aimeat 2.4.0 → 2.6.0

package/dist/src/services/connections/providers.d.ts

@@ -0,0 +1,118 @@
+/**
+ * @file providers.ts
+ * @description Registry of OUTBOUND connection providers (TARGET-057) — the services a principal
+ *   can connect their own account at. Mirrors the shape of services/oidc-providers.ts, which is the
+ *   inbound half, and is deliberately a separate registry: signing IN with Google and PUBLISHING to
+ *   a Google account are different directions, different consent and different client credentials.
+ *
+ *   THE CAPABILITY IS OFF UNTIL IT IS CONFIGURED. A provider is `enabled` only when the node has
+ *   what it needs to talk to it. Nothing here fails open, and nothing here half-works: an
+ *   unconfigured provider is absent from discovery and refused at start, with a reason.
+ *
+ *   Two axes decide everything else about a provider, and both were chosen because getting either
+ *   wrong is invisible until the third provider:
+ *     - `credentialShape` — oauth2 | static | session. Designing around oauth2 alone produces a
+ *       store that cannot hold a Bluesky app password.
+ *     - `instanceScoped`  — whether the provider IS one endpoint. Mastodon is not: its client
+ *       credentials are per instance and acquired at runtime (see storage ProviderClient).
+ * @structure
+ *   - OutboundProvider — the descriptor
+ *   - buildOutboundProviders(config) — the enabled list, gated on configuration
+ *   - findProvider(list, id) / listProviderMeta(list) — lookup + the safe public projection
+ * @usage const providers = buildOutboundProviders(config);
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 1b. Mastodon, YouTube, Bluesky.
+ */
+import type { AimeatConfig } from '../../config.js';
+import type { CredentialShape } from '../../models/connection-schemas.js';
+/** Stable provider identifiers. Also the value stored in `Connection.provider`. */
+export type OutboundProviderId = 'mastodon' | 'youtube' | 'bluesky' | 'fake' | 'fake-static';
+/**
+ * What a user must supply for a provider that has NO authorization round.
+ *
+ * Declared here rather than hardcoded in a form so the panel renders whatever a provider needs
+ * without knowing about that provider. A provider with `attachFields: null` uses the OAuth round
+ * instead, and the two paths never overlap.
+ */
+export interface AttachField {
+    name: string;
+    label: string;
+    /** Rendered as a password input, and never echoed back in any response. */
+    secret: boolean;
+    placeholder?: string;
+}
+/** OAuth2 endpoints. Derived from the instance origin for an instance-scoped provider. */
+export interface OAuthEndpoints {
+    authorize: string;
+    token: string;
+    /** Null when the provider offers no revocation endpoint — revoking is then local-only. */
+    revoke: string | null;
+}
+export interface OutboundProvider {
+    id: OutboundProviderId;
+    /** Fallback English label; the SDK lib overrides it from i18n. */
+    label: string;
+    credentialShape: CredentialShape;
+    /**
+     * True when the provider is a FEDERATION rather than one endpoint. Client credentials are then
+     * per instance and acquired at runtime; `client` is null and `endpoints()` needs the instance.
+     */
+    instanceScoped: boolean;
+    /** Config-gated. False = absent from discovery and refused at start, with a reason. */
+    enabled: boolean;
+    /** Why it is disabled, in words an operator can act on. Null when enabled. */
+    disabledReason: string | null;
+    /** Fixed-endpoint client credentials from config. Null for an instance-scoped provider. */
+    client: {
+        id: string;
+        secret: string;
+    } | null;
+    /** Scopes requested at authorize time. Empty for a `static` credential. */
+    scopes: string[];
+    /** Whether to send a PKCE challenge. Always true where the provider supports it. */
+    pkce: boolean;
+    /**
+     * What an app may ASK about a connection at this provider (decision K1). An app never reads the
+     * provider's own scope vocabulary — it cannot know what those names mean — so it asks a question
+     * in AIMEAT's vocabulary and gets a yes or no.
+     */
+    capabilities: string[];
+    /**
+     * The provider's own daily ceiling on publishes, when it has one that is shared rather than
+     * per-user. YouTube's allowance is per Google PROJECT, so ten publishers on one shared channel
+     * close it before lunch unless somebody counts.
+     *
+     * null means "no known shared ceiling", which is the honest value until the real number has been
+     * READ from the provider's console rather than guessed. The counting mechanism does not wait for
+     * it — publish-gate measures usage either way, so the number can be filled in with evidence.
