@storylinkpro/instagram-stories-api 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.2
+
+- The client sends the access token in the `Authorization` header, not in the URL. Proxy and server logs no longer record it. The client also removes the token from the `paging.next` URLs that Meta returns.
+- The timeout now works on Node 20.0 to 20.2 when you pass your own `signal`.
+- The publish workflow runs the dev dependencies in a job that cannot get an npm token.
+
 ## 0.1.1
 
 - The package description, keywords and README make the package easier to find.

package/dist/client.js

@@ -67,11 +67,23 @@ function metricValues(body) {
     }
     return out;
 }
+/** Aborts when either signal aborts. `AbortSignal.any` needs Node 20.3+, so
+ *  older runtimes link the two by hand and keep the timeout. */
 function combineSignals(a, b) {
     if (!a)
         return b;
     const any = AbortSignal.any;
-    return any ? any([a, b]) : a;
+    if (any)
+        return any([a, b]);
+    const ctrl = new AbortController();
+    for (const s of [a, b]) {
+        if (s.aborted) {
+            ctrl.abort(s.reason);
+            return ctrl.signal;
+        }
+        s.addEventListener("abort", () => ctrl.abort(s.reason), { once: true });
+    }
+    return ctrl.signal;
 }
 export function createClient(options) {
     if (!options || typeof options.accessToken !== "string" || options.accessToken.length === 0) {
@@ -91,13 +103,15 @@ export function createClient(options) {
     let lastUsage = null;
     const userId = (o) => checkId(o?.igUserId ?? options.igUserId, "igUserId");
     async function call(url, signal) {
-        url.searchParams.set("access_token", token);
+        // The token goes in a header, not the query string, so it stays out of
+        // proxy and server logs. Meta adds it to `paging.next` URLs: remove it.
+        url.searchParams.delete("access_token");
         const path = url.pathname;
         let res;
         try {
             res = await doFetch(url.toString(), {
                 method: "GET",
-                headers: { accept: "application/json" },
+                headers: { accept: "application/json", authorization: `Bearer ${token}` },
                 signal: combineSignals(signal, AbortSignal.timeout(timeoutMs)),
             });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@storylinkpro/instagram-stories-api",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Instagram Graph API client and CLI for Node.js and TypeScript: read Instagram Stories, posts, reels and their insights (views, reach, replies, likes, saves, shares). Typed, zero dependencies.",
   "keywords": [
     "instagram",