nyaucast 0.0.0-stage → 0.0.2

package/README.md

@@ -1,3 +1,35 @@
-# Temporary Holding Version
+# nyaucast
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+YouTube チャンネル運営を自動化するツールキット。agent (Claude Code / Codex) が直接呼べる型付き MCP tool として、チャンネル運営のワークフロー知識を提供する。
+
+- 用語集: [CONTEXT.md](https://github.com/daiki-beppu/nyaucast/blob/main/CONTEXT.md)
+- アーキテクチャ規約: [docs/adr/0001-thin-architecture.md](https://github.com/daiki-beppu/nyaucast/blob/main/docs/adr/0001-thin-architecture.md)
+- 出自: [00-automation ADR-0021](https://github.com/daiki-beppu/youtube-automation/blob/main/docs/adr/0021-separate-repo-restart.md)（Python 版からの転換の経緯）
+
+## Setup
+
+前提: [Node](https://nodejs.org)（ホスト供給。開発・CI の版線は `package.json` の `devEngines.runtime` が定める）と pnpm v12 native binary。pnpm の版は `packageManager` の exact pin が定める。旧 pnpm からの自動切替は使わないため、既存環境はリポジトリ外で一度だけ pin 版へ更新する（pnpm 未導入なら[公式のインストール手順](https://pnpm.io/installation)を使う）。
+
+```bash
+pnpm_version=$(node -p 'require("./package.json").packageManager.split("@").at(-1)')
+(cd /tmp && pnpm self-update "$pnpm_version")
+pnpm --version   # packageManager の pin と一致すること
+vp install       # 依存導入（初回と worktree 作成後。lockfile 検出で pnpm へ委譲）
+pnpm run check   # 全ゲートを実行
+```
+
+lockfile と `package.json` の乖離は check の最初のゲートが検出する。
+
+全ゲートの入口は `pnpm run check`。ゲートの構成は `package.json` の `check` script だけが定義する。
+
+## Status
+
+v0.1.0 に向けて開発中。ゲートは first-party チャンネルでの dogfood 完走（collection フルライフサイクル 1 周）。Python 版 (`youtube-channels-automation`) は nyaucast が実運用カバレッジに達するまでメンテナンスモードで維持される。
+
+## 旧称 tayk からの移行
+
+旧称 tayk の設定を使っている場合は、次のコマンドで設定ディレクトリを移す。
+
+```sh
+mv ~/.config/tayk ~/.config/nyaucast
+```

package/bin/nyaucast.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+
+import "#nyaucast-entry";

package/dist/channel-registry/schema.js

@@ -0,0 +1,3 @@
+import { isAbsolute } from "node:path";
+import { z } from "zod";
+export const channelRegistrySchema = z.array(z.string().refine((path) => isAbsolute(path), "channel paths must be absolute"));

package/dist/collections/directories.js

@@ -0,0 +1,37 @@
+import { mkdir, rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+function relativeCollectionDirectory(id) {
+    return `collections/${id}`;
+}
+function isNotFound(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+async function createDirectory(root, id) {
+    await mkdir(root, { recursive: true });
+    await mkdir(join(root, id), { recursive: false });
+    return relativeCollectionDirectory(id);
+}
+export function createCollectionDirectories(channelRoot) {
+    const root = join(channelRoot, "collections");
+    return {
+        create: async (id) => {
+            return createDirectory(root, id);
+        },
+        exists: async (id) => {
+            try {
+                await stat(join(root, id));
+                return true;
+            }
+            catch (error) {
+                if (isNotFound(error)) {
+                    return false;
+                }
+                throw error;
+            }
+        },
+        recreate: async (id) => {
+            await rm(join(root, id), { force: true, recursive: true });
+            return createDirectory(root, id);
+        },
+    };
+}

package/dist/collections/gate-operations.js

@@ -0,0 +1,28 @@
+import { createCollectionStore } from "../db/collections.js";
+import { getGateState, recordApproval, recordRejection } from "../db/gates.js";
+async function assertCollectionExists(store, collectionId) {
+    const collection = await createCollectionStore(store).findById(collectionId);
+    if (collection === undefined) {
+        throw new Error(`collection does not exist: ${collectionId}`);
+    }
+}
+function clockAfterLatestFact(clock, latestTimestamp) {
+    const proposedTimestamp = clock.now();
+    if (latestTimestamp === undefined || proposedTimestamp.toISOString() > latestTimestamp) {
+        return { now: () => proposedTimestamp };
+    }
+    return { now: () => new Date(new Date(latestTimestamp).getTime() + 1) };
+}
+function createGateOperation(decision, recordDecision) {
+    return async (store, input, clock) => {
+        await assertCollectionExists(store, input.collectionId);
+        const state = await getGateState(store, input.collectionId, input.gate);
+        const recorded = state.decision !== decision;
+        if (recorded) {
+            await recordDecision(store, input, clockAfterLatestFact(clock, state.latestTimestamp));
+        }
+        return { ...input, recorded };
+    };
+}
+export const approveCollectionGate = createGateOperation("approved", recordApproval);
+export const rejectCollectionGate = createGateOperation("rejected", recordRejection);

