@opencoredev/social-sdk 0.3.0 → 0.4.0

package/dist/platforms/x.js

@@ -1,19 +1,28 @@
-/* oxlint-disable anti-slop/no-conditional-empty-object-spread, anti-slop/no-runtime-typeof, anti-slop/require-readable-spacing, anti-slop/require-safety-comment-for-type-assertion -- validated external boundary or fixture contract. */
 import { remainingBudget } from "../transport/budget.js";
+import { definedFields } from "../core/fields.js";
 import { isValidXText } from "./x-text.js";
 import { defineAdapter } from "../core/adapter.js";
 import { connectedAccountRef, profileRef } from "../core/types.js";
 import { SocialError } from "../core/errors.js";
-import { managedHttp, publicFields } from "../cloud/common.js";
+import { managedHttp, optionsObject, publicFields } from "../cloud/common.js";
+import { verifyXWebhook } from "../server/webhooks.js";
+import { directWebhooks, webhookCapability } from "./webhook-adapter.js";
 import { createHttp, HttpError } from "../transport/http.js";
-import { array, object as parseObject, optionalNumber, optionalString, string, } from "../transport/validation.js";
-// oxlint-disable-next-line anti-slop/no-unknown-parameters, anti-slop/require-safety-comment-for-type-assertion -- transport parser validates the provider boundary.
-const object = (value) => parseObject(value);
-// 53-bit conversation ID hashes, 11 base36 characters each. listConversations returns at
-// most 1,200 distinct conversations, which keeps its cursor well under the client's 16,384
-// character cursor limit.
+import { isJsonValue } from "../transport/json.js";
+import { parseRulesUpdate, parseStreamRule, readFilteredStream, validateRuleIds, validateRuleInput, } from "./x-stream.js";
+import { array, isString, object, optionalBoolean, optionalNumber, optionalString, string, } from "../transport/validation.js";
 const conversationHashWidth = 11;
 const maxConversationHashes = 1200;
+const replyFields = [
+    "id",
+    "text",
+    "author_id",
+    "created_at",
+    "conversation_id",
+    "in_reply_to_user_id",
+    "referenced_tweets",
+    "public_metrics",
+];
 function conversationHash(id) {
     let h1 = 0xdeadbeef;
     let h2 = 0x41c6ce57;
@@ -28,11 +37,11 @@ function conversationHash(id) {
     return value.toString(36).padStart(conversationHashWidth, "0");
 }
 export { xLike, xUnlike } from "./x-engagement.js";
+export { xStreamDefaultStallTimeoutMs, } from "./x-stream.js";
 export function x(options) {
     const request = managedHttp("https://api.x.com", {
         apiKey: options.auth.accessToken ?? "app-auth-placeholder",
-        // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-        ...(options.fetch ? { fetch: options.fetch } : {}),
+        ...definedFields({ fetch: options.fetch }),
     });
     const appRequest = () => {
         if (!options.appBearerToken?.trim())
@@ -43,8 +52,7 @@ export function x(options) {
             });
         return managedHttp("https://api.x.com", {
             apiKey: options.appBearerToken,
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated external boundary or fixture contract.
-            ...(options.fetch ? { fetch: options.fetch } : {}),
+            ...definedFields({ fetch: options.fetch }),
         });
     };
     const requireUserToken = (operation) => {
@@ -61,7 +69,7 @@ export function x(options) {
         : options.auth.accessToken?.trim()
             ? request
             : appRequest();
-    const http = createHttp(options.fetch ? { fetch: options.fetch } : {});
+    const http = createHttp(definedFields({ fetch: options.fetch }));
     const now = () => (options.clock?.() ?? new Date()).toISOString();
     const authorize = (ref, context) => {
         if (ref.backend !== context.backendInstance ||
@@ -90,15 +98,7 @@ export function x(options) {
                 accountId: options.auth.userId,
             },
             displayName: string(user["name"]),
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            // oxlint-disable-next-line anti-slop/no-runtime-typeof -- validated boundary or fixture contract.
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- provider payload is validated at this adapter boundary.
-            // oxlint-disable-next-line anti-slop/no-runtime-typeof -- validated external boundary or fixture contract.
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated external boundary or fixture contract.
-            // oxlint-disable-next-line anti-slop/no-runtime-typeof -- validated external boundary or fixture contract.
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated external boundary or fixture contract.
-            // oxlint-disable-next-line anti-slop/no-runtime-typeof -- validated external boundary or fixture contract.