+     */
+    sharedDailyLimit: number | null;
+    /**
+     * Non-null when this provider is connected by SUPPLYING a credential rather than by an
+     * authorization round. Null for an OAuth provider. Advertising a provider without one of the two
+     * is how a "Connect" button appears that cannot work.
+     */
+    attachFields: AttachField[] | null;
+    /** Endpoints. `instance` is required exactly when `instanceScoped` is true. */
+    endpoints(instance: string | null): OAuthEndpoints | null;
+}
+/** What discovery may show. Deliberately free of anything an app could not act on. */
+export interface OutboundProviderMeta {
+    id: OutboundProviderId;
+    label: string;
+    instanceScoped: boolean;
+    credentialShape: CredentialShape;
+    capabilities: string[];
+    attachFields: AttachField[] | null;
+}
+/**
+ * The providers this node offers. Disabled ones are RETURNED rather than filtered, so a route can
+ * answer "why can I not connect YouTube" with the reason instead of a bare absence — an operator
+ * staring at an empty list has nothing to act on.
+ */
+export declare function buildOutboundProviders(config: AimeatConfig): OutboundProvider[];
+/** Lookup by id. Returns disabled providers too; the caller decides what to do about that. */
+export declare function findProvider(providers: OutboundProvider[], id: string): OutboundProvider | undefined;
+/** The public projection for discovery. Enabled providers only, and no credentials in it. */
+export declare function listProviderMeta(providers: OutboundProvider[]): OutboundProviderMeta[];
+//# sourceMappingURL=providers.d.ts.map

package/dist/src/services/connections/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../../src/services/connections/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,aAAa,CAAC;AAE7F;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,kBAAkB,CAAC;IACvB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,eAAe,CAAC;IACjC;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,uFAAuF;IACvF,OAAO,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2FAA2F;IAC3F,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,oFAAoF;IACpF,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;OAIG;IACH,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACnC,+EAA+E;IAC/E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,GAAG,IAAI,CAAC;CAC3D;AAED,sFAAsF;AACtF,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,kBAAkB,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;CACpC;AA6MD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,EAAE,CAa/E;AAED,8FAA8F;AAC9F,wBAAgB,YAAY,CAC1B,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,GACxC,gBAAgB,GAAG,SAAS,CAE9B;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,oBAAoB,EAAE,CAStF"}

package/dist/src/services/connections/providers.js

@@ -0,0 +1,260 @@
+/**
+ * @file providers.ts
+ * @description Registry of OUTBOUND connection providers (TARGET-057) — the services a principal
+ *   can connect their own account at. Mirrors the shape of services/oidc-providers.ts, which is the
+ *   inbound half, and is deliberately a separate registry: signing IN with Google and PUBLISHING to
+ *   a Google account are different directions, different consent and different client credentials.
+ *
+ *   THE CAPABILITY IS OFF UNTIL IT IS CONFIGURED. A provider is `enabled` only when the node has
+ *   what it needs to talk to it. Nothing here fails open, and nothing here half-works: an
+ *   unconfigured provider is absent from discovery and refused at start, with a reason.
+ *
+ *   Two axes decide everything else about a provider, and both were chosen because getting either
+ *   wrong is invisible until the third provider:
+ *     - `credentialShape` — oauth2 | static | session. Designing around oauth2 alone produces a
+ *       store that cannot hold a Bluesky app password.
+ *     - `instanceScoped`  — whether the provider IS one endpoint. Mastodon is not: its client
+ *       credentials are per instance and acquired at runtime (see storage ProviderClient).
+ * @structure
+ *   - OutboundProvider — the descriptor
+ *   - buildOutboundProviders(config) — the enabled list, gated on configuration
+ *   - findProvider(list, id) / listProviderMeta(list) — lookup + the safe public projection
+ * @usage const providers = buildOutboundProviders(config);
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 1b. Mastodon, YouTube, Bluesky.
+ */
+/**
+ * Mastodon. The awkward one, and the reason the store carries an `instance` column at all: the same
+ * handle at two instances is two accounts, and the client credentials are issued per instance by
+ * `POST /api/v1/apps` with no human in the loop. There is nothing to put in .env because nobody
+ * knows which instance the next user arrives from.
+ */
+function mastodon(enabled) {
+    return {
+        id: 'mastodon',
+        label: 'Mastodon',
+        credentialShape: 'oauth2',
+        instanceScoped: true,
+        enabled,
+        disabledReason: enabled ? null : 'connections capability is off (AIMEAT_CONNECTIONS_ENABLED)',
+        client: null,
+        scopes: ['read:accounts', 'write:statuses', 'write:media'],
+        pkce: true,
+        capabilities: ['publish-post', 'publish-video'],
+        attachFields: null,
+        // Instances rate-limit, but there is no single daily publish ceiling to state, and inventing
+        // one would be a guess wearing a number.