package/dist/db/collections.js

@@ -0,0 +1,45 @@
+import { eq } from "drizzle-orm";
+import { approvals, collections, rejections, thumbnails } from "./schema.js";
+async function findCollection(store, condition) {
+    const rows = await store.db.select().from(collections).where(condition).limit(1);
+    return rows[0];
+}
+export async function hasThumbnail(store, collectionId) {
+    const rows = await store.db
+        .select({ present: thumbnails.collectionId })
+        .from(thumbnails)
+        .where(eq(thumbnails.collectionId, collectionId))
+        .limit(1);
+    return rows.length > 0;
+}
+export function createCollectionStore(store) {
+    return {
+        create: async (collection) => {
+            await store.db.insert(collections).values(collection);
+        },
+        findById: (id) => findCollection(store, eq(collections.id, id)),
+        findByTitle: (title) => findCollection(store, eq(collections.title, title)),
+        hasDownstreamRecords: async (id) => {
+            const [thumbnail, approval, rejection] = await Promise.all([
+                hasThumbnail(store, id),
+                store.db
+                    .select({ present: approvals.collectionId })
+                    .from(approvals)
+                    .where(eq(approvals.collectionId, id))
+                    .limit(1),
+                store.db
+                    .select({ present: rejections.collectionId })
+                    .from(rejections)
+                    .where(eq(rejections.collectionId, id))
+                    .limit(1),
+            ]);
+            return thumbnail || approval.length > 0 || rejection.length > 0;
+        },
+        recreate: async (collection) => {
+            await store.db.transaction(async (transaction) => {
+                await transaction.delete(collections).where(eq(collections.id, collection.id));
+                await transaction.insert(collections).values(collection);
+            });
+        },
+    };
+}

package/dist/db/gates.js

@@ -0,0 +1,65 @@
+import { z } from "zod";
+import { approvals, rejections } from "./schema.js";
+const gateSchema = z.enum(["produce", "publish"]);
+export function parseGate(value) {
+    return gateSchema.parse(value);
+}
+async function latestTimestamp(store, collectionId, gate, decision) {
+    const query = decision === "approval"
+        ? "SELECT approved_at AS timestamp FROM approvals WHERE collection_id = ? AND gate = ? ORDER BY approved_at DESC LIMIT 1"
+        : "SELECT rejected_at AS timestamp FROM rejections WHERE collection_id = ? AND gate = ? ORDER BY rejected_at DESC LIMIT 1";
+    const result = await store.client.execute({ args: [collectionId, gate], sql: query });
+    const timestamp = result.rows[0]?.["timestamp"];
+    return typeof timestamp === "string" ? timestamp : undefined;
+}
+function decideGate(latestApproval, latestRejection) {
+    if (latestRejection === undefined) {
+        return latestApproval === undefined ? "pending" : "approved";
+    }
+    return latestApproval !== undefined && latestApproval > latestRejection ? "approved" : "rejected";
+}
+function latestGateTimestamp(latestApproval, latestRejection) {
+    if (latestApproval === undefined) {
+        return latestRejection;
+    }
+    if (latestRejection === undefined || latestApproval >= latestRejection) {
+        return latestApproval;
+    }
+    return latestRejection;
+}
+export async function getGateState(store, collectionId, gate) {
+    const [latestApproval, latestRejection] = await Promise.all([
+        latestTimestamp(store, collectionId, gate, "approval"),
+        latestTimestamp(store, collectionId, gate, "rejection"),
+    ]);
+    return {
+        decision: decideGate(latestApproval, latestRejection),
+        latestTimestamp: latestGateTimestamp(latestApproval, latestRejection),
+    };
+}
+export async function getGateDecision(store, collectionId, gate) {
+    return (await getGateState(store, collectionId, gate)).decision;
+}
+async function recordGateFact(store, fact, clock, decision) {
+    const gate = parseGate(fact.gate);
+    const timestamp = clock.now().toISOString();
+    if (decision === "approval") {
+        await store.db.insert(approvals).values({
+            approvedAt: timestamp,
+            collectionId: fact.collectionId,
+            gate,
+        });
+        return;
+    }
+    await store.db.insert(rejections).values({
+        collectionId: fact.collectionId,
+        gate,
+        rejectedAt: timestamp,
+    });
+}
+export async function recordApproval(store, fact, clock) {
+    await recordGateFact(store, fact, clock, "approval");
+}
+export async function recordRejection(store, fact, clock) {
+    await recordGateFact(store, fact, clock, "rejection");
+}

package/dist/db/local-store.js

@@ -0,0 +1,44 @@
+import { copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { createClient } from "@libsql/client";
+import { drizzle } from "drizzle-orm/libsql";
+import { migrate } from "drizzle-orm/libsql/migrator";
+import { readMigrationFiles } from "drizzle-orm/migrator";
+import * as schema from "./schema.js";
+const migrationsFolder = resolve(import.meta.dirname, "../../drizzle");
+async function hasPendingMigrations(client) {
+    const migrations = readMigrationFiles({ migrationsFolder });
+    const latestMigration = migrations.at(-1);
+    if (latestMigration === undefined) {
+        return false;
+    }
+    const table = await client.execute("SELECT name FROM sqlite_master WHERE type = 'table' AND name = '__drizzle_migrations'");
+    if (table.rows.length === 0) {
+        return true;
+    }
+    const applied = await client.execute("SELECT created_at FROM __drizzle_migrations ORDER BY created_at DESC LIMIT 1");
+    const latestApplied = applied.rows[0]?.["created_at"];
+    return typeof latestApplied !== "number" || latestApplied < latestMigration.folderMillis;
+}
+export async function openLocalStore(channelRoot) {
+    const dataDirectory = join(channelRoot, "data");
+    const databasePath = join(dataDirectory, "local.db");
+    mkdirSync(dataDirectory, { recursive: true });
+    const existed = existsSync(databasePath);
+    const client = createClient({ url: pathToFileURL(databasePath).href });
+    const db = drizzle(client, { schema });
+    if (existed && (await hasPendingMigrations(client))) {
+        const latestVersion = readMigrationFiles({ migrationsFolder }).at(-1)?.folderMillis;
+        if (latestVersion === undefined) {
+            throw new Error("pending migration has no version");
+        }
+        copyFileSync(databasePath, `${databasePath}.bak-${latestVersion}`);
+    }
+    await migrate(db, { migrationsFolder });
+    return {
+        client,
+        close: async () => client.close(),
+        db,
+    };
+}

