@opencoredev/social-sdk 0.3.0 → 0.5.0

package/dist/cli-request.d.ts

@@ -0,0 +1,15 @@
+import type { PublishRequest } from "./core/types.js";
+/**
+ * A JSON publish request the CLI cannot hand to `prepare`. The message names the
+ * offending path and never repeats the submitted value.
+ */
+export declare class PublishRequestInputError extends Error {
+    readonly name = "PublishRequestInputError";
+}
+/**
+ * Parse and decode CLI input text into a `PublishRequest`. This checks the
+ * request's structure; `prepare` still reports semantic problems such as an
+ * unknown backend, an empty target list, or a past schedule as diagnostics.
+ * Text that is not JSON throws the `SyntaxError` from `JSON.parse`.
+ */
+export declare function decodePublishRequest(text: string): PublishRequest;

package/dist/cli-request.js

@@ -0,0 +1,193 @@
+import { definedFields } from "./core/fields.js";
+import { isJsonValue } from "./transport/json.js";
+import { isFiniteNumber, isJsonArray, isJsonObject, isString, } from "./transport/validation.js";
+/**
+ * A JSON publish request the CLI cannot hand to `prepare`. The message names the
+ * offending path and never repeats the submitted value.
+ */
+export class PublishRequestInputError extends Error {
+    name = "PublishRequestInputError";
+}
+/** JSON diagnostics deliberately accept only portable URLs, never executable streams or Blob handles. */
+const httpsMediaOnlyMessage = "CLI media validation accepts HTTPS URL inputs only. Validate Blob/stream/media handles through the SDK.";
+function fail(path, expectation) {
+    throw new PublishRequestInputError(`Invalid publish request: ${path} must be ${expectation}.`);
+}
+function objectAt(value, path) {
+    if (!isJsonObject(value))
+        fail(path, "an object");
+    return value;
+}
+function stringAt(value, path) {
+    if (!isString(value))
+        fail(path, "a string");
+    return value;
+}
+function optionalStringAt(value, path) {
+    return value === undefined ? undefined : stringAt(value, path);
+}
+function optionalNumberAt(value, path) {
+    if (value === undefined)
+        return undefined;
+    if (!isFiniteNumber(value))
+        fail(path, "a finite number");
+    return value;
+}
+function versionAt(value, path) {
+    if (value !== 1)
+        fail(path, "1");
+    return value;
+}
+function connectedAccount(value, path) {
+    const input = objectAt(value, path);
+    if (input["kind"] !== "connected-account")
+        fail(`${path}.kind`, '"connected-account"');
+    return {
+        kind: input["kind"],
+        version: versionAt(input["version"], `${path}.version`),
+        backend: stringAt(input["backend"], `${path}.backend`),
+        platform: stringAt(input["platform"], `${path}.platform`),
+        accountId: stringAt(input["accountId"], `${path}.accountId`),
+    };
+}
+function mediaRef(input, path) {
+    if (input["kind"] !== "media")
+        fail(`${path}.kind`, '"media"');
+    return {
+        kind: input["kind"],
+        version: versionAt(input["version"], `${path}.version`),
+        backend: stringAt(input["backend"], `${path}.backend`),
+        mediaId: stringAt(input["mediaId"], `${path}.mediaId`),
+        platform: stringAt(input["platform"], `${path}.platform`),
+        accountId: stringAt(input["accountId"], `${path}.accountId`),
+    };
+}
+function replyReference(value, path) {
+    const input = objectAt(value, path);
+    const kind = input["kind"];
+    const base = {
+        version: versionAt(input["version"], `${path}.version`),
+        backend: stringAt(input["backend"], `${path}.backend`),
+        platform: stringAt(input["platform"], `${path}.platform`),
+        accountId: stringAt(input["accountId"], `${path}.accountId`),
+        postId: stringAt(input["postId"], `${path}.postId`),
+    };
+    if (kind === "comment")
