@crievo/omni 0.0.0-stage → 0.1.0

package/tools/lib/platforms/tiktok.mjs

@@ -0,0 +1,343 @@
+/* ============================================================================
+   TikTok (Content Posting API, Login Kit for desktop). The access token lasts
+   24 h and the refresh one a year: each use renews whatever expired and writes
+   both back to the injected TokenStore. `mode: "direct"` publishes to the
+   profile (video.publish); `"draft"` sends it to the app's inbox
+   (video.upload). An unaudited app only publishes as "only me" (SELF_ONLY).
+   Pure: the file comes in as bytes.
+   ============================================================================ */
+
+import { request, withDefaults } from "../http.mjs";
+
+/** @typedef {import("../http.mjs").Deps} Deps */
+/** @typedef {import("../http.mjs").TokenStore} TokenStore */
+
+export const TT = "https://open.tiktokapis.com/v2";
+export const TT_AUTH = "https://www.tiktok.com/v2/auth/authorize/";
+export const TT_SCOPES = ["user.info.basic", "user.info.profile", "video.publish", "video.upload"];
+const MB = 1024 * 1024;
+/** The access token is reused while more than this is left. */
+export const ACCESS_MARGIN_MS = 10 * 60_000;
+
+/**
+ * The app credentials from the store.
+ * @param {TokenStore} store
+ */
+export function tiktokApp(store) {
+  const key = store.get("TIKTOK_CLIENT_KEY"),
+    secret = store.get("TIKTOK_CLIENT_SECRET");
+  if (!key || !secret)
+    throw new Error("faltam TIKTOK_CLIENT_KEY e TIKTOK_CLIENT_SECRET no .env (reference/publish.md, TikTok passo 2)");
+  return { key, secret };
+}
+
+/**
+ * Is the stored access token still good for this call?
+ * @param {{ access: string, expires: number, now: number }} p `expires` epoch ms (NaN when unknown)
+ */
+export const tiktokAccessValid = ({ access, expires, now }) => !!access && expires - now > ACCESS_MARGIN_MS;
+
+/**
+ * The store values a token answer becomes.
+ * @param {any} j the /oauth/token/ body
+ * @param {number} now
+ * @returns {Record<string, string>}
+ */
+export const tiktokTokenValues = (j, now) => ({
+  TIKTOK_ACCESS_TOKEN: j.access_token,
+  TIKTOK_ACCESS_EXPIRES: new Date(now + j.expires_in * 1000).toISOString(),
+  ...(j.refresh_token ? { TIKTOK_REFRESH_TOKEN: j.refresh_token } : {}),
+  ...(j.refresh_expires_in
+    ? { TIKTOK_REFRESH_EXPIRES: new Date(now + j.refresh_expires_in * 1000).toISOString() }
+    : {}),
+  ...(j.open_id ? { TIKTOK_OPEN_ID: j.open_id } : {}),
+  ...(j.scope ? { TIKTOK_SCOPES: j.scope } : {}),
+});
+
+/**
+ * The token route answers 200 even on error (`error` in the body). Stores what comes back.
+ * @param {{ store: TokenStore, body: Record<string, string>, label: string } & Deps} p
+ * @returns {Promise<string>} the access token
+ */
+export async function fetchTiktokToken({ store, body, label, ...deps }) {
+  const d = withDefaults(deps);
+  const { key, secret } = tiktokApp(store);
+  const { j } = await request(
+    `${TT}/oauth/token/`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ client_key: key, client_secret: secret, ...body }),
+    },
+    label,
+    d,
+  );
+  if (!j?.access_token) throw new Error(`${label}: ${j?.error_description || j?.error || "sem access_token"}`);
+  await store.set(tiktokTokenValues(j, d.now()));
+  return j.access_token;
+}
+
+/**
+ * A usable access token: the stored one while valid, else renewed with the refresh token.