package/dist/db/read-model.js

@@ -0,0 +1,36 @@
+import { createCollectionStore, hasThumbnail } from "./collections.js";
+import { getGateDecision } from "./gates.js";
+function progressFromFacts(produce, publish, hasThumbnail) {
+    if ([produce, publish].includes("rejected")) {
+        return { terminated: true };
+    }
+    if (produce === "pending") {
+        return { awaitingApproval: "produce", terminated: false };
+    }
+    if (!hasThumbnail) {
+        return { terminated: false };
+    }
+    if (publish === "pending") {
+        return { awaitingApproval: "publish", terminated: false };
+    }
+    return { terminated: false };
+}
+export async function deriveCollectionStatus(store, collectionId) {
+    const collection = await createCollectionStore(store).findById(collectionId);
+    if (collection === undefined) {
+        throw new Error("collection does not exist");
+    }
+    const [produce, publish, thumbnailExists] = await Promise.all([
+        getGateDecision(store, collectionId, "produce"),
+        getGateDecision(store, collectionId, "publish"),
+        hasThumbnail(store, collectionId),
+    ]);
+    return {
+        collectionId,
+        gates: { produce, publish },
+        progress: progressFromFacts(produce, publish, thumbnailExists),
+    };
+}
+export async function deriveCollectionProgress(store, collectionId) {
+    return (await deriveCollectionStatus(store, collectionId)).progress;
+}

package/dist/db/schema.js

@@ -0,0 +1,27 @@
+import { sql } from "drizzle-orm";
+import { check, sqliteTable, text } from "drizzle-orm/sqlite-core";
+export const collections = sqliteTable("collections", {
+    id: text().primaryKey(),
+    title: text().notNull().unique(),
+});
+export const thumbnails = sqliteTable("thumbnails", {
+    collectionId: text("collection_id")
+        .primaryKey()
+        .references(() => collections.id),
+    path: text().notNull(),
+    createdAt: text("created_at").notNull(),
+});
+export const approvals = sqliteTable("approvals", {
+    collectionId: text("collection_id")
+        .notNull()
+        .references(() => collections.id),
+    gate: text().notNull(),
+    approvedAt: text("approved_at").notNull(),
+}, (table) => [check("approvals_gate", sql `${table.gate} IN ('produce', 'publish')`)]);
+export const rejections = sqliteTable("rejections", {
+    collectionId: text("collection_id")
+        .notNull()
+        .references(() => collections.id),
+    gate: text().notNull(),
+    rejectedAt: text("rejected_at").notNull(),
+}, (table) => [check("rejections_gate", sql `${table.gate} IN ('produce', 'publish')`)]);

package/dist/index.js

@@ -0,0 +1,99 @@
+import { randomUUID } from "node:crypto";
+import { createCollectionDirectories } from "./collections/directories.js";
+import { approveCollectionGate, rejectCollectionGate } from "./collections/gate-operations.js";
+import { createCollectionStore } from "./db/collections.js";
+import { parseGate } from "./db/gates.js";
+import { openLocalStore } from "./db/local-store.js";
+import { deriveCollectionStatus } from "./db/read-model.js";
+import { serveMcp } from "./mcp.js";
+import { createCollectionStatusTool } from "./tools/collection.status.js";
+import { createPlanCheckTitleTool } from "./tools/plan.checkTitle.js";
+import { createPlanInitTool } from "./tools/plan.init.js";
+import { createProductionYouTubeAuth } from "./youtube/auth.js";
+const systemClock = { now: () => new Date() };
+function requireArguments(arguments_, expected, usage) {
+    if (arguments_.length !== expected) {
+        throw new Error(`usage: ${usage}`);
+    }
+}
+function gateOperationMessage(collectionId, gate, recorded, decision) {
+    if (!recorded) {
+        return decision === "approval"
+            ? `既に承認済みです: collection ${collectionId} / gate=${gate}（記録は追加していません）\n`
+            : `既に NO-GO 済みです: collection ${collectionId} / gate=${gate}（記録は追加していません）\n`;
+    }
+    if (decision === "approval") {
+        return (`承認を記録しました: collection ${collectionId} / gate=${gate}\n` +
+            `Claude Code で collection ${collectionId} の ${gate} 区間を実行してください。\n`);
+    }
+    return (`NO-GO を記録しました: collection ${collectionId} / gate=${gate}\n` +
+        `この collection は ${gate} ゲートで停止します。判断を覆して先へ進める場合は\n` +
+        `nyaucast collection ${gate} ${collectionId} を実行してください（NO-GO より後に承認を積むと覆ります）。\n`);
+}
+async function runGateOperation(channelRoot, gate, collectionId, decision) {
+    const store = await openLocalStore(channelRoot);
+    try {
+        const operation = decision === "approval" ? approveCollectionGate : rejectCollectionGate;
+        const result = await operation(store, { collectionId, gate }, systemClock);
+        process.stdout.write(gateOperationMessage(collectionId, gate, result.recorded, decision));
+    }
+    finally {
+        await store.close();
+    }
+}
+async function runCollection(arguments_) {
+    const subcommand = arguments_[0];
+    if (subcommand === "produce" || subcommand === "publish") {
+        requireArguments(arguments_, 2, `nyaucast collection ${subcommand} <id>`);
+        await runGateOperation(process.cwd(), subcommand, arguments_[1], "approval");
+        return;
+    }
+    if (subcommand === "reject") {
+        requireArguments(arguments_, 3, "nyaucast collection reject <gate> <id>");
+        await runGateOperation(process.cwd(), parseGate(arguments_[1]), arguments_[2], "rejection");
+        return;
+    }
+    throw new Error(`unknown collection command: ${String(subcommand)}`);
+}
+async function runMcp() {
+    const channelRoot = process.cwd();
+    const store = await openLocalStore(channelRoot);
+    const collectionStore = createCollectionStore(store);
+    const tools = [
+        createPlanInitTool({
+            collectionDirectories: createCollectionDirectories(channelRoot),
+            collectionStore,
+            generateCollectionId: randomUUID,
+        }),
+        createPlanCheckTitleTool({ findCollectionByTitle: collectionStore.findByTitle }),
+        createCollectionStatusTool({
+            getCollectionStatus: (collectionId) => deriveCollectionStatus(store, collectionId),
+        }),
+    ];
+    process.once("exit", () => store.client.close());
+    await serveMcp(tools);
+}
+async function runAuth(command, arguments_) {
+    // fallow-ignore-next-line code-duplication -- Top-level auth dispatch and collection existence checks have different effects.
+    if (command !== "auth")
+        throw new Error(`unknown command: ${command}`);
+    requireArguments(arguments_, 1, "nyaucast auth <channel>");
+    await createProductionYouTubeAuth().authenticate(arguments_[0]);
+}
+async function main() {
+    const [command, ...arguments_] = process.argv.slice(2);
+    if (command === undefined) {
+        return;
+    }
+    if (command === "mcp") {
+        requireArguments(arguments_, 0, "nyaucast mcp");
+        await runMcp();
+        return;
+    }
+    if (command === "collection") {
+        await runCollection(arguments_);
+        return;
+    }
+    await runAuth(command, arguments_);
+}
+await main();