-            ...(typeof user["username"] === "string" ? { handle: user["username"] } : {}),
+            ...definedFields({ handle: optionalString(user["username"]) }),
             status: "connected",
         };
     }
@@ -113,7 +113,6 @@ export function x(options) {
                 operation: "posts.read",
                 message: "X post identity or author does not match the declared reference.",
             });
-        // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- validated boundary or fixture contract.
         return result;
     }
     async function listPosts(account, input, context) {
@@ -127,10 +126,10 @@ export function x(options) {
             });
         const result = object(await request(`/2/users/${encodeURIComponent(account.accountId)}/tweets`, context, undefined, {
             "tweet.fields": "id,text,author_id,created_at,conversation_id",
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(input.cursor === undefined ? {} : { pagination_token: input.cursor }),
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(input.limit === undefined ? {} : { max_results: String(input.limit) }),
+            ...definedFields({
+                pagination_token: input.cursor,
+                max_results: input.limit?.toString(),
+            }),
         }));
         const items = (result["data"] === undefined ? [] : array(result["data"])).map((entry) => {
             const row = object(entry);
@@ -147,8 +146,7 @@ export function x(options) {
         const nextCursor = optionalString(meta["next_token"]);
         return {
             items,
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(nextCursor === undefined ? {} : { nextCursor }),
+            ...definedFields({ nextCursor }),
         };
     }
     async function searchPosts(account, input, context, nativeInput) {
@@ -207,28 +205,16 @@ export function x(options) {
             ]
                 .filter((field, index, fields) => fields.indexOf(field) === index)
                 .join(","),
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(input.cursor === undefined ? {} : { next_token: input.cursor }),
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(input.limit === undefined ? {} : { max_results: String(input.limit) }),
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(input.startTime === undefined ? {} : { start_time: input.startTime }),
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(input.endTime === undefined ? {} : { end_time: input.endTime }),
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(nativeInput?.sortOrder === undefined ? {} : { sort_order: nativeInput.sortOrder }),
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(nativeInput?.expansions === undefined
-                ? {}
-                : { expansions: nativeInput.expansions.join(",") }),
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(nativeInput?.userFields === undefined
-                ? {}
-                : { "user.fields": nativeInput.userFields.join(",") }),
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(nativeInput?.mediaFields === undefined
-                ? {}
-                : { "media.fields": nativeInput.mediaFields.join(",") }),
+            ...definedFields({
+                next_token: input.cursor,
+                max_results: input.limit?.toString(),
+                start_time: input.startTime,
+                end_time: input.endTime,
+                sort_order: nativeInput?.sortOrder,
+                expansions: nativeInput?.expansions?.join(","),
+                "user.fields": nativeInput?.userFields?.join(","),
+                "media.fields": nativeInput?.mediaFields?.join(","),
+            }),
         }));
         const requestedFields = nativeInput?.tweetFields ?? [
             "id",
@@ -244,23 +230,97 @@ export function x(options) {
         ];
         const items = (result["data"] === undefined ? [] : array(result["data"])).map((entry) => {
             const row = object(entry);
-            return Object.fromEntries(["id", "text", ...requestedFields].flatMap((field, index, fields) => fields.indexOf(field) === index && field in row ? [[field, row[field]]] : []));
+            const picked = {};
+            // A Set keeps first-seen order, so "id" and "text" lead and repeated fields appear once.
+            for (const field of new Set(["id", "text", ...requestedFields])) {
+                const value = row[field];
+                if (value !== undefined)
+                    picked[field] = value;
+            }
+            return picked;
         });
         const meta = result["meta"] === undefined ? {} : object(result["meta"]);
         const nextCursor = optionalString(meta["next_token"]);
         const includes = result["includes"];
         return {
             items,
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-            ...(nextCursor === undefined ? {} : { nextCursor }),
-            ...(includes === undefined
-                ? {}
-                : {
-                    // SAFETY: X's `includes` member is a JSON object validated by the transport boundary.
