@volter/twin-tiktok 0.1.36 → 1.0.0

package/dist/journeys/customer-life.outline.md

@@ -0,0 +1,59 @@
+# tiktok customer life: outline
+
+Author: `codex-demand-rule`.
+
+**Tidewater Yoga** posts to TikTok from **Postiz** (gitroomhq/postiz-app at `e0a08a7d9592fdc1ef1e82cb7cb781489fceade3`, ../journeys/demand.json). The World
+clock starts Tue 20 Jan 2026, 09:00.
+
+1. **The developer site and the person.** The World registers Postiz's TikTok app on the developer site: its client key
+   and secret (the credential door answers TIKTOK_CLIENT_ID and TIKTOK_CLIENT_SECRET), its redirect URI
+   (`https://postiz.tidewater.yoga/integrations/social/tiktok`) and its URL property (the studio's media domain).
+   Maya (@tidewateryoga, 1,240 followers, following 180, 9,800 likes, videos up to 10 minutes) has a TikTok account.
+2. **Connecting.** Postiz sends Maya to the authorize page with its six scopes; she signs in and authorizes; the
+   browser returns to the redirect URI with a code, the granted scopes and the state. A redirect URI the app never
+   registered is refused on the page. Postiz trades the code (form, grant_type authorization_code): an access token,
+   a refresh token, open_id and the scopes; the same code again is refused (invalid_grant). It reads the account
+   (open_id, avatar_url, display_name, union_id, username).
+3. **A video, posted directly.** Postiz asks the creator's longest video (600 seconds) and initializes a Direct Post of
+   a 2,304-byte synthetic MP4 as one chunk (FILE_UPLOAD, PUBLIC_TO_EVERYONE); a privacy level not among the creator's options is
+   refused. It PUTs the bytes to the upload URL: 201. The status is PUBLISH_COMPLETE with its public post id and the
+   bytes uploaded. A second PUT to the finished upload is refused (416).
+4. **A video to the inbox.** A second video goes to Maya's inbox (inbox/video/init): after its upload the status is
+   SEND_TO_USER_INBOX, and it is no public video. Maya also reviews a 65 MiB class recording: Postiz's actual plan
+   (`tiktok.provider.ts:703–718,755–786,825–832`) sends five 10 MiB parts (206) and a 15 MiB final part (201), then
+   reads SEND_TO_USER_INBOX and the complete uploaded byte count. Compact synthetic media fills keep the life small.
+5. **Photos.** Postiz posts two photos by URL from a domain the app never verified: 403 url_ownership_unverified.
+   From the studio's verified domain, whose server the World does not run: the post's status is FAILED,
+   photo_pull_failed (the twin pulls through the World and reaches nothing else).
+6. **Analytics.** TikTok's audience watches (the door): 1,200 views, 150 likes, 12 comments, 8 shares. Postiz reads
+   the account's stats (followers 1,240, video count 1), lists its videos (the public one, newest first, cursor and
+   has_more) and queries their counts.
+7. **The next day.** The access token is refreshed (grant_type refresh_token): a new pair, and the old refresh token no
+   longer works. A request with no token answers 401 access_token_invalid.
+8. **What TikTok refuses, and its edges.** The developer site takes only https redirect URIs; TikTok takes no invalid,
+   empty-passworded or taken username. Jonah (a teacher, a private account) is refused on an unknown client key, a
+   response type other than code, a scope the app lacks and a wrong password; he cancels once (access_denied), then
+   authorizes only his basic profile and posting. His code is refused with a wrong client secret or another redirect
+   URI, and a grant type TikTok lacks is refused; traded, his token cannot read stats or videos (scope_not_authorized)
+   or Maya's post, and his creator settings offer a private account's privacy levels. Maya's refreshed token meets the
+   rest: an unknown user field; a caption over 2200 characters; a video from a URL (the twin's gap, said so); no
+   source; every chunk-plan rule; an upload URL naming no task, a chunk without its range or with the wrong bytes, and
+   an upload URL an hour old; photo posts with the wrong media type, post mode or source, no photos, a cover index past
+   them, a title over 90 or a description over 4000 characters, or a privacy level not offered; photos sent to the
+   inbox (their pull fails as before); a publish_id TikTok never gave; a video field that does not exist, a page over
+   20, videos before the first one's time, a query naming none; a video's cover from the CDN.