+ * @param {{ store: TokenStore } & Deps} p
+ * @returns {Promise<string>}
+ */
+export async function tiktokAccessToken({ store, ...deps }) {
+  const d = withDefaults(deps);
+  tiktokApp(store);
+  const refresh = store.get("TIKTOK_REFRESH_TOKEN");
+  if (!refresh) throw new Error("TikTok não conectado: rode node tools/publish.mjs auth tiktok");
+  const access = store.get("TIKTOK_ACCESS_TOKEN");
+  if (tiktokAccessValid({ access, expires: Date.parse(store.get("TIKTOK_ACCESS_EXPIRES")), now: d.now() }))
+    return access;
+  try {
+    return await fetchTiktokToken({
+      store,
+      body: { grant_type: "refresh_token", refresh_token: refresh },
+      label: "token do TikTok",
+      ...d,
+    });
+  } catch (e) {
+    if (/invalid_grant|expired|revoked|invalid_request/i.test(/** @type {Error} */ (e).message))
+      throw new Error("o login do TikTok venceu ou foi revogado: rode node tools/publish.mjs auth tiktok de novo");
+    throw e;
+  }
+}
+
+/**
+ * The consent URL for the desktop login. TikTok desktop PKCE: the challenge is the SHA-256 in hex.
+ * @param {{ clientKey: string, redirect: string, state: string, challenge: string }} p
+ */
+export const tiktokAuthUrl = ({ clientKey, redirect, state, challenge }) =>
+  `${TT_AUTH}?${new URLSearchParams({
+    client_key: clientKey,
+    scope: TT_SCOPES.join(","),
+    response_type: "code",
+    redirect_uri: redirect,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+  })}`;
+
+/**
+ * JSON POST to the API: the error comes in `error.code` even with HTTP 200.
+ * @param {string} token @param {string} path @param {any} body @param {string} label @param {Deps} [deps]
+ * @returns {Promise<{ data: any, text: string }>}
+ */
+export async function ttApi(token, path, body, label, deps = {}) {
+  const { j, text } = await request(
+    `${TT}${path}`,
+    {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json; charset=UTF-8" },
+      body: JSON.stringify(body),
+    },
+    label,
+    withDefaults(deps),
+  );
+  if (j?.error?.code && j.error.code !== "ok") {
+    /** @type {import("../http.mjs").PlatformError} */
+    const error = new Error(`${label}: ${j.error.message || j.error.code} (${j.error.code})`);
+    error.code = j.error.code;
+    throw error;
+  }
+  return { data: j?.data ?? {}, text };
+}
+
+/**
+ * The account card. `username` needs user.info.profile: without it, the display name stays.
+ * @param {string} token @param {Deps} [deps]
+ */
+export async function tiktokAccount(token, deps = {}) {
+  const d = withDefaults(deps);
+  /** @param {string} fields */
+  const read = async fields =>
+    (
+      await request(
+        `${TT}/user/info/?fields=${fields}`,
+        { headers: { authorization: `Bearer ${token}` } },
+        "conta do TikTok",
+        d,
+      )
+    ).j?.data?.user ?? {};
+  let u;
+  try {
+    u = await read("open_id,avatar_url,display_name,username");
+  } catch {
+    u = await read("open_id,avatar_url,display_name");
+  }
+  const username = u.username ? `@${u.username}` : null;
+  return {
+    account: username ?? u.display_name ?? "conta conectada",
+    username,
+    name: u.display_name ?? null,
+    avatar: u.avatar_url ?? null,
+  };
+}
+
+/**
+ * How the file is split: up to 64 MB in one chunk; above, 10 MB chunks and the last takes the rest.