+        return { kind, ...base, commentId: stringAt(input["commentId"], `${path}.commentId`) };
+    if (kind !== "platform-post")
+        fail(`${path}.kind`, '"platform-post" or "comment"');
+    const native = input["native"];
+    return {
+        kind,
+        ...base,
+        ...definedFields({
+            native: native === undefined ? undefined : objectAt(native, `${path}.native`),
+        }),
+    };
+}
+function mediaSource(value, path) {
+    if (!isJsonObject(value) || value["kind"] !== "https-url")
+        throw new PublishRequestInputError(httpsMediaOnlyMessage);
+    return { kind: value["kind"], url: stringAt(value["url"], `${path}.url`) };
+}
+/** Thumbnails were never limited to URLs by the CLI, so JSON media references stay accepted. */
+function thumbnailSource(value, path) {
+    const input = objectAt(value, path);
+    if (input["kind"] === "https-url")
+        return { kind: input["kind"], url: stringAt(input["url"], `${path}.url`) };
+    if (input["kind"] === "media-ref")
+        return {
+            kind: input["kind"],
+            ref: mediaRef(objectAt(input["ref"], `${path}.ref`), `${path}.ref`),
+        };
+    return fail(`${path}.kind`, '"https-url" or "media-ref"');
+}
+function mediaAttachment(value, path) {
+    const input = objectAt(value, path);
+    const kind = input["kind"];
+    if (kind !== "image" && kind !== "video")
+        fail(`${path}.kind`, '"image" or "video"');
+    const thumbnail = input["thumbnail"];
+    return {
+        kind,
+        source: mediaSource(input["source"], `${path}.source`),
+        ...definedFields({
+            mimeType: optionalStringAt(input["mimeType"], `${path}.mimeType`),
+            filename: optionalStringAt(input["filename"], `${path}.filename`),
+            byteSize: optionalNumberAt(input["byteSize"], `${path}.byteSize`),
+            width: optionalNumberAt(input["width"], `${path}.width`),
+            height: optionalNumberAt(input["height"], `${path}.height`),
+            durationSeconds: optionalNumberAt(input["durationSeconds"], `${path}.durationSeconds`),
+            altText: optionalStringAt(input["altText"], `${path}.altText`),
+            caption: optionalStringAt(input["caption"], `${path}.caption`),
+            thumbnail: thumbnail === undefined ? undefined : thumbnailSource(thumbnail, `${path}.thumbnail`),
+        }),
+    };
+}
+function link(value, path) {
+    const input = objectAt(value, path);
+    return {
+        url: stringAt(input["url"], `${path}.url`),
+        ...definedFields({
+            title: optionalStringAt(input["title"], `${path}.title`),
+            description: optionalStringAt(input["description"], `${path}.description`),
+        }),
+    };
+}
+function content(value, path) {
+    const input = objectAt(value, path);
+    const media = input["media"];
+    const linkInput = input["link"];
+    if (media !== undefined && !isJsonArray(media))
+        fail(`${path}.media`, "an array");
+    return definedFields({
+        text: optionalStringAt(input["text"], `${path}.text`),
+        media: media?.map((item, index) => mediaAttachment(item, `${path}.media[${index}]`)),
+        link: linkInput === undefined ? undefined : link(linkInput, `${path}.link`),
+    });
+}
+function target(value, path) {
+    const input = objectAt(value, path);
+    const override = input["content"];
+    const replyTo = input["replyTo"];
+    const options = input["options"];
+    return {
+        account: connectedAccount(input["account"], `${path}.account`),
+        ...definedFields({
+            content: override === undefined ? undefined : content(override, `${path}.content`),
+            replyTo: replyTo === undefined ? undefined : replyReference(replyTo, `${path}.replyTo`),
+            // Each adapter validates its own option fields during `prepare`.
