From 480497dcd01bbe5909e004254429319a2d759d5b Mon Sep 17 00:00:00 2001
From: "prompt.ac/@jeffrey" <mail@aesthetic.computer>
Date: Mon, 6 Jul 2026 14:13:07 -0700
Subject: [PATCH] =?UTF-8?q?youtube:=20--as=20<channel>=20=E2=80=94=20per-c?=
 =?UTF-8?q?hannel=20vault=20tokens=20(whistlegraph)=20over=20the=20shared?=
 =?UTF-8?q?=20OAuth=20client?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 toolchain/youtube/README.md | 19 +++++++++++++++++++
 toolchain/youtube/yt.mjs    | 17 +++++++++++++++--
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/toolchain/youtube/README.md b/toolchain/youtube/README.md
index d421a45574..82db816abb 100644
--- a/toolchain/youtube/README.md
+++ b/toolchain/youtube/README.md
@@ -59,6 +59,25 @@ Every upload drops a `<video>.youtube.json` receipt next to the file
 with the resulting `videoId`, watch URL, and the metadata that was
 sent.
 
+## Other channels (whistlegraph)
+
+Every command takes `--as <channel>`, which swaps in
+`aesthetic-computer-vault/youtube/<channel>-token.json`. The OAuth
+client is shared; each channel just needs its own one-time consent:
+
+```bash
+node toolchain/youtube/yt.mjs auth --as whistlegraph
+node toolchain/youtube/yt.mjs whoami --as whistlegraph
+node toolchain/youtube/yt.mjs upload video.mp4 --as whistlegraph --title "..."
+```
+
+During consent, Google's account chooser lists the channel identities —
+pick **whistlegraph**. If the whistlegraph channel lives under a
+*different* Google account (not a brand channel of
+mail@aesthetic.computer), first add that account as a test user on the
+OAuth consent screen (GCP project `aesthetic-computer` → APIs &
+Services → OAuth consent screen), then sign in as it.
+
 ## Notes
 
 - **Private-first.** The default privacy is `private` — uploads land
diff --git a/toolchain/youtube/yt.mjs b/toolchain/youtube/yt.mjs
index 862c7389f5..e693ef3e7d 100644
--- a/toolchain/youtube/yt.mjs
+++ b/toolchain/youtube/yt.mjs
@@ -47,7 +47,6 @@ const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO = resolve(HERE, "../..");
 const VAULT = resolve(REPO, "aesthetic-computer-vault/youtube");
 const CLIENT_PATH = process.env.YT_CLIENT_JSON || resolve(VAULT, "client.json");
-const TOKEN_PATH = process.env.YT_TOKEN_JSON || resolve(VAULT, "token.json");
 
 const SCOPES = [
   "https://www.googleapis.com/auth/youtube.upload",
@@ -74,6 +73,17 @@ for (let i = 0; i < argv.length; i++) {
 
 function die(msg) { console.error(`✗ ${msg}`); process.exit(1); }
 
+// ── channel identity ─────────────────────────────────────────────────
+// One OAuth client, one refresh token per channel. The default token
+// (token.json) is the Aesthetic Dot Computer channel; `--as whistlegraph`
+// (or YT_CHANNEL=whistlegraph) switches every command to
+// whistlegraph-token.json in the vault. Run `auth --as whistlegraph`
+// once, picking the whistlegraph identity in Google's chooser.
+if (flags.as === true) die(`--as needs a channel name, e.g. --as whistlegraph`);
+const CHANNEL_AS = flags.as || process.env.YT_CHANNEL || null;
+const TOKEN_PATH = process.env.YT_TOKEN_JSON ||
+  resolve(VAULT, CHANNEL_AS ? `${CHANNEL_AS}-token.json` : "token.json");
+
 // ── client secret ────────────────────────────────────────────────────
 function loadClient() {
   if (!existsSync(CLIENT_PATH)) {
@@ -88,7 +98,7 @@ function loadClient() {
 }
 
 function loadToken() {
-  if (!existsSync(TOKEN_PATH)) die(`No saved token. Run: node toolchain/youtube/yt.mjs auth`);
+  if (!existsSync(TOKEN_PATH)) die(`No saved token. Run: node toolchain/youtube/yt.mjs auth${CHANNEL_AS ? ` --as ${CHANNEL_AS}` : ""}`);
   return JSON.parse(readFileSync(TOKEN_PATH, "utf8"));
 }
 
@@ -159,6 +169,7 @@ async function doAuth() {
       });
       server._redirect = redirect;
       console.log(`\n▸ Opening browser — sign in as mail@aesthetic.computer and approve.`);
+      if (CHANNEL_AS) console.log(`  In Google's account chooser, pick the "${CHANNEL_AS}" channel identity.`);
       console.log(`  If it doesn't open, paste this URL:\n\n  ${authUrl}\n`);
       openBrowser(authUrl);
     });
@@ -451,6 +462,8 @@ if (!cmd || !COMMANDS[cmd]) {
   console.log(`  auth                 one-time OAuth consent (browser)`);
   console.log(`  whoami               print the authorized channel`);
   console.log(`  upload <video> ...   resumable upload (see file header for flags)`);
+  console.log(`\nAll commands take --as <channel> (e.g. --as whistlegraph) to use`);
+  console.log(`that channel's token (<channel>-token.json in the vault).`);
   process.exit(cmd ? 1 : 0);
 }
 
-- 
2.51.2