+9. **TikTok Business.** The ads portal gives Postiz's business app its App ID and secret, and refuses a redirect URL
+   without its trailing slash, with a port, a query, http, a relative one, or eleven; Postiz's is registered. Maya
+   connects her account through the same authorize page; the code is refused with a wrong secret (40131), another
+   grant type, a code TikTok never gave (40110) or another redirect URL, then traded. An open-platform token is not the
+   business API's (40105), none is 40104, another account's business_id 40001; fields that are not a JSON array or
+   name what the profile lacks are 40002. Postiz names the account and reads its analytics, and its posts' counts (the
+   public video of chapter 3, 1,200 views); a page over 20, fields without item_id, and posts before the first are
+   refused or empty. TikTok knows a location near the studio and two tracks; Postiz finds the location and lists the
+   tracks, all and by genre. A video published by URL, with a track, loses its media body after the studio's server
+   supplies headers: FAILED, video_pull_failed. Her next video downloads successfully from the application's media
+   response and becomes PUBLISH_COMPLETE; Postiz reads its id, caption and zero initial counts back from the public
+   Business video list (`tiktok.business.provider.ts:666–691,1140`). Photos saved as a draft fail because the World
+   has no response for those image URLs; every missing field is
+   40002. Jonah connects his business account; Maya's task is not his (40001). The token is refreshed once; the spent
+   refresh token is 40107; a day later Jonah's unrefreshed token has expired (40102).

package/dist/journeys/decisions.json

@@ -0,0 +1,161 @@
+{
+  "about": "Postiz channel connections, posting and analytics at its pinned scanned commit; revocation, cancellation and token-info flows answer the gap.",
+  "decisions": [
+    {
+      "operation": "oauthToken",
+      "demand": "Postiz trades the authorize code for tokens, and refreshes them (libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:305,382).",
+      "mechanism": "handler",
+      "why": "an action: a code or refresh token is spent, a token pair issued (drawn from ctx.secret, kept by SHA-256)"
+    },
+    {
+      "operation": "userInfo",
+      "demand": "Postiz names the connected account and reads its stats (libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:319,399,978).",
+      "mechanism": "handler",
+      "why": "a computed read: the person projected to the fields asked, each gated by its scope"
+    },
+    {
+      "operation": "creatorInfoQuery",
+      "demand": "Postiz reads the creator's longest video (libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:425).",
+      "mechanism": "handler",
+      "why": "a computed read of the creator's settings"
+    },
+    {
+      "operation": "videoInit",
+      "demand": "Postiz posts a video directly (FILE_UPLOAD) (libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:543,546,857).",
+      "mechanism": "handler",
+      "why": "an action: a post made in PROCESSING_UPLOAD with its upload task"
+    },
+    {
+      "operation": "inboxVideoInit",
+      "demand": "Postiz sends a video to the creator's inbox (FILE_UPLOAD) (libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:543,546,857).",
+      "mechanism": "handler",
+      "why": "an action: a post made in PROCESSING_UPLOAD with its upload task"
+    },
+    {
+      "operation": "contentInit",
+      "demand": "Postiz posts photos (PULL_FROM_URL) (libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:543,546,857).",
+      "mechanism": "handler",
+      "why": "an action: a post made in PROCESSING_DOWNLOAD, and the vendor pulls its photos through the World (ctx.vendorFetch)"
+    },
+    {
+      "operation": "uploadVideo",
+      "demand": "Postiz PUTs the video's bytes to the upload URL (libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:773).",
+      "mechanism": "handler",
+      "why": "an action: a chunk's bytes into ctx.blobs; the last moves the post (states.ts) and makes its video"
+    },
+    {
+      "operation": "publishStatusFetch",
+      "demand": "Postiz polls the post's status (libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:455,1158).",
+      "mechanism": "handler",
+      "why": "a computed read of the post by its publish_id, the caller's own only"
+    },
+    {
+      "operation": "videoList",
+      "demand": "Postiz lists the account's videos for analytics (libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:1028,1115).",
+      "mechanism": "handler",