+        sharedDailyLimit: null,
+        endpoints(instance) {
+            // The caller validates and normalises `instance` before this is reached; building a URL from
+            // an unvalidated user-supplied host is exactly the SSRF this feature has to not have.
+            if (!instance)
+                return null;
+            return {
+                authorize: `${instance}/oauth/authorize`,
+                token: `${instance}/oauth/token`,
+                revoke: `${instance}/oauth/revoke`,
+            };
+        },
+    };
+}
+/**
+ * YouTube via Google. One endpoint, one client, credentials from config.
+ *
+ * `access_type=offline` + `prompt=consent` are added at authorize time by the OAuth service, not
+ * here: without them Google returns no refresh token at all on a repeat authorization, and the
+ * connection silently becomes a one-hour connection that dies and cannot renew.
+ */
+function youtube(clientId, clientSecret, capabilityOn) {
+    const configured = Boolean(clientId && clientSecret);
+    const enabled = capabilityOn && configured;
+    return {
+        id: 'youtube',
+        label: 'YouTube',
+        credentialShape: 'oauth2',
+        instanceScoped: false,
+        enabled,
+        disabledReason: enabled
+            ? null
+            : !capabilityOn
+                ? 'connections capability is off (AIMEAT_CONNECTIONS_ENABLED)'
+                : 'no client credentials (AIMEAT_CONNECT_GOOGLE_CLIENT_ID / _SECRET)',
+        client: configured ? { id: clientId, secret: clientSecret } : null,
+        // BOTH, and the second one is not optional. `youtube.upload` grants the write and nothing else,
+        // so `channels.list?mine=true` — how the node learns WHICH channel this connection is for —
+        // comes back 403 with a valid token. Asking only for the write and then reading is a
+        // contradiction that shows up at the very last step of a user's first connection attempt.
+        // The channel identity is what the dedupe key and the account label are built from, so this is
+        // the narrowest pair that actually works rather than a convenience.
+        scopes: [
+            'https://www.googleapis.com/auth/youtube.upload',
+            'https://www.googleapis.com/auth/youtube.readonly',
+        ],
+        pkce: true,
+        capabilities: ['publish-video'],
+        attachFields: null,
+        // SIX. Read from the project's own quota page on 2026-08-02, not guessed:
+        //
+        //   Queries per day .......... 10,000   <- the budget, and the one that binds
+        //   Video Uploads per day ....... 100   <- looks like the limit, and is not
+        //
+        // The allowance is spent in UNITS, and one videos.insert costs 1,600 of them, so the budget
+        // runs out after six uploads while the upload counter is still at 6 of 100. Anyone reading that
+        // page would take the 100 and be wrong by a factor of sixteen.
+        //
+        // It is per Google PROJECT, so this is six uploads a day for EVERY publisher on the node
+        // combined — which is exactly why a shared channel needs a per-publisher cap on top.
+        //
+        // The 1,600 is Google's documented per-call cost rather than something measured here. The
+        // measurement is one step away and belongs to the first real upload: the quota page shows
+        // Current usage, so a single publish either moves it by 1,600 or corrects this number. (It
+        // already reads 1 from the channels.list the node makes when an account is connected.)
+        sharedDailyLimit: 6,
+        endpoints() {
+            return {
+                authorize: 'https://accounts.google.com/o/oauth2/v2/auth',
+                token: 'https://oauth2.googleapis.com/token',
+                revoke: 'https://oauth2.googleapis.com/revoke',
+            };
+        },
+    };
+}
+/**
+ * Bluesky. Present in the first slice specifically because it is NOT oauth2-shaped: an app password
+ * exchanged for a session. A store that only ever saw Mastodon and YouTube would be built around
+ * authorization codes, and the mistake would surface at the third provider rather than the first.
+ *
+ * It is also the one place a user copies a secret to us. That is worse than a consent screen and
+ * the connect dialog has to say so plainly.
+ */
+function bluesky(capabilityOn) {
+    return {
+        id: 'bluesky',
+        label: 'Bluesky',
+        // What is STORED is a session, even though what the user supplies is a static app password.
+        // Both are kept: the session is what calls use, and the app password is what lets a dead
+        // session be re-minted without asking the user to go and find it again.