+            options: options === undefined ? undefined : objectAt(options, `${path}.options`),
+        }),
+    };
+}
+function schedule(value, path) {
+    const input = objectAt(value, path);
+    return {
+        at: stringAt(input["at"], `${path}.at`),
+        ...definedFields({ timeZone: optionalStringAt(input["timeZone"], `${path}.timeZone`) }),
+    };
+}
+/**
+ * Parse and decode CLI input text into a `PublishRequest`. This checks the
+ * request's structure; `prepare` still reports semantic problems such as an
+ * unknown backend, an empty target list, or a past schedule as diagnostics.
+ * Text that is not JSON throws the `SyntaxError` from `JSON.parse`.
+ */
+export function decodePublishRequest(text) {
+    const parsed = JSON.parse(text);
+    if (!isJsonValue(parsed) || !isJsonObject(parsed) || !isJsonArray(parsed["targets"]))
+        throw new PublishRequestInputError("Expected a JSON publish request with a targets array.");
+    const scheduleInput = parsed["schedule"];
+    const replyTo = parsed["replyTo"];
+    return {
+        targets: parsed["targets"].map((item, index) => target(item, `targets[${index}]`)),
+        content: content(parsed["content"], "content"),
+        ...definedFields({
+            idempotencyKey: optionalStringAt(parsed["idempotencyKey"], "idempotencyKey"),
+            correlationId: optionalStringAt(parsed["correlationId"], "correlationId"),
+            schedule: scheduleInput === undefined ? undefined : schedule(scheduleInput, "schedule"),
+            replyTo: replyTo === undefined ? undefined : replyReference(replyTo, "replyTo"),
+        }),
+    };
+}

package/dist/cli.d.ts

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
 import type { SocialAdapter } from "./core/index.js";
-declare const names: readonly ["mock", "zernio", "post-for-me", "bluesky", "x", "threads", "youtube", "tiktok", "instagram", "linkedin"];
-type AdapterName = (typeof names)[number];
+/** Adapters the diagnostic CLI can construct offline. */
+export declare const adapterNames: readonly ["mock", "zernio", "post-for-me", "postfast", "bluesky", "x", "threads", "youtube", "tiktok", "instagram", "linkedin"];
+export type AdapterName = (typeof adapterNames)[number];
+export declare function isAdapterName(value: string): value is AdapterName;
 export declare function createDiagnosticAdapter(name: AdapterName, accountId?: string): SocialAdapter<unknown>;
 export interface CliIO {
     readonly env: Readonly<Record<string, string | undefined>>;
@@ -10,4 +12,3 @@ export interface CliIO {
 }
 /** All commands are offline and return 0 (valid), 1 (diagnostic failure), or 2 (usage/input error). */
 export declare function runCli(args: readonly string[], io: CliIO): Promise<number>;
-export {};

package/dist/cli.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
-/* oxlint-disable anti-slop/no-runtime-typeof, anti-slop/no-unknown-parameters, anti-slop/no-unsafe-dictionary-type, anti-slop/require-safety-comment-for-type-assertion -- CLI JSON is parsed and validated at its input boundary. */
 import { realpathSync } from "node:fs";
 import { readFile, stat } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
 import { createSocial } from "./core/client.js";
+import { decodePublishRequest, PublishRequestInputError } from "./cli-request.js";
 import { mockBackend } from "./testing/index.js";
 import { zernio } from "./cloud/zernio.js";
 import { postForMe } from "./cloud/post-for-me.js";
+import { postfast } from "./cloud/postfast.js";
 import { bluesky } from "./platforms/bluesky.js";
 import { x } from "./platforms/x.js";
 import { threads } from "./platforms/threads.js";
@@ -14,10 +15,12 @@ import { youtube } from "./platforms/youtube.js";
 import { tiktok } from "./platforms/tiktok.js";
 import { instagram } from "./platforms/instagram.js";
 import { linkedin } from "./platforms/linkedin.js";