+ * @param {number} size
+ */
+export function tiktokChunks(size) {
+  const chunk = size <= 64 * MB ? size : 10 * MB;
+  return { chunk, chunks: Math.floor(size / chunk) };
+}
+
+/**
+ * @typedef {object} TiktokSettings publish.tiktok in the config
+ * @property {"direct" | "draft"} mode
+ * @property {boolean} audited
+ * @property {boolean} comments
+ * @property {boolean} duet
+ * @property {boolean} stitch
+ * @property {boolean} ai_content
+ * @property {number | null} cover_at_s
+ */
+
+/**
+ * @typedef {{ publish_id: string, privacy: string | null, draft: boolean, username: string | null }} TiktokStarted
+ */
+
+/**
+ * Opens the upload and sends the file; TikTok processes it after. `tiktokUploadStatus` says when it is done
+ * (a cloud function asks once per run instead of waiting).
+ * @param {{ token: string, bytes: Uint8Array, caption: string, video: { duration: number },
+ *   requestedPrivacy: string, settings: TiktokSettings } & Deps} p
+ * @returns {Promise<TiktokStarted>}
+ */
+export async function startTiktokUpload({ token, bytes, caption, video, requestedPrivacy, settings, ...deps }) {
+  const d = withDefaults(deps);
+  let draft = settings.mode === "draft";
+  const size = bytes.byteLength;
+  const { chunk, chunks } = tiktokChunks(size);
+  const source_info = { source: "FILE_UPLOAD", video_size: size, chunk_size: chunk, total_chunk_count: chunks };
+
+  /** @type {string | null} */
+  let privacy = null;
+  let init;
+  if (!draft) {
+    const { data: info } = await ttApi(token, "/post/publish/creator_info/query/", {}, "TikTok (conta)", d);
+    privacy = requestedPrivacy;
+    if (!settings.audited && privacy !== "SELF_ONLY") {
+      d.log('TikTok: o app ainda não passou pela auditoria, então o vídeo sobe como "só eu" (publish.tiktok.audited)');
+      privacy = "SELF_ONLY";
+    }
+    const options = info.privacy_level_options ?? [];
+    if (options.length && !options.includes(privacy))
+      throw new Error(`a conta do TikTok não aceita privacidade ${privacy} (aceita: ${options.join(", ")})`);
+    if (info.max_video_post_duration_sec && video.duration > info.max_video_post_duration_sec) {
+      throw new Error(
+        `a conta do TikTok aceita vídeo de até ${info.max_video_post_duration_sec} s; este tem ${video.duration.toFixed(1)} s`,
+      );
+    }
+    try {
+      init = (
+        await ttApi(
+          token,
+          "/post/publish/video/init/",
+          {
+            post_info: {
+              title: caption,
+              privacy_level: privacy,
+              disable_comment: !settings.comments || !!info.comment_disabled,
+              disable_duet: !settings.duet || !!info.duet_disabled,
+              disable_stitch: !settings.stitch || !!info.stitch_disabled,
+              is_aigc: !!settings.ai_content,
+              ...(settings.cover_at_s != null
+                ? { video_cover_timestamp_ms: Math.round(settings.cover_at_s * 1000) }
+                : {}),
+            },
+            source_info,
+          },
+          "TikTok (abrir envio)",
+          d,
+        )
+      ).data;
+    } catch (e) {
+      /* an unaudited app only posts directly to private accounts: a public account gets a draft */
+      if (/** @type {any} */ (e).code !== "unaudited_client_can_only_post_to_private_accounts") throw e;
+      d.log(
+        "TikTok: app sem auditoria só publica direto em conta privada, e esta é pública. Vai como rascunho para a caixa de entrada do app: termine a postagem lá.",
+      );
+      draft = true;
+      privacy = null;
+    }
+  }
+  if (draft) {
+    init = (await ttApi(token, "/post/publish/inbox/video/init/", { source_info }, "TikTok (abrir envio)", d)).data;
+  }
+  if (!init.publish_id || !init.upload_url)
+    throw new Error("TikTok (abrir envio): sem publish_id ou upload_url na resposta");
+
+  d.log(`TikTok: enviando ${(size / 1e6).toFixed(1)} MB${chunks > 1 ? ` em ${chunks} partes` : ""}…`);
+  for (let i = 0; i < chunks; i++) {
+    const start = i * chunk;
+    const end = i === chunks - 1 ? size - 1 : start + chunk - 1;
+    await request(
+      init.upload_url,
+      {
+        method: "PUT",
+        headers: { "content-type": "video/mp4", "content-range": `bytes ${start}-${end}/${size}` },
+        body: /** @type {any} */ (bytes.subarray(start, end + 1)),
+      },
+      `TikTok (enviar${chunks > 1 ? ` parte ${i + 1}/${chunks}` : ""})`,
+      d,
+    );
+  }
+
+  d.log("TikTok: processando o vídeo…");
+  let username = null;
+  try {
+    username = (await tiktokAccount(token, d)).username;
+  } catch {
+    /* no @, no link */
+  }
+  return { publish_id: init.publish_id, privacy, draft, username };
+}
+
+/**
+ * One look at the processing: the result when done, null while TikTok is still on it; throws when refused.
