Give the account a 09:00 slot every day + a queue, so the soonest open slot is always within ~1 day — well before any far-future floor.

Create a signed OAuth state for the connection link flow.

Ensure Tag records exist for all given tag names in a workspace.

Transition every (or selected) PlatformPost child of *post* to *target*. Returns ``(moved, skipped)`` lists of PlatformPost instances. Children

Verify and decode the OAuth state parameter.

Poll a Threads media container until it is FINISHED. Threads exposes the ingest state via the container's ``status`` field (values: I

Poll container status until FINISHED or error.

Poll container status until FINISHED or error.

One-shot backfill on account connect / reconnect. Account-level: writes today's row (the only one we can reliably get without provider time-s

Create an AT Protocol session using handle and app password. Returns an ``OAuthTokens`` with *accessJwt* as ``access_token`` and *ref

Raise ``StorageQuotaExceededError`` if accepting ``incoming_bytes`` would push the org over its resolved limit. No-op when ``STORAGE_QUOTA_ENA

Extract video metadata using ffprobe.

Stable hash of (method, path, canonical-JSON body). Used to detect "client reused the idempotency key for a different intent". We hash a sort

Generate individual Post records from active RecurrenceRules. Runs daily. For each active rule, computes recurrence dates from the source pos

Fetch the pages that the authenticated user manages. Returns a list of dicts each containing id, name, access_token, category, and pi

Create a default Organization, Workspace, and memberships for a new user. Skips if the user already belongs to an organization (e.g. invited user

Increment the failed-auth counter for this IP. On the first failure, ``cache.add`` seeds the bucket with the window TTL. On subsequent failur

Refresh this account's OAuth access token via *provider* and persist it. Returns the new access token. Propagates whatever the provider's

Remove a single entry, leaving a gap; neighbours are untouched. Comment §3: delete the QueueEntry and clear the matching PlatformPost's sched

Reassign the queue's occupied slot times to entries in a new order. Drag-reorder under the slot model: the SET of occupied datetimes is prese

Free this entry's slot and move it to the queue's next gap.

Return the single app secret for one org's platform (.env dominant). Used to bind inbound-webhook verification to the specific account/org being

Effective per-24h cap for one ``SocialAccount``. Order: per-account override → platform default → fallback. Note the explicit ``is not None`

Whether this account can have a first comment posted by the worker. Most platforms answer purely from PLATFORM_FIELD_CONFIG. LinkedIn Persona

204 that shows a client toast and optionally fires extra HX-Trigger events. The approval surfaces listen for ``showToast`` (renders the toast) pl

Resolve a raw bearer string to an active ``ApiKey``, or None. Returns None for: malformed token, unknown prefix, hash mismatch, revoked key,

Two-phase + lost-key rotation. May raise ``_DeferredToWorker`` to signal a worker fallback.

Set ``provider.include_analytics_scopes`` based on AnalyticsPlatformConfig. Providers add their analytics-only scopes (e.g. ``read_insights``,

Build HTTP Basic auth header for token endpoints.

Workspace-tz wall-clock (date, time) strings for a display-tz grid cell. The composer reads ``?scheduled_date``/``?scheduled_time`` in the *works

Combine the composer's date + time inputs into a workspace-tz-aware datetime. Returns ``None`` unless both parts are present. Shared by the real

Derive a 256-bit encryption key from SECRET_KEY via HKDF.

Dispatch a single delivery to its channel.