-                    metadata: { includes: object(includes) },
-                }),
+            ...definedFields({
+                nextCursor,
+                metadata: includes === undefined ? undefined : { includes: object(includes) },
+            }),
         };
     }
+    // Replies come from recent search with the standalone `conversation_id:` operator, which is
+    // the method X documents for reading a conversation. Sources, accessed 2026-09-24:
+    // https://docs.x.com/x-api/fundamentals/conversation-id
+    // https://docs.x.com/x-api/posts/search/integrate/operators
+    // https://docs.x.com/x-api/posts/search-recent-posts (max_results 10-100, next_token)
+    // https://docs.x.com/x-api/posts/search/introduction (recent search covers the last 7 days)
+    // https://docs.x.com/x-api/fundamentals/rate-limits (450/15min per app, 300/15min per user)
+    async function listReplies(post, input, context) {
+        authorize(post, context);
+        if (!/^[0-9]{1,19}$/.test(post.postId))
+            throw new SocialError({
+                code: "invalid_input",
+                operation: "comments.read",
+                message: "X post IDs must be numeric.",
+            });
+        if (input.limit !== undefined &&
+            (!Number.isSafeInteger(input.limit) || input.limit < 10 || input.limit > 100))
+            throw new SocialError({
+                code: "invalid_input",
+                operation: "comments.read",
+                message: "X reply limits must be integers from 10 through 100.",
+            });
+        const query = {
+            query: `conversation_id:${post.postId}`,
+            "tweet.fields": replyFields.join(","),
+        };
+        if (input.cursor !== undefined) {
+            query["next_token"] = input.cursor;
+        }
+        if (input.limit !== undefined) {
+            query["max_results"] = String(input.limit);
+        }
+        const result = object(await (options.auth.accessToken?.trim() ? request : appRequest())("/2/tweets/search/recent", context, undefined, query));
+        const items = (result["data"] === undefined ? [] : array(result["data"])).flatMap((entry) => {
+            const row = object(entry);
+            const id = string(row["id"]);
+            if (row["conversation_id"] !== post.postId)
+                throw new SocialError({
+                    code: "unauthorized",
+                    operation: "comments.read",
+                    message: "X returned a post from a different conversation.",
+                });
+            // The conversation root shares its own conversation_id; it is not a reply.
+            if (id === post.postId)
+                return [];
+            const references = row["referenced_tweets"] === undefined
+                ? undefined
+                : array(row["referenced_tweets"]).map((reference) => {
+                    const item = object(reference);
+                    return { type: string(item["type"]), id: string(item["id"]) };
+                });
+            const counts = row["public_metrics"] === undefined ? undefined : object(row["public_metrics"]);
+            const metrics = counts === undefined
+                ? undefined
+                : Object.fromEntries(Object.keys(counts).flatMap((name) => {
+                    const value = optionalNumber(counts[name]);
+                    return value === undefined ? [] : [[name, value]];
+                }));
+            const itemFields = definedFields({
+                ...publicFields(row, replyFields),
+                referenced_tweets: references,
+                public_metrics: metrics,
+            });
+            return [itemFields];
+        });
+        const meta = result["meta"] === undefined ? {} : object(result["meta"]);
+        const nextCursor = optionalString(meta["next_token"]);
+        if (nextCursor === undefined)
+            return { items };
+        return { items, nextCursor };
+    }
     async function pageRequest(path, account, input, context, query = {}, fields = "id,name,username,description,created_at,public_metrics", resource = "users") {
         authorize(account, context);
         const isTweets = resource === "tweets";
@@ -285,13 +345,12 @@ export function x(options) {
                     : fields
                         ? { "user.fields": fields }
                         : {}),
-            ...(input.cursor === undefined ? {} : { pagination_token: input.cursor }),
-            ...(input.limit === undefined ? {} : { max_results: String(input.limit) }),
+            ...definedFields({ pagination_token: input.cursor, max_results: input.limit?.toString() }),
         }));
-        const items = (result["data"] === undefined ? [] : array(result["data"])).map((entry) => object(entry));
+        const items = (result["data"] === undefined ? [] : array(result["data"])).map(object);
         const meta = result["meta"] === undefined ? {} : object(result["meta"]);
         const nextCursor = optionalString(meta["next_token"]);
-        return { items, ...(nextCursor === undefined ? {} : { nextCursor }) };
+        return { items, ...definedFields({ nextCursor }) };
     }
     async function getAccountMetrics(account, context) {
         authorize(account, context);
@@ -341,8 +400,7 @@ export function x(options) {
                 "tweet.fields": "conversation_id",
             }))["data"]);
             if (root["id"] !== ref.postId ||
-                // oxlint-disable-next-line anti-slop/no-runtime-typeof -- validated boundary or fixture contract.
