@sizls/broadcast-cli

Command-line interface for @sizls/broadcast. Dispatches release announcements to Bluesky, Mastodon, Discord, LinkedIn, X (Twitter), and Facebook Pages (with additional platforms — Slack, Threads, Reddit, and the newsletter family — available via the self-hosted Worker template), verifies Pluck-signed cassettes, and walks operators through the setup doctor checklist.

Consumed by the sizls/broadcast-action reusable GitHub workflow via npx @sizls/broadcast-cli post --from-github-event .... You almost never invoke this CLI directly — the reusable workflow is the primary surface.

Install

npx --yes @sizls/broadcast-cli --help

Or pin globally:

npm install -g @sizls/broadcast-cli

Commands

broadcast post --from-github-event --platforms <list>

Dispatch a Tier 1 broadcast for a GitHub release. Reads the release payload from $GITHUB_EVENT_PATH, sanitizes and signs the announcement, dispatches through each configured platform adapter, and POSTs the cassette envelope to the Sizl-hosted posts-index at broadcast.sizls.com.

Options:
  --platforms <list>        comma-separated platform ids (bluesky,mastodon,discord,linkedin,twitter,facebook)
  --from-github-event       read the release payload from $GITHUB_EVENT_PATH
  -c, --config <path>       path to broadcast config JSON (default: .sizl/broadcast.config.json)
  --posts-index-url <url>   override the default posts-index URL
  --dry-run                 validate + sanitize + sign but do NOT post

Env vars consumed:

| Env var | Purpose | |---|---| | BROADCAST_API_KEY | SaaS-path bearer token → your tenant on broadcast.sizls.com. | | BLUESKY_APP_PASSWORD | Bluesky auth, identifier:appPassword format. | | MASTODON_TOKEN | Mastodon OAuth app token with write:statuses. | | DISCORD_WEBHOOK_URL | Discord channel webhook URL. | | LINKEDIN_ACCESS_TOKEN | LinkedIn Marketing Developer Platform token with w_member_social (personal) or w_organization_social (page). Rotates ~every 60 days. | | TWITTER_BEARER_TOKEN | X API v2 bearer token from a paid tier (Basic $200/mo minimum; free tier is read-only). Pay-per-usage on top — expect ~$0.20 per release-with-URL post. | | FACEBOOK_PAGE_TOKEN | Long-lived Facebook Page access token with pages_manage_posts. Derive via GET /oauth/access_token?grant_type=fb_exchange_token then GET /{page-id}?fields=access_token. | | POSTS_INDEX_SECRET | Legacy self-host HMAC path (skip when using the SaaS API key). | | BROADCAST_URL | Override the SaaS Worker URL. Default: https://broadcast.sizls.com/v1/broadcast. |

Config fields for the LinkedIn / Facebook adapters (Twitter takes no extra config — the bearer token alone is enough) — set these in .sizl/broadcast.config.json:

• linkedinActorUrn — urn:li:person:<id> or urn:li:organization:<id> depending on the token's scope.
• facebookPageId — numeric Page ID from Meta's Graph API Explorer.

Instagram was in the v0.2.0 launch set but was pulled in v0.2.1 — the CLI has no media pipeline yet and Instagram Business content publishing requires an image. It's queued for v0.3; INSTAGRAM_ACCESS_TOKEN stays in the env allowlist so a future minor can wire it back without a workflow bump.

broadcast verify <input>

Verify a Pluck cassette signature. Accepts a raw cassette hash, a receipt URL, or a direct /posts/<hash> endpoint.

broadcast doctor

Walk through the manual-action checklist — env vars, secrets, keychain, state db, Twitter approval gate.

broadcast secrets set|delete <key> [value]

Store or remove a secret in the OS keychain (via keytar).

Config file example

A minimal .sizl/broadcast.config.json covering the v0.2 launch-set adapters (Bluesky, Mastodon, Discord, LinkedIn, X/Twitter, Facebook) and the tier policy defaults lives at examples/broadcast.config.json. Copy it into your repo at .sizl/broadcast.config.json (or pass --config <path> to point elsewhere).

Swap the two REPLACE-WITH-... placeholders before your first run:

• linkedinActorUrn — your urn:li:person:<id> (personal token) or urn:li:organization:<id> (page token). Grep for sub in a fresh access token JWT payload for the numeric id.
• facebookPageId — the numeric Page ID from Meta's Graph API Explorer (GET /me/accounts returns it).

Leaving a REPLACE-... value in place will surface as an adapter-side rejection at post time (LinkedIn refuses a non-URN-shaped actor outright; Facebook returns a 400 on a non-numeric page id) — the run continues on the other adapters and the offending platform lands in the skipped output.

Trust chain

Every published version of @sizls/broadcast-cli ships an npm provenance attestation proving it was built from a specific commit on sizls/broadcast by a specific GitHub Actions workflow. Verify with:

npm audit signatures @sizls/broadcast-cli

npm audit signatures actually verifies the tarball against the Sigstore-anchored attestation and fails-closed on a mismatch. (The npm view ... | jq .dist.attestations recipe circulated in earlier docs only prints the URL of the attestation — it does not verify anything.)

The reusable workflow at sizls/broadcast-action/.github/workflows/broadcast-reusable.yml pins the CLI by version (cli-version: '0.2' in the default, or explicit '0.2.1' for reproducibility). Combined with a commit-SHA pin on the reusable workflow itself, consumers get equivalent trust to the pre-refactor bundled action.

License

MIT OR Apache-2.0