-const names = [
+/** Adapters the diagnostic CLI can construct offline. */
+export const adapterNames = [
     "mock",
     "zernio",
     "post-for-me",
+    "postfast",
     "bluesky",
     "x",
     "threads",
@@ -26,10 +29,17 @@ const names = [
     "instagram",
     "linkedin",
 ];
+export function isAdapterName(value) {
+    return adapterNames.some((name) => name === value);
+}
+function isLinkedInAuthorUrn(value) {
+    return value.startsWith("urn:li:person:") || value.startsWith("urn:li:organization:");
+}
 const environmentNames = {
     mock: [],
     zernio: ["ZERNIO_API_KEY"],
     "post-for-me": ["POST_FOR_ME_API_KEY"],
+    postfast: ["POSTFAST_API_KEY"],
     bluesky: ["BLUESKY_SERVICE", "BLUESKY_DID", "BLUESKY_ACCESS_JWT"],
     x: ["X_USER_ID", "X_ACCESS_TOKEN"],
     threads: ["THREADS_USER_ID", "THREADS_ACCESS_TOKEN"],
@@ -49,6 +59,8 @@ export function createDiagnosticAdapter(name, accountId = "diagnostic-account")
             return zernio({ apiKey: "offline-placeholder", fetch: noNetwork });
         case "post-for-me":
             return postForMe({ apiKey: "offline-placeholder", fetch: noNetwork });
+        case "postfast":
+            return postfast({ apiKey: "offline-placeholder", fetch: noNetwork });
         case "bluesky":
             return bluesky({
                 auth: { service: "https://bsky.social", did: accountId, accessJwt: "offline-placeholder" },
@@ -83,9 +95,7 @@ export function createDiagnosticAdapter(name, accountId = "diagnostic-account")
         case "linkedin":
             return linkedin({
                 auth: {
-                    author: accountId.startsWith("urn:li:")
-                        ? accountId
-                        : "urn:li:person:diagnostic",
+                    author: isLinkedInAuthorUrn(accountId) ? accountId : "urn:li:person:diagnostic",
                     accessToken: "offline-placeholder",
                 },
                 apiVersion: "202609",
@@ -97,6 +107,7 @@ export function createDiagnosticAdapter(name, accountId = "diagnostic-account")
 export async function runCli(args, io) {
     const command = args[0] ?? "help";
     const json = args.includes("--json");
+    // `data` is any report shape this command builds; it is only passed to JSON.stringify.
     const finish = (code, data) => {
         const result = { schemaVersion: 1, command, ok: code === 0, data };
         io.write(json ? JSON.stringify(result) + "\n" : JSON.stringify(result, null, 2) + "\n");
@@ -123,12 +134,12 @@ export async function runCli(args, io) {
             exitCodes: { success: 0, diagnosticFailure: 1, invalidInput: 2 },
         });
     const selected = options.get("--adapter") ?? "mock";
-    if (!names.includes(selected))
-        return finish(2, { error: "Unknown adapter.", adapters: names });
+    if (!isAdapterName(selected))
+        return finish(2, { error: "Unknown adapter.", adapters: adapterNames });
     const name = selected;
     if (command === "adapters")
         return finish(0, {
-            adapters: names,
+            adapters: adapterNames,
             verification: "Local contract tests; no live checks are performed by this CLI.",
         });
     if (command === "doctor") {
@@ -176,18 +187,7 @@ export async function runCli(args, io) {
         const raw = await io.readInput(file);
         if (new TextEncoder().encode(raw).byteLength > 1024 * 1024)
             return finish(2, { error: "Input exceeds the 1 MiB diagnostic limit." });
-        const request = JSON.parse(raw);
-        if (!request ||
-            typeof request !== "object" ||
-            !Array.isArray(request["targets"]))
-            return finish(2, { error: "Expected a JSON publish request with a targets array." });
-        const input = request;
-        // JSON diagnostics deliberately accept only portable URLs, never executable streams or Blob handles.