package/dist/mcp.js

@@ -0,0 +1,25 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+function wireName(name) {
+    return name
+        .replaceAll(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .replaceAll(".", "_")
+        .toLowerCase();
+}
+export async function serveMcp(tools) {
+    const server = new McpServer({ name: "nyaucast", version: "0.0.2" });
+    for (const tool of tools) {
+        server.registerTool(wireName(tool.name), {
+            description: tool.description,
+            inputSchema: tool.inputSchema,
+            outputSchema: tool.outputSchema,
+        }, async (input) => {
+            const result = await tool.handler(input);
+            return {
+                content: [{ text: JSON.stringify(result), type: "text" }],
+                structuredContent: result,
+            };
+        });
+    }
+    await server.connect(new StdioServerTransport());
+}

package/dist/tools/collection.status.js

@@ -0,0 +1,27 @@
+import { z } from "zod";
+const gateDecisionSchema = z.enum(["approved", "pending", "rejected"]);
+const inputSchema = z.object({ collectionId: z.string() }).strict();
+const outputSchema = z
+    .object({
+    collectionId: z.string(),
+    gates: z.object({ produce: gateDecisionSchema, publish: gateDecisionSchema }).strict(),
+    progress: z
+        .object({
+        awaitingApproval: z.enum(["produce", "publish"]).optional(),
+        terminated: z.boolean(),
+    })
+        .strict(),
+})
+    .strict();
+export function createCollectionStatusTool(dependencies) {
+    return {
+        description: "Read derived collection progress and current gate decisions.",
+        handler: async (input) => {
+            const parsed = inputSchema.parse(input);
+            return dependencies.getCollectionStatus(parsed.collectionId);
+        },
+        inputSchema,
+        name: "collection.status",
+        outputSchema,
+    };
+}

package/dist/tools/plan.checkTitle.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+export const titleSchema = z.string().max(100);
+async function assertTitleAvailable(title, lookup) {
+    titleSchema.parse(title);
+    if ((await lookup.findCollectionByTitle(title)) !== undefined) {
+        throw new Error("collection title is already in use");
+    }
+}
+const inputSchema = z.object({ title: titleSchema }).strict();
+const outputSchema = z.object({ ok: z.literal(true) }).strict();
+export function createPlanCheckTitleTool(lookup) {
+    return {
+        description: "Validate that a collection title is within the limit and unused.",
+        handler: async (input) => {
+            const parsed = inputSchema.parse(input);
+            await assertTitleAvailable(parsed.title, lookup);
+            return { ok: true };
+        },
+        inputSchema,
+        name: "plan.checkTitle",
+        outputSchema,
+    };
+}

