What is prepared, and what is published

The version lives in packages/cloudflare-worker/package.json. Publication is a separate maintainer decision, so nothing in this section is tagged, deployed, or available as a published npm release.

Changed

• Bluesky publishing now uses the official @atproto/api SDK, keeping link facets, publication identifiers, bounded responses and application-owned retries.
• Bluesky requests are sent with redirect: "manual". workerd rejects redirect: "error" before dispatch, and manual keeps the same guarantee: the response is inspected and a 3xx counts as a failure rather than a followed redirect.
• Platforms are enabled independently from their credentials, unconfigured platforms are rejected before persistence or enqueueing, and the Bluesky host defaults to bsky.social.
• Production setup requires only SYNDROO_API_KEY; platform secrets are added after deployment. Local development uses the local Wrangler environment to load optional platform credentials.
• Publication state transitions commit together with their Post aggregate update in one D1 transaction, including the claim read. A statement failure rolls the claim back, and an unknown commit outcome stays on the conservative path instead of resetting a publication to pending.
• The Worker bundle is rebuilt from source into a clean output directory before packaging, and npm run verify:package checks the packed artifact against the built bundle.
• The toolchain floor rises to wrangler@^4.132.0, @cloudflare/workers-types ^5.20260915.1 and @cloudflare/vitest-plugin ^1.1.10.

Added

• Optional maintenance admission control: the non-secret variable SYNDROO_MAINTENANCE with the exact value true rejects authenticated POST /v1/posts with HTTP 503 before the request body, the Idempotency-Key or D1 is read. Health checks and authenticated queries keep working, and the switch does not pause Queue consumers or the Cron Trigger.
• Strict retry deadlines through migration 0003_retry_timing.sql, which adds the nullable publications.retry_at column. Claim and Cron selection both require the deadline, so a duplicate Queue message cannot start the next attempt early. Minimum waits are 60 seconds after the first failure and 120 seconds after the second, the attempt limit stays at three, and ambiguous outcomes are never retried automatically.
• A local Mock SNS end-to-end gate (npm run test:e2e, npm run check:e2e) that drives the bundled Worker, D1, Queue, Cron handler and real adapters against loopback mock servers with fake credentials.
• Package verification covering the packed artifact, plus generated third-party license text for the bundled Worker.
• Native LinkedIn public text publishing with an explicit author and API version, little-text escaping, header-based confirmation and ambiguous-write protection.
• Native Tumblr NPF text publishing with OAuth 1.0a, optional blog credentials, preflight text validation, bounded responses and ambiguous-write protection.
• X text publishing through the official @xdevplatform/xdk SDK, optional OAuth 1.0a credentials, official weighted text validation and bounded requests without SDK retries.
• A thin deployment architecture around the public @syndroo/cloudflare-worker package, plus the Apache License 2.0, NOTICE, DCO contribution policy, CI and an npm release workflow.

Migration and rollback

• Apply migration 0003_retry_timing.sql before deploying this Worker version; npm run deploy applies pending migrations before the code deploy. The migration is compatible with the previously deployed Worker: rows written by older code keep retry_at as NULL and stay immediately eligible.
• Rolling back to older Worker code keeps publishing against the migrated database but cannot enforce the stored retry deadline, so a duplicate Queue message or Cron scan can start the next attempt before the earliest stored retry time. Do not reverse the migration and do not reset publication statuses by hand.

Licensing note

• @xdevplatform/xdk@0.6.6 declares an MIT license and an author in its package.json, but the published tarball for that exact version contains only dist/, package.json and README.md, and the upstream repository has no license file. The distribution therefore adds the canonical SPDX MIT text with the copyright placeholder unmodified, and records the source URL and SHA-256 beside it. This is not the upstream project's license file and asserts no copyright holder.

Verification status

• Local unit and script suites pass. Gate totals are recorded by the release maintainer after the final run.
• Bluesky and Threads are exercised locally through the Mock SNS gate only; live-account acceptance has not been performed. X, Tumblr and LinkedIn are experimental and have not been validated live.