POST /v1/projects/:projectId/social/reauth-url

// Step 1 — detect by polling. (The `social_account.needs_reauth` webhook is
// registered in the catalog but not yet emitting — see the callout below
// before wiring an event-driven path.)
const { items } = await fetch(
  `https://api.layers.com/v1/projects/${projectId}/social-accounts?status=reauth_required`,
  { headers: { Authorization: `Bearer ${LAYERS_API_KEY}` } },
).then(r => r.json());

for (const account of items) {
  // Step 2 — mint. The new authorize URL preserves `account.socialAccountId`.
  const { authorizeUrl, state } = await fetch(
    `https://api.layers.com/v1/projects/${projectId}/social/reauth-url`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${LAYERS_API_KEY}`,
        "Idempotency-Key": crypto.randomUUID(),
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        socialAccountId: account.socialAccountId,
        returnUrl: `${APP_BASE_URL}/reconnect/${account.platform}/return`,
      }),
    },
  ).then(r => r.json());

  // Step 3 — send the user through. Most partners do one of:
  //   - Email the user a link to `authorizeUrl` (lowest friction; works
  //     when the user isn't actively logged in).
  //   - Surface a "Reconnect TikTok" banner in the app linking to the URL.
  // The flow from here is identical to the initial OAuth handshake: the
  // user consents on tiktok.com / instagram.com, lands back at `returnUrl`,
  // and your handler polls `oauth-status/${state}` until it flips to
  // `completed`. On `completed`, the same `socialAccountId` is back to
  // `connected` — queued scheduled posts targeting it resume publishing.
  await persistReauthPending({
    socialAccountId: account.socialAccountId,
    state,
    authorizeUrl,
  });
}