feat(twitter): add extended Twitter/X operations: posting, DMs, engagement

[Charlsz]

#22

Adds 7 new Twitter/X operation nodes, an OAuth2 PKCE credential definition, Zod schemas for all inputs/outputs, and unit tests. Also adds OAuth 1.0a (HMAC-SHA1) signing so write operations (tweet, like, retweet, DM) work with consumer key + access token credentials.

I built a complete Twitter/X integration layer on top of the existing twitter-monitor node. The codebase now supports the full lifecycle of Twitter interactions — reading tweets, posting content, engaging with tweets (likes, retweets), sending direct messages, and looking up user profiles. All of this is backed by a shared twitter-client.ts that handles authentication, retries, and error handling in one place.

The biggest technical addition beyond the 7 nodes themselves is OAuth 1.0a support. Twitter's API v2 requires user-context authentication for any write operation (posting, liking, retweeting, DMs). The original codebase only had Bearer token auth, which is read-only. I implemented full HMAC-SHA1 signature generation following RFC 5849 directly in the client — no external OAuth libraries needed. When all four OAuth 1.0a credentials are present (consumer key, consumer secret, access token, access token secret), the client signs requests automatically. If they're missing, it falls back to Bearer token auth for read-only operations. This means existing read-only workflows won't break.

I also wired everything through the full stack: the core NodeCredentials type, the CLI playground (env-provider, credential prompts, run command), and the web playground (credential UI, node registry). A user can set their Twitter credentials via the .env file, the CLI jam credentials set twitter command, or the web UI — all three paths work.

Important notes

• Twitter API credits: Twitter's API v2 uses a paid credit system. The Free tier allows ~1,500 tweet reads and ~50 tweet posts per month. If you see a 402 CreditsDepleted error, it's not a code issue — your developer account has used its monthly quota. Check your usage at https://developer.twitter.com/en/portal/dashboard.
• OAuth 1.0a is required for writes: Bearer tokens (app-only auth) can only read data. To post tweets, like, retweet, or send DMs, you must provide all four OAuth 1.0a credentials: consumerKey, consumerSecret, accessToken, accessTokenSecret. These come from the "Keys and Tokens" tab in your Twitter Developer Portal app.
• OAuth2 PKCE is defined but not the primary auth path: The credential definition includes the full OAuth2 PKCE flow config (authorization URL, token URL, scopes) as specified in the issue. However, the actual API requests use OAuth 1.0a signing because that's what Twitter's v2 endpoints require for user-context operations. The OAuth2 PKCE credential is there for future use when a host application implements the full browser-based authorization flow.
• No external dependencies added: The OAuth 1.0a signature generation uses Node.js built-in crypto module (createHmac, randomBytes). No new packages were added to package.json.
• Rate limits: Twitter has per-endpoint rate limits (e.g., 200 tweets/15min, 300 likes/15min). The client has built-in retry logic with exponential backoff (3 retries, 1s base), but it won't retry on 429 (rate limit) responses indefinitely. Callers should handle rate limiting at the workflow level if needed.
• The test-twitter.ts file at the repo root is a manual smoke test for verifying live credentials. It's not part of the automated test suite and can be removed before merging if preferred.

New operations

Node	What it does
twitterCreateTweet	Post a tweet (with reply, media, quote tweet, poll support)
twitterDeleteTweet	Delete a tweet by ID
twitterLikeTweet	Like a tweet
twitterRetweet	Retweet a tweet
twitterSearchTweets	Search recent tweets by query
twitterSendDM	Send a direct message
twitterGetUserByUsername	Get a user profile by handle

Environment variables

# Required for write operations (post, like, retweet, DM)
TWITTER_CONSUMER_KEY=...
TWITTER_CONSUMER_SECRET=...
TWITTER_ACCESS_TOKEN=...
TWITTER_ACCESS_TOKEN_SECRET=...

# Optional
TWITTER_BEARER_TOKEN=...       # Read-only fallback
TWITTER_CLIENT_ID=...          # OAuth2 PKCE
TWITTER_CLIENT_SECRET=...      # OAuth2 PKCE

[MAlshaik]

Merged in commit bf33d7a. Thank you for the extended Twitter/X operations with OAuth 1.0a support! 🎉