+      "why": "a computed read: the public videos, newest first, by the cursor rule, projected to the fields asked"
+    },
+    {
+      "operation": "videoQuery",
+      "demand": "Postiz reads its videos' counts (libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:1047,1183).",
+      "mechanism": "handler",
+      "why": "a computed read: the caller's videos by id, projected to the fields asked"
+    },
+    {
+      "operation": "ttUserOauth2Token",
+      "demand": "Postiz trades the business account's authorize code for tokens (libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:370).",
+      "mechanism": "handler",
+      "why": "an action: the shared code spent, a business token pair issued"
+    },
+    {
+      "operation": "ttUserOauth2RefreshToken",
+      "demand": "Postiz refreshes the business token (libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:300).",
+      "mechanism": "handler",
+      "why": "an action: a refresh token spent, a new pair issued"
+    },
+    {
+      "operation": "businessGet",
+      "demand": "Postiz names the account (username, display_name, profile_image) and reads its analytics counts (libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:260,956).",
+      "mechanism": "handler",
+      "why": "a computed read of the person, projected to the fields asked"
+    },
+    {
+      "operation": "businessVideoList",
+      "demand": "Postiz reads its posts' likes, comments, shares and views (libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:909,1140).",
+      "mechanism": "handler",
+      "why": "a computed read of the public videos, projected to the fields asked"
+    },
+    {
+      "operation": "businessVideoPublish",
+      "demand": "Postiz publishes a video by URL (or to the drafts) (libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:677).",
+      "mechanism": "handler",
+      "why": "an action: a post made and pulled through the World; its video made"
+    },
+    {
+      "operation": "businessPhotoPublish",
+      "demand": "Postiz publishes photos by URL (or as a draft) (libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:677).",
+      "mechanism": "handler",
+      "why": "an action: a post made and pulled through the World"
+    },
+    {
+      "operation": "businessPublishStatus",
+      "demand": "Postiz reads the post's status once per poll (libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:431).",
+      "mechanism": "handler",
+      "why": "a computed read of the post"
+    },
+    {
+      "operation": "businessPublishLocation",
+      "demand": "Postiz searches location tags for a post (libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:873).",
+      "mechanism": "handler",
+      "why": "a computed read of the World's location tags"
+    },
+    {
+      "operation": "discoveryCmlTrendingList",
+      "demand": "Postiz lists popular tracks to pick music for a post (libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:810).",
+      "mechanism": "handler",
+      "why": "a computed read of the World's tracks"
+    },
+    {
+      "operation": "door:appCredentials",
+      "demand": "Customer life appCredentials setup; Postiz token, profile, posting and analytics calls recorded in demand.json.",
+      "mechanism": "door",
+      "why": "Developer dashboard creates the first app credential; no TikTok API operation does."
+    },
+    {
+      "operation": "door:apps",
+      "demand": "Customer life apps setup; Postiz token, profile, posting and analytics calls recorded in demand.json.",
+      "mechanism": "door",
+      "why": "Developer-site redirect URIs and verified URL properties have no API operation."
+    },
+    {
+      "operation": "door:people",
+      "demand": "Customer life people setup; Postiz token, profile, posting and analytics calls recorded in demand.json.",
+      "mechanism": "door",
+      "why": "The audience\u2019s accounts exist before the application connects them; no published API creates them."
+    },
+    {
+      "operation": "door:videoStats",
+      "demand": "Customer life videoStats setup; Postiz token, profile, posting and analytics calls recorded in demand.json.",
+      "mechanism": "door",
+      "why": "Audience view and engagement counts are not writable through the application API."
+    },
+    {
+      "operation": "door:media",
+      "demand": "Customer life media setup; Postiz token, profile, posting and analytics calls recorded in demand.json.",
+      "mechanism": "door",
+      "why": "The vendor CDN serves synthetic avatar/cover bytes in the World."
