Tactical Media Broadcast Hub — initial release

Self-hosted multi-platform broadcast newsroom for activist collectives:
publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style
column wall with hostile-content-safe rendering, live control room with Auto
Director, bridged chat governance with polls and quorum, distributed sandboxed
transcode workers, encrypted content-addressed archive, monthly analytics.

MIT licensed. See README.md and docs/.

packages/egress/src/policy.d.ts

@@ -0,0 +1,26 @@
+export interface ResolvedAddress {
+    address: string;
+    family: number;
+}
+export type Resolver = (hostname: string) => Promise<readonly ResolvedAddress[]>;
+export interface EgressPolicyOptions {
+    /** Operator-controlled allowlists; defaults to HTTP 80 and HTTPS 443 only. */
+    ports?: Partial<Record<"http:" | "https:", readonly number[]>>;
+    resolver?: Resolver;
+}
+export interface ValidatedEndpoint {
+    url: URL;
+    pinnedAddress: string;
+    family: 4 | 6;
+    hostKey: string;
+}
+export declare function assertPublicAddress(address: string): void;
+export declare function hostBudgetKey(url: URL): string;
+/** Pure syntactic/literal policy check; no DNS or budget is consumed. */
+export declare function validateUrl(raw: string | URL, options?: EgressPolicyOptions): URL;
+export declare class EgressPolicy {
+    private readonly options;
+    constructor(options?: EgressPolicyOptions);
+    validateUrl(raw: string | URL): URL;
+    validate(raw: string | URL): Promise<ValidatedEndpoint>;
+}