+ * @param {{ token: string, started: TiktokStarted } & Deps} p
+ */
+export async function tiktokUploadStatus({ token, started, ...deps }) {
+  const d = withDefaults(deps);
+  const { data: s, text } = await ttApi(
+    token,
+    "/post/publish/status/fetch/",
+    { publish_id: started.publish_id },
+    "TikTok (status)",
+    d,
+  );
+  if (s.status === "FAILED") throw new Error(`o TikTok recusou o vídeo: ${s.fail_reason ?? "sem motivo"}`);
+  if (s.status === "SEND_TO_USER_INBOX") return { id: started.publish_id, url: null, draft: true };
+  if (s.status === "PUBLISH_COMPLETE") {
+    /* the post id is int64: read from the text, JSON.parse would lose the last digits */
+    const post = /"publicaly_available_post_id"\s*:\s*\[\s*"?(\d+)/.exec(text)?.[1] ?? null;
+    return {
+      id: post ?? started.publish_id,
+      publish_id: started.publish_id,
+      url: post && started.username ? `https://www.tiktok.com/${started.username}/video/${post}` : null,
+      privacy: started.privacy,
+    };
+  }
+  return null;
+}
+
+/**
+ * Uploads and waits for TikTok to process (the CLI: up to 10 min, a look every 5 s).
+ * @param {{ token: string, bytes: Uint8Array, caption: string, video: { duration: number },
+ *   requestedPrivacy: string, settings: TiktokSettings } & Deps} p
+ */
+export async function uploadTiktok(p) {
+  const d = withDefaults(p);
+  const started = await startTiktokUpload(p);
+  const deadline = d.now() + 10 * 60_000;
+  for (;;) {
+    const r = await tiktokUploadStatus({ token: p.token, started, ...d });
+    if (r) return r;
+    if (d.now() > deadline)
+      throw new Error(`10 min e o TikTok não terminou de processar (publish_id ${started.publish_id})`);
+    await d.sleep(5000);
+  }
+}

package/tools/lib/platforms/youtube.mjs

@@ -0,0 +1,228 @@
+/* ============================================================================
+   YouTube (Data API v3): OAuth token from the stored refresh token, the
+   channel, the resumable upload and the custom thumbnail. Pure: the file comes
+   in as bytes, the credentials from an injected TokenStore.
+   ============================================================================ */
+
+import { request, withDefaults } from "../http.mjs";
+
+/** @typedef {import("../http.mjs").Deps} Deps */
+/** @typedef {import("../http.mjs").TokenStore} TokenStore */
+
+export const GOOGLE_AUTH = "https://accounts.google.com/o/oauth2/v2/auth";
+export const GOOGLE_TOKEN = "https://oauth2.googleapis.com/token";
+/* readonly only to show the channel's name and picture in status */
+export const SCOPES = [
+  "https://www.googleapis.com/auth/youtube.upload",
+  "https://www.googleapis.com/auth/youtube.readonly",
+];
+
+/**
+ * The OAuth client from the store.