-        const contents = [input.content, ...input.targets.map((target) => target.content)];
-        if (contents.some((content) => content?.media?.some((media) => media.source?.kind !== "https-url")))
-            return finish(2, {
-                error: "CLI media validation accepts HTTPS URL inputs only. Validate Blob/stream/media handles through the SDK.",
-            });
+        const input = decodePublishRequest(raw);
         const social = createSocial({
             backend: createDiagnosticAdapter(name, input.targets[0]?.account?.accountId),
         });
@@ -204,7 +204,10 @@ export async function runCli(args, io) {
             })),
         });
     }
-    catch {
+    catch (error) {
+        // Decoder messages name a path or rule and never repeat submitted values.
+        if (error instanceof PublishRequestInputError)
+            return finish(2, { error: error.message });
         return finish(2, {
             error: "Unable to read or validate the JSON publish request. Check its shape and file permissions.",
         });

package/dist/cloud/common.d.ts

@@ -1,6 +1,7 @@
 import type { ManagedMediaStore } from "./media.js";
-import type { AdapterOperationContext, CapabilityManifest, ConnectedAccountRef, JsonObject, MediaAttachment, Platform, PreparationIssue, PreparedPublishTarget } from "../core/types.js";
+import type { AdapterOperationContext, CapabilityDeclaration, CapabilityManifest, ConnectedAccountRef, JsonObject, JsonValue, MediaAttachment, Platform, PreparationIssue, PreparedPublishTarget } from "../core/types.js";
 import { type HttpOptions } from "../transport/http.js";
+import { type JsonField } from "../transport/validation.js";
 export interface ManagedOptions extends HttpOptions {
     readonly apiKey: string;
     readonly mediaStore?: ManagedMediaStore;
@@ -9,17 +10,21 @@ export interface ManagedOptions extends HttpOptions {
     readonly uploadHostAllowed?: (hostname: string) => boolean;
 }
 export declare const selectedPlatforms: readonly ["x", "threads", "bluesky", "youtube", "tiktok", "instagram", "linkedin", "facebook"];
-export declare function platform(value: unknown): Platform;
-export declare function managedHttp(origin: string, options: ManagedOptions): (path: string, context: AdapterOperationContext, body?: JsonObject, query?: Record<string, string>, method?: "GET" | "POST" | "PUT" | "DELETE") => Promise<unknown>;
-export declare function capabilityManifest(backend: string, apiRevision: string, operations: readonly string[]): CapabilityManifest;
-export declare function optionsObject(target: PreparedPublishTarget): Record<string, unknown>;
+export declare function platform(value: JsonField): Platform;
+/** How a provider expects its server-side API key. Defaults to a bearer token. */
+export type ManagedAuthHeader = (apiKey: string) => readonly [name: string, value: string];
+export declare function managedHttp(origin: string, options: ManagedOptions, authHeader?: ManagedAuthHeader): (path: string, context: AdapterOperationContext, body?: JsonObject, query?: Record<string, string>, method?: "GET" | "POST" | "PUT" | "DELETE") => Promise<JsonValue>;
+export type PublishFormats = (platform: (typeof selectedPlatforms)[number]) => CapabilityDeclaration["formats"];
+export declare const publishFormats: PublishFormats;
+export declare function capabilityManifest(backend: string, apiRevision: string, operations: readonly string[], formats?: PublishFormats): CapabilityManifest;
+export declare function optionsObject(target: PreparedPublishTarget): JsonObject;
 /** Every accepted normalized option has an intentional provider mapping. */
-export declare function managedOptionIssues(target: PreparedPublishTarget, provider: "zernio" | "post-for-me"): PreparationIssue[];
+export declare function managedOptionIssues(target: PreparedPublishTarget, provider: "zernio" | "post-for-me" | "postfast"): PreparationIssue[];
 export declare function managedPreparation(target: PreparedPublishTarget): PreparationIssue[];
-export declare function uploadManagedMedia(item: MediaAttachment, presign: (body: JsonObject) => Promise<unknown>, config: {