+    },
+    {
+      "operation": "door:locations",
+      "demand": "Customer life locations setup; Postiz token, profile, posting and analytics calls recorded in demand.json.",
+      "mechanism": "door",
+      "why": "Location tags are TikTok\u2019s external inventory; no application API creates them."
+    },
+    {
+      "operation": "door:tracks",
+      "demand": "Customer life tracks setup; Postiz token, profile, posting and analytics calls recorded in demand.json.",
+      "mechanism": "door",
+      "why": "Commercial Music Library tracks are external inventory; no application API creates them."
+    }
+  ]
+}

package/dist/journeys/demand.json

@@ -0,0 +1,142 @@
+{
+  "measured": "Application calls and optional settings are recorded below at the cited commits.",
+  "applications": [
+    {
+      "name": "gitroomhq/postiz-app",
+      "commit": "e0a08a7d9592fdc1ef1e82cb7cb781489fceade3",
+      "client": "fetch; TikTokProvider and TiktokBusinessProvider",
+      "frontend": [
+        {
+          "call": "Connect the selected TikTok account through Login Kit consent",
+          "operation": "screen:authorize",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:345-346; libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:352-353"
+        }
+      ],
+      "backend": [
+        {
+          "call": "oauthToken",
+          "operation": "oauthToken",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:305,382"
+        },
+        {
+          "call": "userInfo",
+          "operation": "userInfo",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:320,399,978"
+        },
+        {
+          "call": "creatorInfoQuery",
+          "operation": "creatorInfoQuery",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:425"
+        },
+        {
+          "call": "videoInit",
+          "operation": "videoInit",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:858-863"
+        },
+        {
+          "call": "inboxVideoInit",
+          "operation": "inboxVideoInit",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:858-863"
+        },
+        {
+          "call": "contentInit",
+          "operation": "contentInit",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:858-863"
+        },
+        {
+          "call": "uploadVideo",
+          "operation": "uploadVideo",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:773"
+        },
+        {
+          "call": "publishStatusFetch",
+          "operation": "publishStatusFetch",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:455,1158"
+        },
+        {
+          "call": "videoList",
+          "operation": "videoList",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:1028,1115"
+        },
+        {
+          "call": "videoQuery",
+          "operation": "videoQuery",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.provider.ts:1047,1183"
+        },
+        {
+          "call": "ttUserOauth2Token",
+          "operation": "ttUserOauth2Token",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:370"
+        },
+        {
+          "call": "ttUserOauth2RefreshToken",
+          "operation": "ttUserOauth2RefreshToken",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:300"
+        },
+        {
+          "call": "businessGet",
+          "operation": "businessGet",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:261,957"
+        },
+        {
+          "call": "businessVideoList",
+          "operation": "businessVideoList",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:910,1140"
+        },
+        {
+          "call": "businessVideoPublish",
+          "operation": "businessVideoPublish",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:678-682"
+        },
+        {
+          "call": "businessPhotoPublish",
+          "operation": "businessPhotoPublish",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:678-682"
+        },
+        {
+          "call": "businessPublishStatus",
+          "operation": "businessPublishStatus",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:432,1116"
+        },
+        {
+          "call": "businessPublishLocation",
+          "operation": "businessPublishLocation",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:874"
+        },
+        {
+          "call": "discoveryCmlTrendingList",
+          "operation": "discoveryCmlTrendingList",
+          "evidence": "libraries/nestjs-libraries/src/integrations/social/tiktok.business.provider.ts:811"