package/dist/tools/plan.init.js

@@ -0,0 +1,60 @@
+import { z } from "zod";
+import { titleSchema } from "./plan.checkTitle.js";
+const inputSchema = z
+    .object({
+    force: z.boolean().optional().default(false),
+    title: titleSchema,
+})
+    .strict();
+const outputSchema = z
+    .object({
+    collectionId: z.string(),
+    created: z.boolean(),
+    dir: z.string(),
+})
+    .strict();
+function collectionDirectory(id) {
+    return `collections/${id}`;
+}
+async function initializeExistingCollection(existing, force, dependencies) {
+    if (!force) {
+        return {
+            collectionId: existing.id,
+            created: false,
+            dir: collectionDirectory(existing.id),
+        };
+    }
+    if (await dependencies.collectionStore.hasDownstreamRecords(existing.id)) {
+        throw new Error("collection with downstream records cannot be recreated");
+    }
+    const dir = await dependencies.collectionDirectories.recreate(existing.id);
+    await dependencies.collectionStore.recreate(existing);
+    return { collectionId: existing.id, created: true, dir };
+}
+async function initializeNewCollection(title, dependencies) {
+    const collectionId = dependencies.generateCollectionId();
+    const recordExists = (await dependencies.collectionStore.findById(collectionId)) !== undefined;
+    const directoryExists = await dependencies.collectionDirectories.exists(collectionId);
+    if (recordExists || directoryExists) {
+        throw new Error("generated collection ID already exists");
+    }
+    await dependencies.collectionStore.create({ id: collectionId, title });
+    const dir = await dependencies.collectionDirectories.create(collectionId);
+    return { collectionId, created: true, dir };
+}
+export function createPlanInitTool(dependencies) {
+    return {
+        description: "Initialize a flat collection directory and its local-store record.",
+        handler: async (input) => {
+            const parsed = inputSchema.parse(input);
+            const existing = await dependencies.collectionStore.findByTitle(parsed.title);
+            if (existing !== undefined) {
+                return initializeExistingCollection(existing, parsed.force, dependencies);
+            }
+            return initializeNewCollection(parsed.title, dependencies);
+        },
+        inputSchema,
+        name: "plan.init",
+        outputSchema,
+    };
+}

package/dist/youtube/auth.js

@@ -0,0 +1,168 @@
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { OAuth2Client } from "google-auth-library";
+import { z } from "zod";
+import { authorizeWithLoopback } from "./oauth-loopback.js";
+const youtubeScopes = [
+    "https://www.googleapis.com/auth/youtube",
+    "https://www.googleapis.com/auth/youtube.force-ssl",
+    "https://www.googleapis.com/auth/yt-analytics.readonly",
+    "https://www.googleapis.com/auth/yt-analytics-monetary.readonly",
+];
+const requiredString = z.string().min(1);
+const optionalCredentialToken = z.string().nullable().optional();
+const clientSecretsSchema = z.strictObject({
+    installed: z.strictObject({
+        // fallow-ignore-next-line code-duplication -- Client-secret validation and MCP input schemas validate different boundaries.
+        client_id: requiredString,
+        client_secret: requiredString,
+        redirect_uris: z.array(requiredString).min(1),
+    }),
+});
+const storedCredentialsSchema = z.looseObject({
+    access_token: optionalCredentialToken,
+    expiry_date: z.number().nullable().optional(),
+    refresh_token: optionalCredentialToken,
+});
+const newCredentialsSchema = storedCredentialsSchema.extend({
+    access_token: requiredString,
+    refresh_token: requiredString,
+});
+const refreshedCredentialsSchema = storedCredentialsSchema.extend({
+    access_token: requiredString,
+});
+const channelSchema = z
+    .string()
+    .min(1)
+    .refine((channel) => channel !== "." && channel !== ".." && !/[/\\]/u.test(channel));
+const credentialPaths = (root, channel) => {
+    const slug = channelSchema.parse(channel);
+    const directory = join(root, slug);
+    return {
+        clientSecrets: join(directory, "client_secrets.json"),
+        directory,
+        token: join(directory, "token.json"),
+    };
+};
+class AuthRequiredError extends Error {
+    constructor(channel) {
+        super(`YouTube 認証が必要です。nyaucast auth ${channel} を実行してください`);
+    }
+}
+const redactFailure = async (failure, operation) => {
+    try {
+        return await operation();
+    }
+    catch {
+        throw failure;
+    }
+};
+const readCredential = async (path, schema, failure) => {
+    return redactFailure(failure, async () => {
+        const contents = await readFile(path, "utf8");
+        await chmod(path, 0o600);
+        return schema.parse(JSON.parse(contents));
+    });
+};
+const saveToken = async (paths, credentials) => {
+    const temporaryToken = join(paths.directory, `.token-${randomUUID()}.tmp`);
+    try {
+        // fallow-ignore-next-line code-duplication -- Atomic credential publication is not an OAuth request block.
+        await redactFailure(new Error("YouTube credential の保存に失敗しました"), async () => {
+            await mkdir(paths.directory, { mode: 0o700, recursive: true });
+            await writeFile(temporaryToken, `${JSON.stringify(credentials, undefined, 2)}\n`, {
+                flag: "wx",
+                mode: 0o600,
+            });
+            await rename(temporaryToken, paths.token);
+        });
+    }
+    catch (error) {
+        await Promise.allSettled([rm(temporaryToken, { force: true })]);
+        throw error;
+    }
+};
+class YouTubeAuthService {
+    #dependencies;
+    constructor(dependencies) {
+        this.#dependencies = dependencies;
+    }
+    async authenticate(channel) {
+        const paths = credentialPaths(this.#dependencies.credentialRoot, channel);
+        const clientSecrets = await this.#loadClientSecrets(paths, channel);
+        // fallow-ignore-next-line code-duplication -- Interactive authorization and token refresh have different failure contracts.
+        const credentials = await redactFailure(new Error("YouTube 認証に失敗しました。client_secrets.json を確認してください"), async () => {
+            const installed = clientSecrets.installed;
+            const authorized = await this.#dependencies.authorize({
+                clientId: installed.client_id,
+                clientSecret: installed.client_secret,
+                scopes: [...youtubeScopes],
+            });
+            return newCredentialsSchema.parse(authorized.credentials);
+        });
+        await saveToken(paths, credentials);
+    }
+    async getAccessToken(channel) {
+        const loaded = await this.#loadOAuthClient(channel);
+        const credentialsBeforeUpdate = { ...loaded.client.credentials };
+        const credentials = await this.#validatedUpdatedCredentials(channel, async () => {
+            await loaded.client.getAccessToken();
+            return loaded.client.credentials;
+        });
+        if (!isDeepStrictEqual(credentialsBeforeUpdate, loaded.client.credentials)) {
+            await saveToken(loaded.paths, credentials);
+        }
+        return credentials.access_token;
+    }
+    async refreshAccessToken(channel) {
+        return this.#refreshLoaded(channel, await this.#loadOAuthClient(channel));
+    }
+    async #loadClientSecrets(paths, channel) {
+        return readCredential(paths.clientSecrets, clientSecretsSchema, new Error(`client_secrets.json を ~/.config/nyaucast/${channel}/client_secrets.json に配置してください`));
+    }
+    async #loadOAuthClient(channel) {
+        const paths = credentialPaths(this.#dependencies.credentialRoot, channel);
+        const [clientSecrets, credentials] = await Promise.all([
+            this.#loadClientSecrets(paths, channel),
+            readCredential(paths.token, storedCredentialsSchema, new AuthRequiredError(channel)),
+        ]);
+        const installed = clientSecrets.installed;
+        const client = this.#dependencies.createOAuthClient({
+            clientId: installed.client_id,
+            clientSecret: installed.client_secret,
+            redirectUri: installed.redirect_uris[0],
+        });
+        const storedCredentials = credentials;
+        client.setCredentials(storedCredentials);
+        return { client, paths };
+    }
+    async #refreshLoaded(channel, loaded) {
+        const credentials = await this.#validatedUpdatedCredentials(channel, async () => {
+            const response = await loaded.client.refreshAccessToken();
+            return response.credentials;
+        });
+        await saveToken(loaded.paths, credentials);
+        return credentials.access_token;
+    }
+    async #validatedUpdatedCredentials(channel, update) {
+        let refreshed;
+        try {
+            refreshed = refreshedCredentialsSchema.parse(await update());
+        }
+        catch {
+            throw new Error(`YouTube credential を更新できません。nyaucast auth ${channel} を実行してください`);
+        }
+        return refreshed;
+    }
+}
+export const createYouTubeAuth = (dependencies) => new YouTubeAuthService(dependencies);
+export function createProductionYouTubeAuth() {
+    return createYouTubeAuth({
+        authorize: authorizeWithLoopback,
+        createOAuthClient: (options) => new OAuth2Client(options),
+        credentialRoot: join(homedir(), ".config", "nyaucast"),
+    });
+}