+export declare function uploadManagedMedia(item: MediaAttachment, presign: (body: JsonObject) => Promise<JsonValue>, config: {
     options: ManagedOptions;
     provider: "zernio" | "post-for-me";
     context: AdapterOperationContext;
 }): Promise<string>;
 export declare function accountMatches(ref: Pick<ConnectedAccountRef, "backend" | "platform" | "accountId">, context: AdapterOperationContext): void;
-export declare function publicFields(value: unknown, fields: readonly string[]): JsonObject;
+export declare function publicFields(value: JsonField, fields: readonly string[]): JsonObject;

package/dist/cloud/common.js

@@ -1,8 +1,10 @@
 import { remainingBudget } from "../transport/budget.js";
 import { SocialError } from "../core/errors.js";
 import { createHttp, HttpError } from "../transport/http.js";
+import { isJsonValue } from "../transport/json.js";
 import { httpsUrl, upload } from "../transport/upload.js";
-import { object, string } from "../transport/validation.js";
+import { definedFields } from "../core/fields.js";
+import { isBoolean, isJsonArray, isJsonObject, isString, object, string, } from "../transport/validation.js";
 export const selectedPlatforms = [
     "x",
     "threads",
@@ -13,11 +15,9 @@ export const selectedPlatforms = [
     "linkedin",
     "facebook",
 ];
-// oxlint-disable-next-line anti-slop/no-unknown-parameters -- provider payload is validated at this adapter boundary.
 export function platform(value) {
     const slug = value === "twitter" ? "x" : value;
-    // oxlint-disable-next-line anti-slop/no-runtime-typeof -- provider payload is validated at this adapter boundary.
-    if (typeof slug !== "string" || !selectedPlatforms.some((item) => item === slug))
+    if (!isString(slug) || !selectedPlatforms.some((item) => item === slug))
         throw new SocialError({
             code: "unsupported_capability",
             operation: "accounts.read",
@@ -25,7 +25,8 @@ export function platform(value) {
         });
     return slug;
 }
-export function managedHttp(origin, options) {
+const bearer = (apiKey) => ["Authorization", `Bearer ${apiKey}`];
+export function managedHttp(origin, options, authHeader = bearer) {
     if (!options.apiKey.trim())
         throw new SocialError({
             code: "invalid_config",
@@ -37,10 +38,8 @@ export function managedHttp(origin, options) {
         const url = new URL(origin + path);
         for (const [key, value] of Object.entries(query))
             url.searchParams.set(key, value);
-        const headers = new Headers({
-            Authorization: `Bearer ${options.apiKey}`,
-            "Content-Type": "application/json",
-        });
+        const headers = new Headers({ "Content-Type": "application/json" });
+        headers.set(...authHeader(options.apiKey));
         if (context.targetIdempotencyKey && origin.includes("zernio.com"))
             headers.set(path === "/v1/posts" ? "x-request-id" : "Idempotency-Key", context.targetIdempotencyKey);
         try {
@@ -49,10 +48,10 @@ export function managedHttp(origin, options) {
                 headers,
                 timeoutMs: remainingBudget(context),
                 method,
-                // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- provider payload is validated at this adapter boundary.
-                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-                // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- provider payload is validated at this adapter boundary.
-                ...(context.signal ? { signal: context.signal } : {}),
+                ...definedFields({
+                    body: body === undefined ? undefined : JSON.stringify(body),
+                    signal: context.signal,
+                }),
                 maxAttempts: method === "GET" ? Math.min(5, context.retryBudget.maxAttempts) : 1,
             });
         }
@@ -88,8 +87,7 @@ export function managedHttp(origin, options) {
                 backend: context.backendInstance,
                 correlationId: context.correlationId,
                 message: error.message,
-                // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- provider payload is validated at this adapter boundary.