+ * @param {TokenStore} store
+ */
+export function googleClient(store) {
+  const id = store.get("YOUTUBE_CLIENT_ID"),
+    secret = store.get("YOUTUBE_CLIENT_SECRET");
+  if (!id || !secret)
+    throw new Error("faltam YOUTUBE_CLIENT_ID e YOUTUBE_CLIENT_SECRET no .env (reference/publish.md, YouTube passo 1)");
+  return { id, secret };
+}
+
+/**
+ * A fresh access token from the stored refresh token (Google's last ~1 h, so it is always fetched).
+ * @param {{ store: TokenStore } & Deps} p
+ * @returns {Promise<string>}
+ */
+export async function youtubeAccessToken({ store, ...deps }) {
+  const { id, secret } = googleClient(store);
+  const refresh = store.get("YOUTUBE_REFRESH_TOKEN");
+  if (!refresh) throw new Error("YouTube não conectado: rode node tools/publish.mjs auth youtube");
+  try {
+    const { j } = await request(
+      GOOGLE_TOKEN,
+      {
+        method: "POST",
+        body: new URLSearchParams({
+          client_id: id,
+          client_secret: secret,
+          refresh_token: refresh,
+          grant_type: "refresh_token",
+        }),
+      },
+      "token do YouTube",
+      withDefaults(deps),
+    );
+    return j.access_token;
+  } catch (e) {
+    if (/invalid_grant|expired|revoked/i.test(/** @type {Error} */ (e).message))
+      throw new Error("o login do YouTube venceu ou foi revogado: rode node tools/publish.mjs auth youtube de novo");
+    throw e;
+  }
+}
+
+/**
+ * The consent URL for the desktop login (PKCE S256).
+ * @param {{ clientId: string, redirect: string, state: string, challenge: string }} p
+ */
+export const youtubeAuthUrl = ({ clientId, redirect, state, challenge }) =>
+  `${GOOGLE_AUTH}?${new URLSearchParams({
+    client_id: clientId,
+    redirect_uri: redirect,
+    response_type: "code",
+    scope: SCOPES.join(" "),
+    access_type: "offline",
+    prompt: "consent",
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+  })}`;
+
+/**
+ * Exchanges the login code for tokens.
+ * @param {{ clientId: string, secret: string, code: string, redirect: string, verifier: string } & Deps} p
+ * @returns {Promise<{ access_token: string, refresh_token?: string }>}
+ */
+export async function exchangeGoogleCode({ clientId, secret, code, redirect, verifier, ...deps }) {
+  const { j } = await request(
+    GOOGLE_TOKEN,
+    {
+      method: "POST",
+      body: new URLSearchParams({
+        code,
+        client_id: clientId,
+        client_secret: secret,
+        redirect_uri: redirect,
+        grant_type: "authorization_code",
+        code_verifier: verifier,
+      }),
+    },
+    "token do Google",
+    withDefaults(deps),
+  );
+  return j;
+}
+
+/**
+ * The channel: `account` is the text line; the rest is the studio card.
+ * @param {string} token
+ * @param {Deps} [deps]
+ * @returns {Promise<{ account: string, username: string | null, name: string, avatar: string | null }>}
+ */
+export async function youtubeChannel(token, deps = {}) {
+  const { j } = await request(
+    "https://www.googleapis.com/youtube/v3/channels?part=snippet&mine=true",
+    { headers: { authorization: `Bearer ${token}` } },
+    "canal do YouTube",
+    withDefaults(deps),
+  );
+  const c = j.items?.[0];
+  if (!c) throw new Error("esta conta do Google não tem canal no YouTube");
+  const s = c.snippet;
+  const t = s.thumbnails ?? {};
+  return {
+    account: s.customUrl ? `${s.title} (${s.customUrl})` : s.title,
+    username: s.customUrl ?? null,
+    name: s.title,
+    avatar: (t.default ?? t.medium ?? t.high)?.url ?? null,
+  };
+}
+
+/**
+ * Up to 3 min in 9:16 YouTube treats it as a Short.