package/dist/youtube/client.js

@@ -0,0 +1,116 @@
+import { z } from "zod";
+// fallow-ignore-next-line code-duplication -- Retry limits are unrelated to process timeout constants.
+const maximumAttempts = 3;
+const initialRetryDelayMilliseconds = 1_000;
+const retryableStatuses = new Set([429, 503]);
+const youtubeApiOrigin = "https://youtube.googleapis.com";
+const youtubeUploadApiOrigin = "https://www.googleapis.com";
+const youtubeUploadApiPath = "/upload/youtube/v3/videos";
+// fallow-ignore-next-line code-duplication -- Google API error validation is unrelated to tool input schemas.
+const googleErrorSchema = z.object({
+    error: z.object({
+        errors: z.array(z.object({ reason: z.string() })),
+    }),
+});
+const classifyHttpFailure = async (response) => {
+    // fallow-ignore-next-line code-duplication -- Google error decoding is unrelated to generic JSON-RPC routing.
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        body = undefined;
+    }
+    const parsed = googleErrorSchema.safeParse(body);
+    return {
+        reason: parsed.success ? parsed.data.error.errors[0]?.reason : undefined,
+        status: response.status,
+    };
+};
+const httpError = (failure) => {
+    const reason = failure.reason === undefined ? "" : ` (${failure.reason})`;
+    return new Error(`YouTube API request failed: HTTP ${failure.status}${reason}`);
+};
+const isRetryableFailure = (failure) => retryableStatuses.has(failure.status) ||
+    (failure.status === 403 && failure.reason === "quotaExceeded");
+const selectRecovery = (failure, state, random) => {
+    // fallow-ignore-next-line code-duplication -- HTTP recovery selection is unrelated to collection-store waiter routing.
+    if (failure.status === 401 && !state.refreshedAfterUnauthorized)
+        return { kind: "refresh" };
+    if (!isRetryableFailure(failure))
+        return { kind: "fail" };
+    if (state.retryAttempt >= maximumAttempts - 1)
+        return { kind: "fail" };
+    const delay = initialRetryDelayMilliseconds * 2 ** state.retryAttempt * (1 + random);
+    // fallow-ignore-next-line code-duplication -- Returning retry recovery is unrelated to returning a classified HTTP failure.
+    return { delay, kind: "retry" };
+};
+// fallow-ignore-next-line code-duplication -- URL trust validation is unrelated to HTTP failure projection.
+const resolveYouTubeApiUrl = (input) => {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        throw new Error(`YouTube API request URL must use ${youtubeApiOrigin} or ${youtubeUploadApiOrigin}${youtubeUploadApiPath}`);
+    }
+    // fallow-ignore-next-line code-duplication -- Origin validation and JSON-RPC object validation have different trust boundaries.
+    const isYouTubeApi = url.origin === youtubeApiOrigin;
+    const isYouTubeUploadApi = url.origin === youtubeUploadApiOrigin && url.pathname === youtubeUploadApiPath;
+    if (!isYouTubeApi && !isYouTubeUploadApi) {
+        throw new Error(`YouTube API request URL must use ${youtubeApiOrigin} or ${youtubeUploadApiOrigin}${youtubeUploadApiPath}`);
+    }
+    return url.toString();
+};
+class RestYouTubeClient {
+    #dependencies;
+    constructor(dependencies) {
+        // fallow-ignore-next-line code-duplication -- The client and auth services only share constructor syntax, not a domain abstraction.
+        this.#dependencies = dependencies;
+    }
+    async request(request) {
+        const url = resolveYouTubeApiUrl(request.url);
+        const accessToken = await this.#dependencies.auth.getAccessToken(request.channel);
+        return this.#execute(request, url, {
+            accessToken,
+            refreshedAfterUnauthorized: false,
+            retryAttempt: 0,
+        });
+    }
+    // fallow-ignore-next-line code-duplication -- Retry execution and repository queries only share an async method signature.
+    async #execute(request, url, state) {
+        const response = await this.#fetch(request, url, state.accessToken);
+        if (response.ok)
+            return request.schema.parse(await response.json());
+        const failure = await classifyHttpFailure(response);
+        const recovery = selectRecovery(failure, state, this.#dependencies.random());
+        if (recovery.kind === "fail")
+            throw httpError(failure);
+        if (recovery.kind === "refresh") {
+            // fallow-ignore-next-line code-duplication -- Unauthorized recovery and backoff update distinct state fields.
+            const accessToken = await this.#dependencies.auth.refreshAccessToken(request.channel);
+            return this.#execute(request, url, {
+                ...state,
+                accessToken,
+                refreshedAfterUnauthorized: true,
+            });
+        }
+        await this.#dependencies.sleep(recovery.delay);
+        return this.#execute(request, url, { ...state, retryAttempt: state.retryAttempt + 1 });
+    }
+    async #fetch(request, url, accessToken) {
+        // fallow-ignore-next-line code-duplication -- Authorization header assembly is specific to the REST boundary.
+        const headers = new Headers(request.init?.headers);
+        headers.set("authorization", `Bearer ${accessToken}`);
+        const init = { ...request.init, headers };
+        if (request.body !== undefined)
+            init.body = request.body();
+        try {
+            return await this.#dependencies.fetch(url, init);
+        }
+        catch {
+            throw new Error("YouTube API request failed at the HTTP boundary");
+        }
+    }
+}
+export const createYouTubeClient = (dependencies) => new RestYouTubeClient(dependencies);

