X Publishing

Use the official X CLI as the credential-bearing boundary, and keep third-party Markdown conversion code credentialless.

Core invariant

posts / threads / media ───────────────→ official xurl ─→ api.x.com

Markdown / MDX
    ↓
credentialless validator / converter
    ↓
X Article content_state JSON ──────────→ official xurl ─→ api.x.com

Never give a third-party converter the user's X OAuth tokens, X browser cookies, Bitwarden access token, or browser session. Never use auth_token / ct0 cookie automation when the official API can perform the operation.

Start every X task with discovery