@particle-academy/youtube-js 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@particle-academy/youtube-ui`,
 `@particle-academy/youtube-js`, `particle-academy/youtube-php` and
 `fancy-youtube`.
 
+## [0.4.0] — 2026-11-08
+
+### Added
+
+- **One Google consent grant, shared by every Google connector** (`oauth.grant:
+  "google"`), for an org-level Google connection: one OAuth client, one consent
+  and one refresh token per person, with each feature's scopes asked for when it
+  is first used. Declared in the manifest, the `-ui` package's OAuth constant,
+  the README and the registry index:
+  - `authorizeParams`: `access_type=offline` and `include_granted_scopes=true`.
+    A refresh token comes back only on the FIRST code exchange, so keep the stored
+    one when an exchange returns none.
+  - `revoke`: POST `https://oauth2.googleapis.com/revoke` with `token`, and
+    `scope: "grant"`. **Revoking removes the person's WHOLE Google grant, every
+    Google connector**, so a per-feature disconnect stops using that feature's
+    scopes locally and only a full Google disconnect revokes.
+  - `identity`: identify the account by the id_token's `sub` (request `openid`;
+    issuer `https://accounts.google.com` or `accounts.google.com`; audience is
+    the `clientId`), never by email, which Google says is neither unique nor
+    permanent.
+  `restrictedScopes` is empty: none of this connector's scopes is restricted.
+
+  Nothing a request sends has changed; this is what a host needs to run the
+  connection.
+
 ## [0.3.0] — 2026-11-08
 
 ### Added

package/README.md

@@ -55,6 +55,13 @@ YouTube uses OAuth2 (authorization_code). The package DECLARES the exchange; the
 - **Scopes** — `https://www.googleapis.com/auth/youtube.force-ssl`
 - **Access token lifetime** — 3600 seconds (1 hours). A host that never refreshes works all afternoon and is broken by morning.
 
+**One consent grant, shared** (`grant: "google"`). Every connector declaring the same grant can run on ONE OAuth client, with one consent and one refresh token per person.
+
+- **Authorize with** `access_type=offline`, `include_granted_scopes=true`. Ask for a feature's scopes when it is first used; the new token covers every scope granted before. A refresh token comes back only on the FIRST exchange, so keep the stored one when an exchange returns none.
+- **Revoke** — POST https://oauth2.googleapis.com/revoke with `token`. **It removes the WHOLE grant**: every connector sharing it, not only this one. A per-feature disconnect stops using that feature's scopes locally; only a full disconnect revokes.
+- **Identify the account by `sub`**: request `openid`, then verify the token response's id_token (issuer `https://accounts.google.com` or `accounts.google.com`, keys at https://www.googleapis.com/oauth2/v3/certs, audience = `clientId`). Never key a connection by email.
+- **No restricted scopes** in this connector.
+
 The refresh tokens do **not** rotate: the same one is reusable, so a refresh may safely be retried and may run concurrently. Stated rather than assumed, because the opposite — a provider that spends the token and revokes the grant on a replay — looks identical until it happens.
 
 ### The estate

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@particle-academy/youtube-js",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "YouTube for Node — the service descriptor, its faker, its webhook verification, and one function per operation. Plain HTTP on @particle-academy/fancy-connector-core; no vendor SDK.",
   "repository": {
     "type": "git",
@@ -54,7 +54,7 @@
   },
   "peerDependencies": {
     "@particle-academy/fancy-flow": ">=0.47.1 <2.0",
-    "@particle-academy/youtube-ui": ">=0.3.0 <0.4.0"
+    "@particle-academy/youtube-ui": ">=0.4.0 <0.5.0"
   },
   "peerDependenciesMeta": {
     "@particle-academy/fancy-flow": {