-                ...(error.status === undefined ? {} : { upstreamStatus: error.status }),
+                ...definedFields({ upstreamStatus: error.status }),
                 retryDisposition: ambiguous
                     ? { kind: "reconcile-first" }
                     : error.status === 401
@@ -101,7 +99,14 @@ export function managedHttp(origin, options) {
         }
     };
 }
-export function capabilityManifest(backend, apiRevision, operations) {
+export const publishFormats = (platform) => {
+    if (platform === "youtube")
+        return ["video"];
+    if (platform === "instagram" || platform === "tiktok")
+        return ["image", "video", "carousel"];
+    return ["text", "image", "video", "carousel"];
+};
+export function capabilityManifest(backend, apiRevision, operations, formats = publishFormats) {
     return {
         schemaVersion: 1,
         backend,
@@ -111,29 +116,25 @@ export function capabilityManifest(backend, apiRevision, operations) {
             platform,
             operation,
             availability: "available",
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- provider payload is validated at this adapter boundary.
-            ...(operation === "posts.publish"
-                ? {
-                    // oxlint-disable-next-line anti-slop/require-safety-comment-for-type-assertion -- provider payload is validated at this adapter boundary.
-                    formats: (platform === "youtube"
-                        ? ["video"]
-                        : platform === "instagram" || platform === "tiktok"
-                            ? ["image", "video", "carousel"]
-                            : ["text", "image", "video", "carousel"]),
-                }
-                : {}),
+            ...definedFields({
+                formats: operation === "posts.publish" ? formats(platform) : undefined,
+            }),
             notes: "Contract implementation; live account verification and provider/platform eligibility are separate.",
         }))),
     };
 }
-// oxlint-disable-next-line anti-slop/no-unsafe-dictionary-type -- provider payload is validated at this adapter boundary.
 export function optionsObject(target) {
-    return target.options === undefined ? {} : object(target.options);
+    const options = target.options;
+    if (options === undefined)
+        return {};
+    // Reject exactly as `object` does, including options with members JSON cannot represent.
+    if (!isJsonValue(options))
+        throw new HttpError("Upstream response must be an object.", "invalid-response", true);
+    return object(options);
 }
 /** Every accepted normalized option has an intentional provider mapping. */
 export function managedOptionIssues(target, provider) {
     const config = optionsObject(target);
-    // oxlint-disable-next-line anti-slop/no-known-value-widening -- provider payload is validated at this adapter boundary.
     const keys = {
         youtube: ["title", "visibility", "madeForKids"],
         instagram: ["shareToFeed"],
@@ -167,8 +168,7 @@ export function managedOptionIssues(target, provider) {
         "aiGenerated",
         "draft",
     ]) {
-        // oxlint-disable-next-line anti-slop/no-runtime-typeof -- provider payload is validated at this adapter boundary.
-        if (config[key] !== undefined && typeof config[key] !== "boolean")
+        if (config[key] !== undefined && !isBoolean(config[key]))
             fail("options.boolean", "Consent, audience, interaction and disclosure choices must be booleans.");
     }
     if (config["replySettings"] !== undefined &&
@@ -184,8 +184,7 @@ export function managedOptionIssues(target, provider) {
             "aiGenerated",
             "draft",
         ])
-            // oxlint-disable-next-line anti-slop/no-runtime-typeof -- provider payload is validated at this adapter boundary.
-            if (typeof config[key] !== "boolean")
+            if (!isBoolean(config[key]))
                 fail("tiktok.explicit_choice", "Select every interaction, disclosure, AI-content and draft/direct-post choice before submission.");
         if (config["brandedContent"] === true && config["privacy"] === "SELF_ONLY")
             fail("tiktok.branded_privacy", "TikTok branded content cannot use private visibility.");
@@ -241,13 +240,11 @@ export function managedPreparation(target) {
         const options = optionsObject(target);
         if (media.length !== 1 || media[0]?.kind !== "video")
             fail("youtube.video", "YouTube requires exactly one video.");
-        // oxlint-disable-next-line anti-slop/no-runtime-typeof -- provider payload is validated at this adapter boundary.