+        credentialShape: 'session',
+        instanceScoped: false,
+        enabled: capabilityOn,
+        disabledReason: capabilityOn ? null : 'connections capability is off (AIMEAT_CONNECTIONS_ENABLED)',
+        // No client credentials at all: the user's app password IS the credential.
+        client: null,
+        scopes: [],
+        pkce: false,
+        // publish-post ONLY, and publish-video is deliberately absent. Video on Bluesky goes through a
+        // separate video service with its own job queue and limits, which is not built. Listing a
+        // capability the recipe cannot perform is the same "advertised but unconnectable" mistake the
+        // attach route was just fixed for, one field over.
+        capabilities: ['publish-post'],
+        sharedDailyLimit: null,
+        // The one provider a user hands us a secret for, so it is the one that needs a form.
+        attachFields: [
+            { name: 'identifier', label: 'Handle', secret: false, placeholder: 'you.bsky.social' },
+            { name: 'password', label: 'App password', secret: true, placeholder: 'xxxx-xxxx-xxxx-xxxx' },
+        ],
+        endpoints() {
+            // Not an OAuth2 flow. The session endpoints live in the attach recipe, not here.
+            return null;
+        },
+    };
+}
+/**
+ * A stand-in provider for the end-to-end tests. Present ONLY when a base URL is configured, which
+ * nothing but the E2E environment does, so it cannot appear on a real node.
+ *
+ * It exists because the alternative is mocking the connection service, and a mocked service proves
+ * the mock. Against a real HTTP server the tests drive the actual code path: state, PKCE, the token
+ * exchange, the identity lookup, a ROTATING refresh token and revocation. The rotation is the point
+ * — it is the provider behaviour that makes concurrent refresh destructive, and it cannot be
+ * demonstrated against a stub that always returns the same token.
+ */
+function fake(baseUrl, capabilityOn) {
+    const enabled = capabilityOn && Boolean(baseUrl);
+    return {
+        id: 'fake',
+        label: 'Test provider',
+        credentialShape: 'oauth2',
+        instanceScoped: false,
+        enabled,
+        disabledReason: enabled ? null : 'no AIMEAT_CONNECT_FAKE_BASE_URL (this provider is test-only)',
+        client: baseUrl ? { id: 'fake-client', secret: 'fake-secret' } : null,
+        scopes: ['publish'],
+        pkce: true,
+        capabilities: ['publish-video', 'publish-post'],
+        sharedDailyLimit: null,
+        attachFields: null,
+        endpoints() {
+            if (!baseUrl)
+                return null;
+            return {
+                authorize: `${baseUrl}/authorize`,
+                token: `${baseUrl}/token`,
+                revoke: `${baseUrl}/revoke`,
+            };
+        },
+    };
+}
+/**
+ * The session-shaped test provider. Exists for the same reason `fake` does, one axis over: the
+ * supplied-credential path (no authorization round, a session minted from a secret the user hands
+ * over, and a refresh that is not OAuth2) has to be provable without a real Bluesky account.
+ *
+ * Without it, "attach" would ship tested only against the one provider nobody on this node has.
+ */
+function fakeStatic(baseUrl, capabilityOn) {
+    const enabled = capabilityOn && Boolean(baseUrl);
+    return {
+        id: 'fake-static',
+        label: 'Test provider (supplied credential)',
+        credentialShape: 'session',
+        instanceScoped: false,
+        enabled,
+        disabledReason: enabled ? null : 'no AIMEAT_CONNECT_FAKE_BASE_URL (this provider is test-only)',
+        client: null,
+        scopes: [],
+        pkce: false,
+        capabilities: ['publish-post'],
+        sharedDailyLimit: null,
+        attachFields: [
+            { name: 'identifier', label: 'Handle', secret: false, placeholder: 'someone' },
+            { name: 'password', label: 'Secret', secret: true },
+        ],
+        endpoints() { return null; },
+    };
+}
+/**
+ * The providers this node offers. Disabled ones are RETURNED rather than filtered, so a route can
+ * answer "why can I not connect YouTube" with the reason instead of a bare absence — an operator
+ * staring at an empty list has nothing to act on.
+ */
+export function buildOutboundProviders(config) {
+    const on = config.connectionsEnabled;
+    const list = [
+        mastodon(on),
+        youtube(config.connectGoogleClientId, config.connectGoogleClientSecret, on),
+        bluesky(on),
+    ];
+    // Appended only when configured, so a production node's list is exactly the three above.