-                (typeof parent["conversation_id"] === "string" &&
+                (isString(parent["conversation_id"]) &&
                     parent["conversation_id"] !== root["conversation_id"]))
                 throw new SocialError({
                     code: "unauthorized",
@@ -372,8 +430,7 @@ export function x(options) {
                 headers: { Authorization: `Bearer ${options.auth.accessToken}` },
                 body,
                 timeoutMs: remainingBudget(context),
-                // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-                ...(context.signal ? { signal: context.signal } : {}),
+                ...definedFields({ signal: context.signal }),
             });
         }
         catch (error) {
@@ -484,11 +541,11 @@ export function x(options) {
                         Authorization: `Bearer ${options.auth.accessToken}`,
                         "Content-Type": "application/json",
                     },
-                // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- FINALIZE carries no body.
-                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
                 timeoutMs: remainingBudget(context),
-                // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-                ...(context.signal ? { signal: context.signal } : {}),
+                ...definedFields({
+                    body: body === undefined ? undefined : JSON.stringify(body),
+                    signal: context.signal,
+                }),
             });
         }
         catch (error) {
@@ -510,8 +567,7 @@ export function x(options) {
                 headers: { Authorization: `Bearer ${options.auth.accessToken}` },
                 body,
                 timeoutMs: remainingBudget(context),
-                // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-                ...(context.signal ? { signal: context.signal } : {}),
+                ...definedFields({ signal: context.signal }),
             });
         }
         catch (error) {
@@ -529,8 +585,7 @@ export function x(options) {
                 method: "GET",
                 headers: { Authorization: `Bearer ${options.auth.accessToken}` },
                 timeoutMs: remainingBudget(context),
-                // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-                ...(context.signal ? { signal: context.signal } : {}),
+                ...definedFields({ signal: context.signal }),
             });
         }
         catch (error) {
@@ -692,6 +747,7 @@ export function x(options) {
             apiRevision: "X API v2 / OpenAPI 2.168",
             runtime: ["node22", "node24", "bun"],
             capabilities: [
+                webhookCapability("x", "Verifies X-Twitter-Webhooks-Signature-OAuth2 or the legacy X-Twitter-Webhooks-Signature and decodes Account Activity deliveries. Answer the CRC GET with answerXWebhookChallenge."),
                 {
                     platform: "x",
                     operation: "posts.publish",
@@ -744,6 +800,14 @@ export function x(options) {
                     availability: "available",
                     requiredScopes: ["tweet.read", "tweet.write", "users.read"],
                 },
+                {
+                    platform: "x",
+                    operation: "posts.update",
+                    availability: "available",
+                    formats: ["text"],
+                    requiredScopes: ["tweet.read", "tweet.write", "users.read"],
+                    notes: "Text-only edit through native.updatePost. X requires X Premium, the account's own post, and a recent post within X's edit window and edit count. Polls, replies to others, reposts, and scheduled posts are not editable. Each edit creates a new post ID.",
+                },
                 {
                     platform: "x",
                     operation: "graph.read",
@@ -821,6 +885,13 @@ export function x(options) {
                     availability: "available",
                     requiredScopes: ["dm.write"],
                 },
+                {
+                    platform: "x",
+                    operation: "comments.read",
+                    availability: "available",
+                    requiredScopes: ["tweet.read", "users.read"],
+                    notes: "Replies come from recent search with conversation_id, so only replies from the last 7 days are returned. Pass the conversation's root post. Page limits are 10-100. Recent search allows 450 requests per 15 minutes per app and 300 per user, and X bills post reads under the app's plan.",
+                },
                 {
                     platform: "x",
                     operation: "search.posts",
@@ -850,6 +921,12 @@ export function x(options) {
                     requiredScopes: ["dm.read", "users.read", "tweet.read"],
                     notes: "Requires a user-context token and an X API tier that includes Direct Messages.",
                 },
+                {
+                    platform: "x",
+                    operation: "notifications.read",
+                    availability: "unsupported-by-platform",
+                    notes: "X API v2 has no notifications list endpoint. Use mentions.read, or the Account Activity or X Activity API webhooks and streams.",
+                },
                 {
                     platform: "x",
                     operation: "messages.write",
@@ -857,11 +934,30 @@ export function x(options) {
                     requiredScopes: ["dm.write", "dm.read", "users.read", "tweet.read"],
                     notes: "Requires a user-context token and an X API tier that includes Direct Messages.",
                 },
+                {
+                    platform: "x",
+                    operation: "comments.moderate",
+                    availability: "available",
+                    requiredScopes: ["tweet.moderate.write", "tweet.read", "users.read"],
+                    notes: "Native hideReply hides or unhides replies in conversations the authenticated user started. Requires a user-context token.",
+                },
                 {
                     platform: "x",
                     operation: "streams.read",
+                    availability: "available",
