fix(x-oauth): resolve user ID before /users/{id}/bookmarks call

[Bit-Bonds]

Summary

• Resolves authenticated user ID via /2/users/me before calling /2/users/{id}/bookmarks
• Fixes hard 400 from X API v2 on every X OAuth bookmark import

The bug

app/api/import/x-oauth/fetch/route.ts calls https://api.x.com/2/users/me/bookmarks?.... The X API v2 rejects this:

{
  "errors": [{
    "parameters": {"id": ["me"]},
    "message": "The `id` query parameter value [me] is not valid"
  }],
  "title": "Invalid Request",
  "type": "https://api.twitter.com/2/problems/invalid-request"
}

The /users/{id}/bookmarks endpoint requires the numeric user ID — unlike many /2/tweets/* endpoints, it does not accept me as an alias.

Result: every X OAuth import fails with "X API error: 400" before any bookmarks are fetched. Reproduced on a brand-new OAuth 2.0 connection on the new pay-per-use developer console (console.x.com) as of April 2026.

The fix

Call /2/users/me once at the start of POST /api/import/x-oauth/fetch to resolve the numeric ID, then use it for all /users/{id}/bookmarks pagination requests. One extra request per import — negligible against the bookmark pagination loop, and /users/me doesn't consume bookmark-list rate limits.

Test plan

• Tested locally against my own X account on a fresh OAuth 2.0 connection
• 98 bookmarks imported successfully (was failing with 400 before)
• Pagination still works (verified with maxPages: 20)
• No new TypeScript errors

🤖 Generated with Claude Code

[xkonjin]

Review: X OAuth Bookmarks User ID Fix

Clean fix for X API compatibility issue. The /users/me/bookmarks endpoint was rejected; now properly resolves the numeric user ID first.

Security/Error Handling:

• Good: Validates users/me response before extracting ID
• Good: Returns 502 with descriptive error on API failure
• Logs errors to console.error for debugging

Nit: Consider caching the resolved userId in the session to avoid the extra API call on repeated bookmark fetches in the same session. Not blocking.

Test recommendation: Add a mock test for the users/me resolution failure case.

LGTM - fixes a real API breakage.