+    if (config.connectFakeBaseUrl) {
+        list.push(fake(config.connectFakeBaseUrl, on));
+        list.push(fakeStatic(config.connectFakeBaseUrl, on));
+    }
+    return list;
+}
+/** Lookup by id. Returns disabled providers too; the caller decides what to do about that. */
+export function findProvider(providers, id) {
+    return providers.find((p) => p.id === id);
+}
+/** The public projection for discovery. Enabled providers only, and no credentials in it. */
+export function listProviderMeta(providers) {
+    return providers.filter((p) => p.enabled).map((p) => ({
+        id: p.id,
+        label: p.label,
+        instanceScoped: p.instanceScoped,
+        credentialShape: p.credentialShape,
+        capabilities: p.capabilities,
+        attachFields: p.attachFields,
+    }));
+}
+//# sourceMappingURL=providers.js.map

package/dist/src/services/connections/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../../../src/services/connections/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAuFH;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,OAAgB;IAChC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,eAAe,EAAE,QAAQ;QACzB,cAAc,EAAE,IAAI;QACpB,OAAO;QACP,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,4DAA4D;QAC7F,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,aAAa,CAAC;QAC1D,IAAI,EAAE,IAAI;QACV,YAAY,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;QAC/C,YAAY,EAAE,IAAI;QAClB,6FAA6F;QAC7F,yCAAyC;QACzC,gBAAgB,EAAE,IAAI;QACtB,SAAS,CAAC,QAAQ;YAChB,6FAA6F;YAC7F,sFAAsF;YACtF,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,OAAO;gBACL,SAAS,EAAE,GAAG,QAAQ,kBAAkB;gBACxC,KAAK,EAAE,GAAG,QAAQ,cAAc;gBAChC,MAAM,EAAE,GAAG,QAAQ,eAAe;aACnC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,QAAgB,EAAE,YAAoB,EAAE,YAAqB;IAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,YAAY,IAAI,UAAU,CAAC;IAC3C,OAAO;QACL,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,eAAe,EAAE,QAAQ;QACzB,cAAc,EAAE,KAAK;QACrB,OAAO;QACP,cAAc,EAAE,OAAO;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,YAAY;gBACb,CAAC,CAAC,4DAA4D;gBAC9D,CAAC,CAAC,mEAAmE;QACzE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI;QAClE,gGAAgG;QAChG,4FAA4F;QAC5F,qFAAqF;QACrF,0FAA0F;QAC1F,+FAA+F;QAC/F,oEAAoE;QACpE,MAAM,EAAE;YACN,gDAAgD;YAChD,kDAAkD;SACnD;QACD,IAAI,EAAE,IAAI;QACV,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,YAAY,EAAE,IAAI;QAClB,0EAA0E;QAC1E,EAAE;QACF,8EAA8E;QAC9E,4EAA4E;QAC5E,EAAE;QACF,4FAA4F;QAC5F,gGAAgG;QAChG,+DAA+D;QAC/D,EAAE;QACF,yFAAyF;QACzF,qFAAqF;QACrF,EAAE;QACF,0FAA0F;QAC1F,0FAA0F;QAC1F,2FAA2F;QAC3F,uFAAuF;QACvF,gBAAgB,EAAE,CAAC;QACnB,SAAS;YACP,OAAO;gBACL,SAAS,EAAE,8CAA8C;gBACzD,KAAK,EAAE,qCAAqC;gBAC5C,MAAM,EAAE,sCAAsC;aAC/C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CAAC,YAAqB;IACpC,OAAO;QACL,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,4FAA4F;QAC5F,yFAAyF;QACzF,wEAAwE;QACxE,eAAe,EAAE,SAAS;QAC1B,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE,YAAY;QACrB,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,4DAA4D;QAClG,2EAA2E;QAC3E,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,+FAA+F;QAC/F,0FAA0F;QAC1F,8FAA8F;QAC9F,mDAAmD;QACnD,YAAY,EAAE,CAAC,cAAc,CAAC;QAC9B,gBAAgB,EAAE,IAAI;QACtB,qFAAqF;QACrF,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE;YACtF,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,qBAAqB,EAAE;SAC9F;QACD,SAAS;YACP,iFAAiF;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,IAAI,CAAC,OAAe,EAAE,YAAqB;IAClD,MAAM,OAAO,GAAG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO;QACL,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,eAAe;QACtB,eAAe,EAAE,QAAQ;QACzB,cAAc,EAAE,KAAK;QACrB,OAAO;QACP,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,8DAA8D;QAC/F,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI;QACrE,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,IAAI,EAAE,IAAI;QACV,YAAY,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC;QAC/C,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,IAAI;QAClB,SAAS;YACP,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO;gBACL,SAAS,EAAE,GAAG,OAAO,YAAY;gBACjC,KAAK,EAAE,GAAG,OAAO,QAAQ;gBACzB,MAAM,EAAE,GAAG,OAAO,SAAS;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,YAAqB;IACxD,MAAM,OAAO,GAAG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,qCAAqC;QAC5C,eAAe,EAAE,SAAS;QAC1