+                    notes: "Filtered stream via native stream, listStreamRules, addStreamRules, and deleteStreamRules with the app-only appBearerToken. Needs X API pay-per-use (1 connection, 1,000 rules of up to 1,024 characters) or Enterprise (multiple connections, 25,000+ rules of up to 2,048 characters). backfillMinutes and startTime/endTime recovery need Enterprise. One caller-controlled connection per iteration; no automatic reconnect.",
+                },
+                {
+                    platform: "x",
+                    operation: "posts.schedule",
                     availability: "not-implemented-by-adapter",
-                    notes: "Filtered stream rules and streaming transport are not implemented by this adapter.",
+                    notes: "X API v2 has no scheduled-post field; POST /2/tweets publishes immediately. X Ads API scheduled Tweets (ads-api.x.com/12/accounts/:account_id/scheduled_tweets) need Ads API approval, an ads account, and OAuth 1.0a-signed requests, which this OAuth 2.0 adapter does not implement (https://docs.x.com/x-ads-api/fundamentals/making-authenticated-requests, checked 2026-09-24). Scheduled Tweets default to nullcast=true (promoted-only, not on the public timeline); organic nullcast=false Tweets can only be created by the ads account's full promotable user (https://docs.x.com/x-ads-api/creatives, checked 2026-09-24). Use an application-owned job runner to publish at a chosen time.",
+                },
+                {
+                    platform: "x",
+                    operation: "profile.update",
+                    availability: "unsupported-by-platform",
+                    notes: "X API v2 (OpenAPI 2.168, https://docs.x.com/openapi.json, checked 2026-09-24) has no endpoint that writes the user's profile. The v1.1 POST account/update_profile reference is no longer published on docs.x.com (its developer.x.com URL redirects to https://docs.x.com/overview), and v1.1 user writes require OAuth 1.0a.",
                 },
             ],
         },
@@ -890,16 +986,17 @@ export function x(options) {
                         accountId: account.accountId,
                         profileId: id,
                     }),
-                    ...(typeof user["name"] === "string" ? { displayName: user["name"] } : {}),
-                    ...(typeof user["username"] === "string" ? { handle: user["username"] } : {}),
-                    ...(typeof user["description"] === "string" ? { bio: user["description"] } : {}),
+                    ...definedFields({
+                        displayName: optionalString(user["name"]),
+                        handle: optionalString(user["username"]),
+                        bio: optionalString(user["description"]),
+                    }),
                     native: user,
                 };
             },
             async listRelationships(account, input, context) {
                 const pagination = {
-                    ...(input.cursor === undefined ? {} : { cursor: input.cursor }),
-                    ...(input.limit === undefined ? {} : { limit: input.limit }),
+                    ...definedFields({ cursor: input.cursor, limit: input.limit }),
                 };
                 const result = input.kind === "following"
                     ? await nativeAdapter.following({
@@ -944,7 +1041,7 @@ export function x(options) {
                                     : input.kind,
                         };
                     }),
-                    ...(result.nextCursor === undefined ? {} : { nextCursor: result.nextCursor }),
+                    ...definedFields({ nextCursor: result.nextCursor }),
                 };
             },
             async follow(target, context) {
@@ -1013,14 +1110,14 @@ export function x(options) {
                 if (text && !isValidXText(text))
                     fail("x.text", "Text exceeds X's weighted 280-character limit or contains invalid characters.");
                 if (target.schedule || target.content.link)
-                    fail("x.operation", "Scheduling needs an application runner; place URLs explicitly in text.");
+                    fail("x.operation", "X API v2 cannot schedule posts; use an application job runner. Place URLs explicitly in text.");
                 if (target.replyTo &&
                     (target.replyTo.platform !== "x" ||
                         target.replyTo.backend !== target.account.backend ||
                         target.replyTo.accountId !== target.account.accountId ||
                         target.replyTo.kind !== "platform-post"))
                     fail("x.reply", "Use a platform-post reply reference authorized for this account and backend.");
-                const settings = target.options === undefined ? {} : object(target.options);
+                const settings = optionsObject(target);
                 if (Object.keys(settings).some((key) => key !== "replySettings") ||
                     (settings["replySettings"] !== undefined &&
                         !["everyone", "following", "mentionedUsers"].includes(String(settings["replySettings"]))))
@@ -1063,18 +1160,15 @@ export function x(options) {
                 const ids = [];
                 for (const media of target.content.media ?? [])
                     ids.push(await uploadXMedia(media, context));
-                const settings = target.options === undefined ? {} : object(target.options);
+                const replySettings = optionsObject(target)["replySettings"];
                 const hasVideo = (target.content.media ?? []).some((media) => chunkedCategory(media) === "tweet_video");
                 try {
                     return await createPost(target.account, target.content.text ?? "", context, {
-                        // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-                        ...(ids.length ? { media: { media_ids: ids } } : {}),
-                        // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-                        ...(target.replyTo ? { reply: { in_reply_to_tweet_id: target.replyTo.postId } } : {}),
-                        // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- validated boundary or fixture contract.
