@eryxenx/insta-chat 2.0.8 → 2.0.9

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to `@eryxenx/insta-chat` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/) and uses
 [Semantic Versioning](https://semver.org/).
 
+## [2.0.9] - 2026-10-11
+
+### Fixed
+
+- **`unsendMessage` still never deleted the message.** The 2.0.8 fix sent
+  `_csrftoken` + `_uuid` to the REST delete endpoint
+  (`/api/v1/direct_v2/threads/<t>/items/<id>/delete/`), but Instagram retired
+  that endpoint: on `www.instagram.com` the whole `/api/v1` namespace now
+  returns `{"message":"useragent mismatch","status":"fail"}` /
+  `not-logged-in` 404, and on `i.instagram.com` it needs the mobile app
+  identity. Unsend now goes through the web DM client's Relay mutation
+  `IGDMessageUnsendDialogOffMsysMutation` (doc_id `26948700068153789`) with
+  `{ message_id, send_data: { thread_id } }`, which answers
+  `{ data: { direct_unsend_message: true } }`. Verified against a real message.
+
 ## [2.0.8] - 2026-10-11
 
 ### Fixed

package/DOCS.md

@@ -182,6 +182,7 @@ Relay **doc_ids** (stable per friendly-name, rotate rarely):
 | `IGDirectCutoutStickerSendMutation` | `26601474479505807` |
 | `PolarisDirectInboxQuery` | `27909866362025854` |
 | `useFeatureLimitsOffMsysQuery` (login probe) | `28374543635529813` |
+| `IGDMessageUnsendDialogOffMsysMutation` (unsend) | `26948700068153789` |
 | Thread detail | `29619996517588618` |
 
 ### Text send
@@ -213,6 +214,21 @@ Relay **doc_ids** (stable per friendly-name, rotate rarely):
 `reaction_status` is `"created"` or `"deleted"`. (Reverse-engineered from the
 live `comet/CometDirectPageWeb` bundle; the legacy REST reaction endpoint 404s.)
 
+### Unsend (delete for everyone)
+
+`IGDMessageUnsendDialogOffMsysMutation` (doc_id `26948700068153789`) with
+variables:
+
+```javascript
+{ message_id: "<mid.$...>", send_data: { thread_id: "<threadID>" } }
+```
+
+It answers `{ data: { direct_unsend_message: true } }`. The legacy REST delete
+endpoint (`/api/v1/direct_v2/threads/<t>/items/<id>/delete/`) is gone: on
+`www.instagram.com` the whole `/api/v1` namespace returns `not-logged-in` 404,
+and on `i.instagram.com` it needs the mobile app identity. (Reverse-engineered
+from the live `IGDMessageUnsendDialogOffMsys.react` chunk.)
+
 ### Session validation
 
 The REST probe endpoints lie (they 302 to login even for healthy sessions), so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eryxenx/insta-chat",
-  "version": "2.0.8",
+  "version": "2.0.9",
   "description": " Unofficial Instagram Chat API for Node.js | Build Instagram DM bots on personal accounts \u2014 send messages, media, voice notes, reactions, edit & unsend, listen for incoming chats. No browser at runtime",
   "main": "index.js",
   "types": "index.d.ts",
@@ -23,7 +23,7 @@
     "CHANGELOG.md"
   ],
   "scripts": {
-    "test": "node test/smoke.js && node test/antiSuspension.test.js && node test/replyContent.test.js && node test/edit.test.js && node test/sendReply.test.js && node test/client.test.js && node test/relayError.test.js && node test/safetyWiring.test.js && node test/mediaOrder.test.js && node test/sessionSafety.test.js && node test/emptySend.test.js && node test/pollFloor.test.js && node test/unsend.test.js",
+    "test": "node test/smoke.js && node test/antiSuspension.test.js && node test/replyContent.test.js && node test/edit.test.js && node test/sendReply.test.js && node test/client.test.js && node test/relayError.test.js && node test/safetyWiring.test.js && node test/mediaOrder.test.js && node test/sessionSafety.test.js && node test/emptySend.test.js && node test/pollFloor.test.js && node test/unsend.test.js && node test/unsendGraphQL.test.js",
     "build": "node scripts/build.js"
   },
   "keywords": [

package/src/constants.js

@@ -25,7 +25,8 @@ const DOC_ID = {
   CUTOUT_STICKER_SEND: "26601474479505807",
   MARK_THREAD_READ: "27399783383056109",
   THREAD_DETAIL: "29619996517588618",
-  INBOX: "27909866362025854"
+  INBOX: "27909866362025854",
+  UNSEND_MESSAGE: "26948700068153789"
 };
 
 const EP = {

package/src/methods/message.js

@@ -99,15 +99,24 @@ class MessageMethods {
     });
   }
 
-  // Instagram's REST delete requires the request to look like the web client's:
-  // a `_csrftoken` (the csrftoken cookie) and a `_uuid` (the browser/device id).
-  // An empty body is rejected — Instagram answers with `status: "fail"` (or a
-  // 404/redirect), which made `unsend` a silent no-op.
+  // Unsend (delete for everyone) via the Relay mutation the web DM client uses:
+  // `IGDMessageUnsendDialogOffMsysMutation` (doc_id 26948700068153789). The
+  // legacy REST delete path (`/direct_v2/threads/<t>/items/<id>/delete/`) is
+  // dead on www.instagram.com (the whole /api/v1 namespace 404s) and on
+  // i.instagram.com it needs the mobile app identity, so we go straight to
+  // GraphQL. Captured live; verified against a real message.
   async unsend(threadID, itemID) {
-    const csrf = this.http.getCookie("csrftoken");
-    const body = { _csrftoken: csrf, _uuid: this.identity?.uuid || this.http.uuid() };
-    const res = await this.http.postForm(EP.ITEM_DELETE(threadID, itemID), body);
-    return res?.status === "ok";
+    try {
+      const res = await this.http.postGraphQL(
+        "IGDMessageUnsendDialogOffMsysMutation",
+        DOC_ID.UNSEND_MESSAGE,
+        { message_id: String(itemID), send_data: { thread_id: String(threadID) } },
+        `https://www.instagram.com/direct/t/${threadID}/`
+      );
+      return Boolean(res && res.data && res.data.direct_unsend_message) && !res.errors;
+    } catch (_) {
+      return false;
+    }
   }
 
   // Instagram lets you edit an outgoing DM within 15 minutes of sending it.