B,cAAc,EAAE,KAAK;QACrB,OAAO;QACP,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,8DAA8D;QAC/F,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,YAAY,EAAE,CAAC,cAAc,CAAC;QAC9B,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE;YAC9E,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;SACpD;QACD,SAAS,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAoB;IACzD,MAAM,EAAE,GAAG,MAAM,CAAC,kBAAkB,CAAC;IACrC,MAAM,IAAI,GAAG;QACX,QAAQ,CAAC,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,EAAE,EAAE,CAAC;QAC3E,OAAO,CAAC,EAAE,CAAC;KACZ,CAAC;IACF,yFAAyF;IACzF,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAC1B,SAA6B,EAAE,EAAU;IAEzC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,SAA6B;IAC5D,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,YAAY,EAAE,CAAC,CAAC,YAAY;KAC7B,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/src/services/connections/publish-gate.d.ts

@@ -0,0 +1,103 @@
+/**
+ * @file publish-gate.ts
+ * @description Everything that must be true before a publish leaves the node (TARGET-057), in one
+ *   place so a caller cannot satisfy three of the four checks.
+ *
+ *   THE ORDER IS THE POINT. The attempt is recorded BEFORE it is tried. A retry that races a slow
+ *   success publishes the video twice, and this repository has produced that family of bug three
+ *   times. The idempotency key is deterministic, so a retry recomputes it without having to remember
+ *   anything, and the store's unique index arbitrates.
+ *
+ *   AN APP CALLS A DELEGATION, NEVER A CONNECTION. What the app sends is merged UNDER the
+ *   delegation's fixed parameters, so it cannot retarget the channel, the visibility or the
+ *   playlist. Merging the other way round would turn a narrow errand into a power of attorney, and
+ *   it is one character of difference in the spread.
+ *
+ *   A FULL QUOTA IS NOT A FAILURE. It queues, with a reason. So does moderation. Reporting either as
+ *   an error teaches an app to retry, which is the one response that makes both worse.
+ * @structure buildIdempotencyKey · openPublish · quotaStatus
+ * @usage import { openPublish } from './publish-gate.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 1d.
+ */
+import type { Storage } from '../../storage/interface.js';
+import type { ConnectionRecord, DelegationRecord, PublishAttempt } from '../../models/connection-schemas.js';
+export interface PublishRequest {
+    /** WHO is publishing. In shared mode the app's user, not the connection's principal. */
+    publisher: string;
+    appId: string;
+    action: string;
+    storageKey: string;
+    /** Free text the app chose. Part of the idempotency key: a different caption is a different post. */
+    caption: string;
+    /** What the app asked for. Merged UNDER the delegation's fixed parameters. */
+    params?: Record<string, unknown>;
+}
+export type OpenPublishResult = {
+    ok: true;
+    /** True when this call did NOT open new work — the key already existed. */
+    replay: boolean;
+    attempt: PublishAttempt;
+    connection: ConnectionRecord;
+    delegation: DelegationRecord;
+    /** The app's params with the delegation's fixed ones layered on top. */
+    params: Record<string, unknown>;
+} | {
+    ok: false;
+    code: string;
+    reason: string;
+};
+/**
+ * Deterministic over the things that make one publish a DIFFERENT publish. A retry of the same
+ * request recomputes the same key with nothing carried between attempts, which is what lets an
+ * interrupted caller be honest about not knowing whether the first try landed.
+ */
+export declare function buildIdempotencyKey(publisher: string, connectionId: string, storageKey: string, caption: string): string;
+/**
+ * Run every gate and open the attempt.
+ *
+ * The caller performs no check of its own afterwards: if this returns ok it has already decided the
+ * publisher is allowed, the delegation is live, the connection is usable, the caps are not spent and
+ * the attempt is recorded. Splitting these across caller and service is how one of them gets skipped.
+ */
+export declare function openPublish(storage: Storage, req: PublishRequest, opts: {
+    sharedDailyLimit: number | null;
+}): Promise<OpenPublishResult>;
+/**
+ * Open a publish to the caller's OWN connection — no delegation involved.