package/dist/youtube/oauth-loopback.js

@@ -0,0 +1,64 @@
+import { randomBytes } from "node:crypto";
+import { CodeChallengeMethod, OAuth2Client, } from "google-auth-library";
+import { getAuthCode } from "oauth-callback";
+import open from "open";
+const callbackHostname = "127.0.0.1";
+const callbackPath = "/oauth2callback";
+const callbackPort = 53_682;
+const redirectUri = `http://${callbackHostname}:${callbackPort}${callbackPath}`;
+const requireNonEmpty = (value, failure) => {
+    // fallow-ignore-next-line code-duplication -- OAuth value validation is unrelated to collection existence validation.
+    if (value === undefined || value.length === 0)
+        throw new Error(failure);
+    return value;
+};
+const requireCallbackCode = (callback, expectedState) => {
+    // fallow-ignore-next-line code-duplication -- OAuth state correlation is unrelated to CLI argument-count validation.
+    if (callback.state !== expectedState)
+        throw new Error("OAuth callback validation failed");
+    return requireNonEmpty(callback.code, "OAuth callback validation failed");
+};
+export const createLoopbackAuthorizer = (dependencies) => {
+    return async function authorize(options) {
+        // fallow-ignore-next-line code-duplication -- Loopback OAuth construction is unrelated to stored-token restoration.
+        const client = dependencies.createOAuthClient({
+            clientId: options.clientId,
+            clientSecret: options.clientSecret,
+            redirectUri,
+        });
+        const generatedPkce = await client.generateCodeVerifierAsync();
+        const codeChallenge = requireNonEmpty(generatedPkce.codeChallenge, "OAuth PKCE challenge generation failed");
+        const state = dependencies.randomState();
+        // fallow-ignore-next-line code-duplication -- OAuth authorization parameters are unrelated to MCP tool wiring.
+        const authorizationUrl = client.generateAuthUrl({
+            access_type: "offline",
+            code_challenge: codeChallenge,
+            code_challenge_method: CodeChallengeMethod.S256,
+            prompt: "consent",
+            redirect_uri: redirectUri,
+            scope: options.scopes,
+            state,
+        });
+        // fallow-ignore-next-line code-duplication -- Browser callback acquisition and OAuth code exchange use different protocols.
+        const callback = await dependencies.getAuthCode({
+            authorizationUrl,
+            callbackPath,
+            hostname: callbackHostname,
+            launch: (url) => dependencies.launch(url),
+            port: callbackPort,
+        });
+        const code = requireCallbackCode(callback, state);
+        const response = await client.getToken({
+            code,
+            codeVerifier: generatedPkce.codeVerifier,
+            redirect_uri: redirectUri,
+        });
+        return { credentials: response.tokens };
+    };
+};
+export const authorizeWithLoopback = createLoopbackAuthorizer({
+    createOAuthClient: (options) => new OAuth2Client(options),
+    getAuthCode,
+    launch: open,
+    randomState: () => randomBytes(32).toString("base64url"),
+});