-                        ...(settings["replySettings"] && settings["replySettings"] !== "everyone"
-                            ? { reply_settings: string(settings["replySettings"]) }
-                            : {}),
+                        ...definedFields({
+                            media: ids.length ? { media_ids: ids } : undefined,
+                            reply: target.replyTo ? { in_reply_to_tweet_id: target.replyTo.postId } : undefined,
+                            reply_settings: replySettings && replySettings !== "everyone" ? string(replySettings) : undefined,
+                        }),
                     }, target.targetIndex);
                 }
                 catch (error) {
@@ -1116,12 +1210,8 @@ export function x(options) {
             },
         },
         comments: {
-            async list() {
-                throw new SocialError({
-                    code: "unsupported_capability",
-                    operation: "comments.read",
-                    message: "X reply search is not implemented in this slice.",
-                });
+            async list(ref, input, context) {
+                return listReplies(ref, input, context);
             },
             async reply(ref, content, context) {
                 await validateReplyParent(ref, context);
@@ -1162,7 +1252,10 @@ export function x(options) {
                 const seen = [];
                 if (input.cursor !== undefined) {
                     try {
-                        const state = parseObject(JSON.parse(input.cursor));
+                        const parsed = JSON.parse(input.cursor);
+                        if (!isJsonValue(parsed))
+                            throw new Error("bad cursor");
+                        const state = object(parsed);
                         eventCursor = optionalString(state["c"]);
                         const hashes = string(state["s"]);
                         if (hashes.length % conversationHashWidth !== 0)
@@ -1188,8 +1281,7 @@ export function x(options) {
                 for (let fetches = 0; fetches < 10; fetches++) {
                     const page = await nativeAdapter.listDirectMessages({
                         account,
-                        ...(eventCursor === undefined ? {} : { cursor: eventCursor }),
-                        ...(input.limit === undefined ? {} : { limit: input.limit }),
+                        ...definedFields({ cursor: eventCursor, limit: input.limit }),
                         context,
                     });
                     for (const event of page.items) {
@@ -1225,8 +1317,7 @@ export function x(options) {
                         accountId: conversation.accountId,
                     }),
                     conversationId: conversation.conversationId,
-                    ...(input.cursor === undefined ? {} : { cursor: input.cursor }),
-                    ...(input.limit === undefined ? {} : { limit: input.limit }),
+                    ...definedFields({ cursor: input.cursor, limit: input.limit }),
                     context,
                 });
             },
@@ -1280,6 +1371,7 @@ export function x(options) {
                 });
             },
         },
+        webhooks: directWebhooks("x", (input) => verifyXWebhook({ ...input, secret: options.webhookSecret ?? "" }), now),
         native: (nativeAdapter = {
             async searchRecentPosts({ account, search, context }) {
                 return searchPosts(account, { ...search, scope: "recent" }, context, search);
@@ -1290,20 +1382,65 @@ export function x(options) {
             readPost,
             async repost({ account, postId, context }) {
                 authorize(account, context);
-                // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- validated boundary or fixture contract.
                 return object(await request(`/2/users/${encodeURIComponent(account.accountId)}/retweets`, context, {
                     tweet_id: postId,
                 }));
             },
             async quote({ account, text, quotedPostId, context }) {
                 authorize(account, context);
-                // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- validated boundary or fixture contract.