+ *
+ * The gate above is built around a delegation because that is where the interesting constraints
+ * live, and it left the ordinary case with no path at all: publishing to an account you connected
+ * yourself. There is nobody to delegate to and no per-publisher cap to apply, because the publisher
+ * and the account holder are the same person.
+ *
+ * What still applies, and is the reason this is not just a direct call to the recipe:
+ *   - the connection must be usable, and `needs_reauth` must say so before anything is uploaded
+ *   - the provider's SHARED ceiling is per project, so a personal publish spends the same allowance
+ *     a shared channel does and has to be counted against it
+ *   - the attempt is recorded BEFORE it is tried, for exactly the same reason
+ */
+export declare function openOwnPublish(storage: Storage, req: Omit<PublishRequest, 'appId' | 'action'> & {
+    connectionId: string;
+}, opts: {
+    sharedDailyLimit: number | null;
+}): Promise<OpenPublishResult | {
+    ok: false;
+    code: string;
+    reason: string;
+}>;
+/** What the owner's panel shows about a shared channel's allowance. */
+export interface QuotaStatus {
+    limit: number | null;
+    usedInWindow: number;
+    remaining: number | null;
+    windowHours: number;
+}
+/**
+ * How much of the shared allowance is left.
+ *
+ * Read separately from the gate so the owner can see it BEFORE anything is refused. A ceiling a
+ * person only meets by hitting it is indistinguishable from a broken feature.
+ */
+export declare function quotaStatus(storage: Storage, delegationId: string, sharedDailyLimit: number | null): Promise<QuotaStatus>;
+//# sourceMappingURL=publish-gate.d.ts.map

package/dist/src/services/connections/publish-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-gate.d.ts","sourceRoot":"","sources":["../../../../src/services/connections/publish-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,KAAK,EACV,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EACnD,MAAM,oCAAoC,CAAC;AAK5C,MAAM,WAAW,cAAc;IAC7B,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,iBAAiB,GACzB;IACA,EAAE,EAAE,IAAI,CAAC;IACT,2EAA2E;IAC3E,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,GACC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAC3E,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxC,OAAO,CAAC,iBAAiB,CAAC,CA+F5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,EACxE,IAAI,EAAE;IAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxC,OAAO,CAAC,iBAAiB,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAoD1E;AAED,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,GACtE,OAAO,CAAC,WAAW,CAAC,CAatB"}

package/dist/src/services/connections/publish-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-gate.js","sourceRoot":"","sources":["../../../../src/services/connections/publish-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMrD,sFAAsF;AACtF,MAAM,mBAAmB,GAAG,EAAE,CAAC;AA2B/B;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EAAE,YAAoB,EAAE,UAAkB,EAAE,OAAe;IAE5E,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAChE,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,GAAmB,EACnB,IAAyC;IAEzC,iGAAiG;IACjG,iGAAiG;IACjG,4CAA4C;IAC5C,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACpG,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,kDAAkD;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnC,gGAAgG;QAChG,4DAA4D;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB;YACzC,MAAM,EAAE,oFAAoF;SAC7F,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,+FAA+F;IAC/F,gEAAgE;IAChE,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,YAAY,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAClG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC;YAC9C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,0FAA0F;YAC1F,+EAA+E;YAC/E,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;YAC/C,KAAK;SACN,CAAC,CAAC;QACH,IAAI,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO;gBACL,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB;gBACrC,MAAM,EAAE,sBAAsB,UAAU,CAAC,YAAY,CAAC,KAAK,iBAAiB,UAAU,CAAC,YAAY,CAAC,WAAW,QAAQ;aACxH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,mGAAmG;IACnG,kGAAkG;IAClG,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAClF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC;YACpD,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;YAC/C,KAAK;SACN,CAAC,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,CAAC,gBAAgB;YAAE,MAAM,GAAG,IAAI,CAAC;IACzD,CAAC;IAED,MAAM,cAAc,GAAG,mBAAmB,CACxC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAC1D,CAAC;IACF,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;IAE3F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/C,EAAE,EAAE,IAAI;QACR,cAAc;QACd,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,MAAM;KACP,CAAC,CAAC;IAEH,8FAA8F;IAC9F,8FAA8F;IAC9F,6CAA6C;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC;IAEnC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,OAAO;QACP,UAAU;QACV,UAAU;QACV,4EAA4E;QAC5E,MAAM,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,GAAwE,EACxE,IAAyC;IAEzC