package/drizzle/0000_open_payback.sql

@@ -0,0 +1,52 @@
+CREATE TABLE `approvals` (
+	`collection_id` text NOT NULL,
+	`gate` text NOT NULL,
+	`approved_at` text NOT NULL,
+	FOREIGN KEY (`collection_id`) REFERENCES `collections`(`id`) ON UPDATE no action ON DELETE no action,
+	CONSTRAINT "approvals_gate" CHECK("approvals"."gate" IN ('produce', 'publish'))
+);
+--> statement-breakpoint
+CREATE TABLE `collections` (
+	`id` text PRIMARY KEY NOT NULL,
+	`title` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `collections_title_unique` ON `collections` (`title`);--> statement-breakpoint
+CREATE TABLE `rejections` (
+	`collection_id` text NOT NULL,
+	`gate` text NOT NULL,
+	`rejected_at` text NOT NULL,
+	FOREIGN KEY (`collection_id`) REFERENCES `collections`(`id`) ON UPDATE no action ON DELETE no action,
+	CONSTRAINT "rejections_gate" CHECK("rejections"."gate" IN ('produce', 'publish'))
+);
+--> statement-breakpoint
+CREATE TABLE `thumbnails` (
+	`collection_id` text PRIMARY KEY NOT NULL,
+	`path` text NOT NULL,
+	`created_at` text NOT NULL,
+	FOREIGN KEY (`collection_id`) REFERENCES `collections`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE TRIGGER `approvals_no_update`
+BEFORE UPDATE ON `approvals`
+BEGIN
+	SELECT RAISE(ABORT, 'approvals are append-only');
+END;
+--> statement-breakpoint
+CREATE TRIGGER `approvals_no_delete`
+BEFORE DELETE ON `approvals`
+BEGIN
+	SELECT RAISE(ABORT, 'approvals are append-only');
+END;
+--> statement-breakpoint
+CREATE TRIGGER `rejections_no_update`
+BEFORE UPDATE ON `rejections`
+BEGIN
+	SELECT RAISE(ABORT, 'rejections are append-only');
+END;
+--> statement-breakpoint
+CREATE TRIGGER `rejections_no_delete`
+BEFORE DELETE ON `rejections`
+BEGIN
+	SELECT RAISE(ABORT, 'rejections are append-only');
+END;

package/drizzle/meta/0000_snapshot.json

@@ -0,0 +1,181 @@
+{
+  "version": "6",
+  "dialect": "sqlite",
+  "id": "5160fc8e-7bb4-427e-8bc1-6e8fed612371",
+  "prevId": "00000000-0000-0000-0000-000000000000",
+  "tables": {
+    "approvals": {
+      "name": "approvals",
+      "columns": {
+        "collection_id": {
+          "name": "collection_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "gate": {
+          "name": "gate",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "approvals_collection_id_collections_id_fk": {
+          "name": "approvals_collection_id_collections_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "collections",
+          "columnsFrom": ["collection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {
+        "approvals_gate": {
+          "name": "approvals_gate",
+          "value": "\"approvals\".\"gate\" IN ('produce', 'publish')"
+        }
+      }
+    },
+    "collections": {
+      "name": "collections",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "collections_title_unique": {
+          "name": "collections_title_unique",
+          "columns": ["title"],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "rejections": {
+      "name": "rejections",
+      "columns": {
+        "collection_id": {
+          "name": "collection_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "gate": {
+          "name": "gate",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "rejected_at": {
+          "name": "rejected_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "rejections_collection_id_collections_id_fk": {
+          "name": "rejections_collection_id_collections_id_fk",
+          "tableFrom": "rejections",
+          "tableTo": "collections",
+          "columnsFrom": ["collection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {
+        "rejections_gate": {
+          "name": "rejections_gate",
+          "value": "\"rejections\".\"gate\" IN ('produce', 'publish')"
+        }
+      }
+    },
+    "thumbnails": {
+      "name": "thumbnails",
+      "columns": {
+        "collection_id": {
+          "name": "collection_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "thumbnails_collection_id_collections_id_fk": {
+          "name": "thumbnails_collection_id_collections_id_fk",
+          "tableFrom": "thumbnails",
+          "tableTo": "collections",
+          "columnsFrom": ["collection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    }
+  },
+  "views": {},
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "indexes": {}
+  }
+}

package/drizzle/meta/_journal.json

@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "sqlite",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "6",
+      "when": 1787771653213,
+      "tag": "0000_open_payback",
+      "breakpoints": true
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,65 @@
 {
   "name": "nyaucast",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.2",
+  "description": "YouTube channel operations toolkit",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/daiki-beppu/nyaucast.git"
+  },
+  "bin": {
+    "nyaucast": "bin/nyaucast.js"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "drizzle"
+  ],
+  "type": "module",
+  "imports": {
+    "#nyaucast-entry": {
+      "nyaucast-source": "./src/index.ts",
+      "types": "./src/index.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@libsql/client": "0.17.4",
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "drizzle-orm": "0.45.2",
+    "google-auth-library": "11.0.2",
+    "oauth-callback": "2.2.0",
+    "open": "11.0.2",
+    "zod": "4.4.3"
+  },
+  "devDependencies": {
+    "@stryker-mutator/core": "10.0.0",
+    "@stryker-mutator/vitest-runner": "10.0.0",
+    "@types/node": "24.13.3",
+    "drizzle-kit": "0.31.10",
+    "fallow": "3.18.0",
+    "github-actionlint": "1.7.12",
+    "typescript": "7.0.2",
+    "vite-plus": "0.3.0",
+    "yaml": "2.9.0"
+  },
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": "24.x"
+    }
+  },
+  "engines": {
+    "node": ">=22.14.0"
+  },
+  "scripts": {
+    "check": "pnpm run lockfile:check && vp check && pnpm run actions:check && vp test run && pnpm run fallow",
+    "lockfile:check": "pnpm install --frozen-lockfile --lockfile-only",
+    "actions:check": "github-actionlint",
+    "fallow": "fallow --no-cache --fail-on-issues",
+    "mutation": "pnpm exec stryker run",
+    "db:generate": "drizzle-kit generate"
+  }
 }