                 return object(await request("/2/tweets", context, { text, quote_tweet_id: quotedPostId }));
             },
             async deletePost({ account, postId, context }) {
                 authorize(account, context);
                 await request(`/2/tweets/${encodeURIComponent(postId)}`, context, undefined, {}, "DELETE");
             },
+            async updatePost({ account, postId, text, context }) {
+                authorize(account, context);
+                if (!/^[0-9]{1,19}$/.test(postId))
+                    throw new SocialError({
+                        code: "invalid_input",
+                        operation: "posts.update",
+                        message: "X post edits require a numeric post ID.",
+                    });
+                if (!text || !isValidXText(text))
+                    throw new SocialError({
+                        code: "invalid_input",
+                        operation: "posts.update",
+                        message: "Edited text is empty, exceeds X's weighted 280-character limit, or contains invalid characters.",
+                    });
+                const result = object(await request("/2/tweets", context, {
+                    text,
+                    edit_options: { previous_post_id: postId },
+                }));
+                const data = result["data"] === undefined ? {} : object(result["data"]);
+                const id = optionalString(data["id"]);
+                if (!id)
+                    throw new SocialError({
+                        code: "ambiguous_outcome",
+                        operation: "posts.update",
+                        backend: context.backendInstance,
+                        correlationId: context.correlationId,
+                        message: "X edit response lacks a new post ID. Reconcile before retrying.",
+                        retryDisposition: { kind: "reconcile-first" },
+                    });
+                const history = data["edit_history_post_ids"] ?? data["edit_history_tweet_ids"];
+                const editHistoryPostIds = Array.isArray(history)
+                    ? history.filter((entry) => typeof entry === "string")
+                    : undefined;
+                return {
+                    post: {
+                        kind: "platform-post",
+                        version: 1,
+                        backend: account.backend,
+                        platform: "x",
+                        accountId: account.accountId,
+                        postId: id,
+                    },
+                    previousPostId: postId,
+                    text: optionalString(data["text"]) ?? text,
+                    ...definedFields({ editHistoryPostIds }),
+                };
+            },
             async uploadVideo({ account, video, context }) {
                 authorize(account, context);
                 const media = {
@@ -1333,7 +1470,6 @@ export function x(options) {
                         operation: "x.polls.create",
                         message: "X polls require 2-4 options and a duration from 5 minutes to 7 days.",
                     });
-                // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- validated boundary or fixture contract.
                 return object(await request("/2/tweets", context, {
                     text,
                     poll: { options: [...pollOptions], duration_minutes: durationMinutes },
@@ -1341,7 +1477,6 @@ export function x(options) {
             },
             async bookmarks({ account, context }) {
                 authorize(account, context);
-                // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- validated boundary or fixture contract.
                 return object(await request(`/2/users/${encodeURIComponent(account.accountId)}/bookmarks`, context));
             },
             async bookmark({ account, postId, context }) {
@@ -1356,7 +1491,6 @@ export function x(options) {
             },
             async follow({ account, userId, context }) {
                 authorize(account, context);
-                // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- validated boundary or fixture contract.
                 return object(await request(`/2/users/${encodeURIComponent(account.accountId)}/following`, context, {
                     target_user_id: userId,
                 }));
@@ -1381,14 +1515,13 @@ export function x(options) {
                 const result = object(await request(path, context, undefined, {
                     "dm_event.fields": "id,text,event_type,created_at,dm_conversation_id,attachments,entities",
                     expansions: "sender_id,participant_ids",
-                    ...(cursor === undefined ? {} : { pagination_token: cursor }),
-                    ...(limit === undefined ? {} : { max_results: String(limit) }),
+                    ...definedFields({ pagination_token: cursor, max_results: limit?.toString() }),
                 }));
                 const meta = result["meta"] === undefined ? {} : object(result["meta"]);
                 const nextCursor = optionalString(meta["next_token"]);
                 return {
                     items: result["data"] === undefined ? [] : array(result["data"]).map(object),
-                    ...(nextCursor === undefined ? {} : { nextCursor }),
+                    ...definedFields({ nextCursor }),
                 };
             },
             async sendDirectMessage({ account, participantId, text, context }) {
@@ -1410,7 +1543,7 @@ export function x(options) {
                         operation: "messages.conversation.write",
                         message: "X direct messages require non-empty text.",
                     });
-                return object(await requireUserToken("messages.conversation.write")(`/2/dm_conversations/${encodeURIComponent(conversationId)}/messages`, context, { text, ...(attachments === undefined ? {} : { attachments }) }));
+                return object(await requireUserToken("messages.conversation.write")(`/2/dm_conversations/${encodeURIComponent(conversationId)}/messages`, context, { text, ...definedFields({ attachments }) }));
             },