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACpG,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjE,+EAA+E;IAC/E,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB;YACzC,MAAM,EAAE,uEAAuE;SAChF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACnC,+FAA+F;QAC/F,8EAA8E;QAC9E,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAClF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC;YAC9C,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;YAC/C,KAAK;SACN,CAAC,CAAC;QACH,IAAI,IAAI,IAAI,IAAI,CAAC,gBAAgB;YAAE,MAAM,GAAG,IAAI,CAAC;IACnD,CAAC;IAED,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC;QAC/C,EAAE,EAAE,IAAI;QACR,cAAc;QACd,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,qEAAqE;QACrE,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;KACxC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,IAAI;QAC3B,OAAO;QACP,UAAU;QACV,8FAA8F;QAC9F,uCAAuC;QACvC,UAAU,EAAE,IAAmC;QAC/C,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;KACzB,CAAC;AACJ,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAAE,YAAoB,EAAE,gBAA+B;IAEvE,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAClF,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC;QACtD,YAAY;QACZ,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC/C,KAAK;KACN,CAAC,CAAC;IACH,OAAO;QACL,KAAK,EAAE,gBAAgB;QACvB,YAAY;QACZ,SAAS,EAAE,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,YAAY,CAAC;QAC1F,WAAW,EAAE,mBAAmB;KACjC,CAAC;AACJ,CAAC"}

package/dist/src/services/connections/publish.d.ts

@@ -0,0 +1,60 @@
+/**
+ * @file publish.ts
+ * @description The recipes that actually put something on a provider (TARGET-057 phase 7b). One
+ *   function per provider, behind one interface, driven by the gate in publish-gate.ts.
+ *
+ *   WHERE THIS LIVES, AND A DELIBERATE DEVIATION FROM THE SPEC. doc-t057-connect-spec puts recipes
+ *   in an extension so a provider's endpoints can change without a node deploy. That reason is
+ *   real and it still holds. It is not done yet, because the extension path needs two things that
+ *   do not exist — a `ctx.connection()` binding into the sandbox and a streaming upload that keeps
+ *   the bytes out of QuickJS — and building both before a single publish has ever succeeded would
+ *   be designing the seam before knowing its shape. The house rule applies: a primitive is
+ *   extracted when it has a second consumer, not before. `PublishRecipe` below is the seam, kept
+ *   deliberately narrow so the move is a relocation rather than a redesign.
+ *
+ *   PERMANENT AND TEMPORARY ARE DIFFERENT ANSWERS. A provider refusing the CONTENT is final and
+ *   must never be retried; a provider being unreachable is not. Collapsing the two is how a
+ *   rejected video gets resubmitted forever, and how an outage looks like a rejection.
+ * @structure PublishRecipe · publishToProvider · mastodonPublish · blueskyPost · youtubeUpload
+ * @usage import { publishToProvider } from './publish.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 phase 7b. Mastodon video, Bluesky text, YouTube resumable.
+ */
+import type { ConnectionCredential, ConnectionRecord } from '../../models/connection-schemas.js';
+import type { OutboundProvider } from './providers.js';
+/** What a recipe is handed. `params` already has the delegation's fixed values layered on top. */
+export interface PublishInput {
+    /** The provider descriptor, so a recipe reads its own endpoints instead of being handed them. */
+    provider: OutboundProvider;
+    connection: ConnectionRecord;
+    credential: ConnectionCredential;
+    caption: string;
+    params: Record<string, unknown>;
+    file: {
+        bytes: Buffer;
+        mimeType: string;
+        name: string;
+    } | null;
+}
+export type PublishOutcome = {
+    ok: true;
+    externalRef: string;
+} | {
+    ok: false;
+    /**
+     * True when the provider refused the CONTENT or the grant — retrying changes nothing and the
+     * owner has to act. False for anything transport-shaped, which is worth another attempt.
+     */
+    permanent: boolean;
+    reason: string;
+};
+export type PublishRecipe = (input: PublishInput) => Promise<PublishOutcome>;
+/**
+ * Run the recipe for a connection's provider.
+ *
+ * A provider with no recipe is a refusal rather than a silent no-op: the gate has already recorded
+ * an attempt by the time this is called, and leaving it in flight forever would be worse than
+ * saying so.
+ */
+export declare function publishToProvider(input: PublishInput): Promise<PublishOutcome>;
+//# sourceMappingURL=publish.d.ts.map

package/dist/src/services/connections/publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../../../src/services/connections/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACjG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,UAAU,EAAE,oBAAoB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAChE;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjC;IACA,EAAE,EAAE,KAAK,CAAC;IACV;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEJ,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AA4S7E;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAMpF"}