+        }
+      ]
+    },
+    {
+      "name": "dubinc/dub",
+      "client": "partner TikTok handle verification",
+      "backend": [
+        {
+          "call": "Partner profile OAuth code exchange",
+          "operation": "oauthToken",
+          "evidence": "apps/web/lib/api/partner-profile/partner-platforms-providers.ts:73"
+        },
+        {
+          "call": "Verify partner username",
+          "operation": "userInfo",
+          "evidence": "apps/web/lib/tiktok/client.ts:24-29"
+        }
+      ],
+      "commit": "7e0101363b2a",
+      "gate": "The shipped partner-profile verification flow authenticates TikTok with its client credentials (apps/web/lib/api/partner-profile/partner-platforms-providers.ts:71-85).",
+      "evidence": "apps/web/lib/api/partner-profile/partner-platforms-providers.ts:74,75",
+      "frontend": [
+        {
+          "call": "TikTok partner verification consent",
+          "operation": "authorize",
+          "evidence": "apps/web/lib/api/partner-profile/partner-platforms-providers.ts:72"
+        }
+      ]
+    }
+  ],
+  "standIns": "the developer site's app (client key and secret, redirect URIs, URL properties) is the doors'; a TikTok person (who signs in on the authorize page) and a video's audience counts are the doors'; the twin decodes no media: a video's duration and size are read from its MP4 boxes, its cover is a labeled placeholder.",
+  "optional": []
+}

package/dist/journeys/score.json

@@ -0,0 +1,294 @@
+{
+  "vendor": "tiktok",
+  "life": {
+    "steps": 154,
+    "verdict": "unjudged",
+    "judge": null,
+    "authors": []
+  },
+  "failures": [],
+  "flags": [
+    {
+      "step": "The finished upload takes no more",
+      "pattern": "REPEAT",
+      "detail": "repeats a request that succeeded earlier in the sitting (PUT https://open-upload.tiktokapis.com/video/?upload_id=73000000)"
+    },
+    {
+      "step": "The old refresh token no longer works",
+      "pattern": "REPEAT",
+      "detail": "repeats a request that succeeded earlier in the sitting (POST https://open.tiktokapis.com/v2/oauth/token/ [content-type=ap)"
+    },
+    {
+      "step": "The old refresh token no longer works",
+      "pattern": "RUN",
+      "detail": "5 refusals in a row, from \"The old refresh token no longer works\" to \"A username already taken\""
+    },
+    {
+      "step": "A wrong client secret",
+      "pattern": "RUN",
+      "detail": "3 refusals in a row, from \"A wrong client secret\" to \"A grant type TikTok does not take\""
+    },
+    {
+      "step": "His stats need a scope he did not grant",
+      "pattern": "RUN",
+      "detail": "3 refusals in a row, from \"His stats need a scope he did not grant\" to \"Maya's post is not his to read\""
+    },
+    {
+      "step": "A field the user object does not have",
+      "pattern": "RUN",
+      "detail": "13 refusals in a row, from \"A field the user object does not have\" to \"An upload URL that names no task\""
+    },
+    {
+      "step": "A chunk with no Content-Range",
+      "pattern": "RUN",
+      "detail": "11 refusals in a row, from \"A chunk with no Content-Range\" to \"A photo post's privacy not among the creator's opt\""
+    },
+    {
+      "step": "A publish_id TikTok never gave",
+      "pattern": "RUN",
+      "detail": "3 refusals in a row, from \"A publish_id TikTok never gave\" to \"A page of more than 20\""
+    },
+    {
+      "step": "A query naming no video",
+      "pattern": "RUN",
+      "detail": "3 refusals in a row, from \"A query naming no video\" to \"Stats for a video TikTok does not have\""
+    },
+    {
+      "step": "A business redirect URL without its trailing slash is refused",
+      "pattern": "RUN",
+      "detail": "6 refusals in a row, from \"A business redirect URL without its trailing slash\" to \"Eleven are too many\""
+    }
+  ],
+  "coverage": {
+    "vendor": "tiktok",
+    "missing": 0,
+    "stale": [],
+    "code": {
+      "lines": 851,
+      "run": 849,
+      "recorded": 2,
+      "missing": 0
+    },
+    "state": {
+      "declared": 6,
+      "reached": 6,
+      "recorded": 0,
+      "missing": [],
+      "undeclared": []
+    },
+    "files": [
+      {
+        "file": "semantics/shared.ts",
+        "lines": {
+          "found": 39,
+          "hit": 39
+        },
+        "missing": []
+      },
+      {
+        "file": "manifest.ts",
+        "lines": {