             async createGroupConversation({ account, participantIds, message, context }) {
                 authorize(account, context);
@@ -1525,16 +1658,13 @@ export function x(options) {
                 authorize(account, context);
                 return object(await request("/2/lists", context, {
                     name,
-                    ...(description === undefined ? {} : { description }),
-                    ...(isPrivate === undefined ? {} : { private: isPrivate }),
+                    ...definedFields({ description, private: isPrivate }),
                 }));
             },
             async updateList({ account, listId, name, description, isPrivate, context }) {
                 authorize(account, context);
                 return object(await request(`/2/lists/${encodeURIComponent(listId)}`, context, {
-                    ...(name === undefined ? {} : { name }),
-                    ...(description === undefined ? {} : { description }),
-                    ...(isPrivate === undefined ? {} : { private: isPrivate }),
+                    ...definedFields({ name, description, private: isPrivate }),
                 }, {}, "PUT"));
             },
             async deleteList({ account, listId, context }) {
@@ -1600,6 +1730,85 @@ export function x(options) {
                 authorize(account, context);
                 await request(`/2/users/${encodeURIComponent(account.accountId)}/retweets/${encodeURIComponent(postId)}`, context, undefined, {}, "DELETE");
             },
+            async listStreamRules({ account, ids, cursor, limit, context }) {
+                authorize(account, context);
+                if (ids !== undefined)
+                    validateRuleIds(ids, "x.streamRules.list", 1000);
+                if (limit !== undefined && (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000))
+                    throw new SocialError({
+                        code: "invalid_input",
+                        operation: "x.streamRules.list",
+                        message: "X stream rule limits must be integers from 1 through 1000.",
+                    });
+                const result = object(await appRequest()("/2/tweets/search/stream/rules", context, undefined, {
+                    ...definedFields({
+                        ids: ids?.join(","),
+                        pagination_token: cursor,
+                        max_results: limit === undefined ? undefined : String(limit),
+                    }),
+                }));
+                const items = (result["data"] === undefined ? [] : array(result["data"])).map((entry) => parseStreamRule(object(entry), "x.streamRules.list"));
+                const meta = result["meta"] === undefined ? {} : object(result["meta"]);
+                const nextCursor = optionalString(meta["next_token"]);
+                return { items, ...definedFields({ nextCursor }) };
+            },
+            async addStreamRules({ account, rules, dryRun = false, context }) {
+                authorize(account, context);
+                if (rules.length === 0)
+                    throw new SocialError({
+                        code: "invalid_input",
+                        operation: "x.streamRules.add",
+                        message: "Provide at least one X filtered-stream rule to add.",
+                    });
+                for (const rule of rules)
+                    validateRuleInput(rule);
+                const result = await appRequest()("/2/tweets/search/stream/rules", context, {
+                    add: rules.map((rule) => ({
+                        value: rule.value,
+                        ...definedFields({ tag: rule.tag }),
+                    })),
+                }, dryRun ? { dry_run: "true" } : {});
+                return parseRulesUpdate(object(result), dryRun);
+            },
+            async deleteStreamRules({ account, ids, dryRun = false, context }) {
+                authorize(account, context);
+                validateRuleIds(ids, "x.streamRules.delete", 1000);
+                const result = await appRequest()("/2/tweets/search/stream/rules", context, { delete: { ids: [...ids] } }, dryRun ? { dry_run: "true" } : {});
+                return parseRulesUpdate(object(result), dryRun);
+            },
+            async *stream({ account, context, ...streamOptions }) {
+                authorize(account, context);
+                const bearerToken = options.appBearerToken;
+                if (!bearerToken?.trim())
+                    throw new SocialError({
+                        code: "missing_permission",
+                        operation: "streams.read",
+                        message: "The X filtered stream requires an app-only bearer token. Configure appBearerToken.",
+                    });
+                yield* readFilteredStream({ bearerToken, fetch: options.fetch }, streamOptions, context);
+            },
+            async hideReply({ account, replyId, hidden, context }) {
+                authorize(account, context);
+                if (!/^[0-9]{1,19}$/.test(replyId))
+                    throw new SocialError({
+                        code: "invalid_input",
+                        operation: "comments.moderate",
+                        message: "X reply IDs are numeric strings of 1 to 19 digits.",
+                        retryDisposition: { kind: "never" },
+                    });
+                const result = object(await requireUserToken("comments.moderate")(`/2/tweets/${encodeURIComponent(replyId)}/hidden`, context, { hidden }, {}, "PUT"));
+                const state = result["data"] === undefined
+                    ? undefined
+                    : optionalBoolean(object(result["data"])["hidden"]);
+                if (state === undefined)
+                    throw new SocialError({
+                        code: "ambiguous_outcome",
+                        operation: "comments.moderate",
+                        message: "X did not report the reply's hidden state.",
+                        retryDisposition: { kind: "reconcile-first" },
+                    });
+                return { hidden: state };
+            },
         }),
     });
     return adapter;