[Dev-Savio-hub]

Closes #1736

Summary

Applies the shared create-stream validation schema (validateCreateStreamBody), token normalisation (normaliseToken), token allowlist checks (checkTokenAllowed / checkTokenAllowedForOrg), and fingerprinted idempotency (computeFingerprint + checkIdempotency / setIdempotency) to POST /api/v2/streams. Also moves the per-org daily quota check (checkOrgDailyQuota) to run only after validation and allowlist checks succeed so malformed or rejected requests do not consume quota.

Shared Core & Remaining v1 vs v2 Differences

Shared Core (createStreamCore in app/lib/stream-core.ts)

Both POST /api/streams (v1) and POST /api/v2/streams (v2) now delegate to createStreamCore(input):

1. Validates the parsed JSON body with validateCreateStreamBody(body) and returns 422 VALIDATION_ERROR with field-level details on failure.
2. Normalises the requested token (rawToken?.trim() || "XLM") via normaliseToken, returning 422 INVALID_TOKEN on malformed asset strings.
3. Enforces the token allowlist via checkTokenAllowedForOrg (when an org is provided) or checkTokenAllowed, returning 422 TOKEN_NOT_ALLOWED when disallowed.
4. Runs an optional beforePersist gate (used by v2 to charge the per-org daily quota only after all validation and allowlist checks pass).
5. Persists the Stream entity with the normalised token (replacing the hardcoded "XLM" in v2) and records the "created" lifecycle event via appendStreamHistoryEvent.

[drips-wave]

@Dev-Savio-hub Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Held: this PR removes the 401 "Bearer token required" check on POST /api/v2/streams, and its create logic conflicts with what main got from #1773. Please rebase onto the latest default branch, address this, and make sure CI passes, then it can be merged.

[greatest0fallt1me]

Thanks for the work on the shared stream-core refactor. We can't merge this yet, for these reasons:

1. app/api/v2/streams/route.ts still removes the 401 UNAUTHORIZED "Bearer token required." check at the top of handleV2StreamsPost. Please restore it. Unauthenticated callers must not be able to create v2 streams.
2. app/api/v2/streams/route.ts doesn't compile against the latest main. The old body (if (!recipient || !rate || !schedule), the ID generation block, and return NextResponse.json(payload, ...)) is left behind after the new createStreamCore call, so recipient, rate, schedule and payload are undefined. The merge with the create logic from fix(streams): run preview/dryrun through the create pipeline #1773 is still unresolved.

Please rebase on the latest main, restore the auth check, finish the merge so the handler uses createStreamCore cleanly, and make sure CI passes.