+          "found": 28,
+          "hit": 28
+        },
+        "missing": []
+      },
+      {
+        "file": "index.ts",
+        "lines": {
+          "found": 10,
+          "hit": 10
+        },
+        "missing": []
+      },
+      {
+        "file": "server.ts",
+        "lines": {
+          "found": 4,
+          "hit": 2
+        },
+        "missing": []
+      },
+      {
+        "file": "fetch.ts",
+        "lines": {
+          "found": 6,
+          "hit": 6
+        },
+        "missing": []
+      },
+      {
+        "file": "../business/src/semantics/states.ts",
+        "lines": {
+          "found": 2,
+          "hit": 2
+        },
+        "missing": []
+      },
+      {
+        "file": "../business/src/semantics/shared.ts",
+        "lines": {
+          "found": 78,
+          "hit": 78
+        },
+        "missing": []
+      },
+      {
+        "file": "../business/src/semantics/open_api.ts",
+        "lines": {
+          "found": 105,
+          "hit": 105
+        },
+        "missing": []
+      },
+      {
+        "file": "../business/src/semantics/index.ts",
+        "lines": {
+          "found": 12,
+          "hit": 12
+        },
+        "missing": []
+      },
+      {
+        "file": "../business/src/manifest.ts",
+        "lines": {
+          "found": 27,
+          "hit": 27
+        },
+        "missing": []
+      },
+      {
+        "file": "../business/src/index.ts",
+        "lines": {
+          "found": 2,
+          "hit": 2
+        },
+        "missing": []
+      },
+      {
+        "file": "../business/src/fetch.ts",
+        "lines": {
+          "found": 10,
+          "hit": 10
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/semantics/doors.ts",
+        "lines": {
+          "found": 81,
+          "hit": 81
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/semantics/oauth.ts",
+        "lines": {
+          "found": 21,
+          "hit": 21
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/semantics/video.ts",
+        "lines": {
+          "found": 76,
+          "hit": 76
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/semantics/states.ts",
+        "lines": {
+          "found": 11,
+          "hit": 11
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/semantics/shared.ts",
+        "lines": {
+          "found": 126,
+          "hit": 126
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/semantics/index.ts",
+        "lines": {
+          "found": 16,
+          "hit": 16
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/semantics/user.ts",
+        "lines": {
+          "found": 18,
+          "hit": 18
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/semantics/post.ts",
+        "lines": {
+          "found": 39,
+          "hit": 39
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/screens/authorize.ts",
+        "lines": {
+          "found": 39,
+          "hit": 39
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/manifest.ts",
+        "lines": {
+          "found": 45,
+          "hit": 45
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/index.ts",
+        "lines": {
+          "found": 2,
+          "hit": 2
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/engine/mp4.ts",
+        "lines": {
+          "found": 40,
+          "hit": 40
+        },
+        "missing": []
+      },
+      {
+        "file": "../open/src/fetch.ts",
+        "lines": {
+          "found": 14,
+          "hit": 14
+        },
+        "missing": []
+      }
+    ]
+  },
+  "examples": {
+    "done": false,
+    "replayed": true,
+    "verdict": "no file",
+    "failures": [],
+    "line": "examples: 0 published, 0 of patch-removed operations, 0 of operations the twin does not serve, 0 replayed, 0 recorded; 0 failing   done: no"
+  },
+  "breadth": {
+    "operations": 23,
+    "handler": 19,
+    "gap": 4
+  }
+}

package/dist/journeys/unreachable.json

@@ -0,0 +1,13 @@
+{
+  "code": [
+    {
+      "file": "server.ts",
+      "declarations": [
+        "createTiktokTwinServer"
+      ],
+      "world": "host-process",
+      "why": "The fixed host-process listener wraps createTiktokFetch (src/server.ts:5-7); the customer and vendor-example walks send every request through that fetch in their World rather than starting the CLI listener (src/cli.ts:17). Its listener creation and port/stop return are host-process work, not a Postiz customer act."
+    }
+  ],
+  "state": []
+}