-        if (typeof options["title"] !== "string" || !options["title"])
+        if (!isString(options["title"]) || !options["title"])
             fail("youtube.title", "Select a YouTube title explicitly.");
         if (!["public", "unlisted", "private"].includes(String(options["visibility"])))
             fail("youtube.visibility", "Select public, unlisted, or private visibility explicitly.");
-        // oxlint-disable-next-line anti-slop/no-runtime-typeof -- provider payload is validated at this adapter boundary.
-        if (typeof options["madeForKids"] !== "boolean")
+        if (!isBoolean(options["madeForKids"]))
             fail("youtube.audience", "Declare whether the video is made for kids.");
     }
     if (["instagram", "tiktok"].includes(target.account.platform) && media.length === 0)
@@ -261,9 +258,7 @@ export function managedPreparation(target) {
     }
     return issues;
 }
-export async function uploadManagedMedia(item, 
-// oxlint-disable-next-line anti-slop/no-unknown-returns -- provider payload is validated at this adapter boundary.
-presign, config) {
+export async function uploadManagedMedia(item, presign, config) {
     if (item.source.kind === "https-url")
         return httpsUrl(item.source.url).href;
     if (item.source.kind === "media-ref")
@@ -277,8 +272,7 @@ presign, config) {
     const source = item.source;
     const size = item.byteSize ?? (source.kind === "blob" ? source.blob.size : undefined);
     const data = object(await presign(config.provider === "zernio"
-        ? // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- provider payload is validated at this adapter boundary.
-            { filename, contentType: mimeType, ...(size === undefined ? {} : { size }) }
+        ? { filename, contentType: mimeType, ...definedFields({ size }) }
         : {}));
     const uploadUrl = string(data[config.provider === "zernio" ? "uploadUrl" : "upload_url"]);
     const publicUrl = string(data[config.provider === "zernio" ? "publicUrl" : "media_url"]);
@@ -290,19 +284,13 @@ presign, config) {
         url: uploadUrl,
         source: {
             mimeType,
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- provider payload is validated at this adapter boundary.
-            ...(size === undefined ? {} : { size }),
-            // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- Blob bodies preserve known-size uploads for presigned storage.
-            ...(source.kind === "blob" ? { body: source.blob } : {}),
+            ...definedFields({ size, body: source.kind === "blob" ? source.blob : undefined }),
             open: source.kind === "blob" ? () => source.blob.stream() : source.open,
         },
         allowHost,
         maxBytes: 5 * 1024 * 1024 * 1024,
         timeoutMs: remainingBudget(config.context),
-        // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- provider payload is validated at this adapter boundary.
-        ...(config.options.fetch ? { fetch: config.options.fetch } : {}),
-        // oxlint-disable-next-line anti-slop/no-conditional-empty-object-spread -- provider payload is validated at this adapter boundary.
-        ...(config.context.signal ? { signal: config.context.signal } : {}),
+        ...definedFields({ fetch: config.options.fetch, signal: config.context.signal }),
     });
     return httpsUrl(publicUrl).href;
 }
@@ -314,20 +302,12 @@ export function accountMatches(ref, context) {
             message: "Account reference belongs to another backend instance.",
         });
 }
-// oxlint-disable-next-line anti-slop/no-unknown-parameters -- provider payload is validated at this adapter boundary.
 export function publicFields(value, fields) {
     const data = object(value);
     const result = {};
     for (const field of fields) {
         const value = data[field];
-        if (
-        // oxlint-disable-next-line anti-slop/no-runtime-typeof -- provider payload is validated at this adapter boundary.
-        typeof value === "string" ||
-            // oxlint-disable-next-line anti-slop/no-runtime-typeof -- provider payload is validated at this adapter boundary.
-            typeof value === "boolean" ||
-            // oxlint-disable-next-line anti-slop/no-runtime-typeof -- provider payload is validated at this adapter boundary.
-            typeof value === "number" ||
-            value === null)
+        if (value !== undefined && !isJsonObject(value) && !isJsonArray(value))
             result[field] = value;
     }
     return result;