqual([]);
+    expect(parsePhotoUrls('')).toEqual([]);
+  });
+
+  it('drops a non-fbcdn URL smuggled into a gallery key', () => {
+    const evil = '{"viewer_image":{"uri":"https:\\/\\/evil.com\\/x.jpg"}}';
+    expect(parsePhotoUrls(evil)).toEqual([]);
+  });
+});
+
+describe('isFbcdnImageUrl — the gate on remote-HTML fetch targets', () => {
+  it('admits real CDN hosts', () => {
+    expect(isFbcdnImageUrl('https://scontent.fblr7-1.fna.fbcdn.net/v/t39/x_n.jpg')).toBe(true);
+    expect(isFbcdnImageUrl('https://fbcdn.net/x.jpg')).toBe(true);
+  });
+
+  it('rejects a lookalike host, plain http, credentials and internal targets', () => {
+    expect(isFbcdnImageUrl('https://fbcdn.net.evil.com/x.jpg')).toBe(false);
+    expect(isFbcdnImageUrl('https://evilfbcdn.net/x.jpg')).toBe(false);
+    expect(isFbcdnImageUrl('http://scontent.fbcdn.net/x.jpg')).toBe(false);
+    expect(isFbcdnImageUrl('https://user:pw@scontent.fbcdn.net/x.jpg')).toBe(false);
+    expect(isFbcdnImageUrl('http://169.254.169.254/latest/meta-data/')).toBe(false);
+    expect(isFbcdnImageUrl('file:///etc/passwd')).toBe(false);
+    expect(isFbcdnImageUrl('not a url')).toBe(false);
+  });
+});
+
+describe('isLoginWall', () => {
+  it('recognizes the HTTP-200 login page a stale cookie returns', () => {
+    expect(isLoginWall('<title>Log in to Facebook</title>')).toBe(true);
+    expect(isLoginWall('<title>Log into Facebook</title>')).toBe(true);
+  });
+
+  it('leaves a real page alone', () => {
+    expect(isLoginWall('<title>Toole Pawspa</title>')).toBe(false);
+    // A business whose name merely starts with a matching word stays readable.
+    expect(isLoginWall('<title>Logan Plumbing</title>')).toBe(false);
+  });
+});
+
+describe('photosTabUrl', () => {
+  it('sends a numeric profile to its own uploads tab', () => {
+    expect(photosTabUrl('https://www.facebook.com/profile.php?id=61590728309774'))
+      .toBe('https://www.facebook.com/profile.php?id=61590728309774&sk=photos_by');
+  });
+
+  it('sends a vanity page to /photos', () => {
+    expect(photosTabUrl('https://www.facebook.com/toolepawspa'))
+      .toBe('https://www.facebook.com/toolepawspa/photos');
+  });
+
+  it('refuses a URL it cannot attribute to one page', () => {
+    expect(() => photosTabUrl('https://www.facebook.com/groups/123/posts/456')).toThrow();
+  });
+});