+ * @param {{ w: number, h: number, duration: number }} video
+ */
+export const isShort = video => video.h > video.w && video.duration <= 180;
+
+/**
+ * thumbnails.set: the channel needs advanced features (phone verification). Never throws.
+ * @param {{ token: string, videoId: string, jpeg: Uint8Array, version: string } & Deps} p
+ * @returns {Promise<{ version: string, applied: boolean, error?: string }>}
+ */
+export async function setYoutubeThumbnail({ token, videoId, jpeg, version, ...deps }) {
+  try {
+    await request(
+      `https://www.googleapis.com/upload/youtube/v3/thumbnails/set?videoId=${videoId}`,
+      {
+        method: "POST",
+        headers: { authorization: `Bearer ${token}`, "content-type": "image/jpeg" },
+        body: /** @type {any} */ (jpeg),
+      },
+      "YouTube (capa)",
+      withDefaults(deps),
+    );
+    return { version, applied: true };
+  } catch (e) {
+    const msg = /** @type {Error} */ (e).message;
+    const reason = /403|forbidden/i.test(msg)
+      ? `${msg} (o canal precisa dos recursos avançados para capa própria: youtube.com/verify)`
+      : msg;
+    return { version, applied: false, error: reason };
+  }
+}
+
+/**
+ * @typedef {object} YoutubeSettings publish.youtube in the config
+ * @property {string | number} category
+ * @property {string} language
+ * @property {boolean} made_for_kids
+ * @property {boolean} synthetic_content
+ */
+
+/**
+ * The resumable upload: the first call opens the session, the second sends the file.
+ * @param {{ token: string, bytes: Uint8Array, meta: { title: string, description: string, tags: string[] },
+ *   privacy: string, video: { w: number, h: number, duration: number }, settings: YoutubeSettings,
+ *   cover?: { version: string, jpeg: Uint8Array } | null } & Deps} p
+ */
+export async function uploadYoutube({ token, bytes, meta, privacy, video, settings, cover, ...deps }) {
+  const d = withDefaults(deps);
+  const body = {
+    snippet: {
+      title: meta.title,
+      description: meta.description,
+      categoryId: String(settings.category),
+      defaultLanguage: settings.language,
+      defaultAudioLanguage: settings.language,
+      ...(meta.tags.length ? { tags: meta.tags } : {}),
+    },
+    status: {
+      privacyStatus: privacy,
+      selfDeclaredMadeForKids: !!settings.made_for_kids,
+      ...(settings.synthetic_content ? { containsSyntheticMedia: true } : {}),
+    },
+  };
+  const { r } = await request(
+    "https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&part=snippet,status",
+    {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json; charset=UTF-8",
+        "x-upload-content-type": "video/mp4",
+        "x-upload-content-length": String(bytes.byteLength),
+      },
+      body: JSON.stringify(body),
+    },
+    "YouTube (abrir upload)",
+    d,
+  );
+  const session = r.headers.get("location");
+  if (!session) throw new Error("YouTube (abrir upload): sem Location na resposta");
+  d.log(`YouTube: enviando ${(bytes.byteLength / 1e6).toFixed(1)} MB…`);
+  const { j } = await request(
+    session,
+    { method: "PUT", headers: { "content-type": "video/mp4" }, body: /** @type {any} */ (bytes) },
+    "YouTube (enviar)",
+    d,
+  );
+  return {
+    id: j.id,
+    url: isShort(video) ? `https://youtube.com/shorts/${j.id}` : `https://youtu.be/${j.id}`,
+    studio: `https://studio.youtube.com/video/${j.id}/edit`,
+    privacy: j.status?.privacyStatus ?? privacy,
+    ...(cover
+      ? { cover: await setYoutubeThumbnail({ token, videoId: j.id, jpeg: cover.jpeg, version: cover.version, ...d }) }
+      : {}),
+  };
+}