@volter/twin-instagram 0.1.0 → 0.1.2

package/dist/client/instagram-mirror.js

@@ -14,6 +14,15 @@ const SESSION_TOKEN = 'instagram-mirror.token';
 function readSession() {
     if (typeof sessionStorage === 'undefined')
         return null;
+    // the World signed these screens in as the account its config names (`signIn.as`): taken once, as a log-in would
+    // (off the page once taken, and not again in this tab once the person signs out)
+    const w = window;
+    const given = sessionStorage.getItem('volter.signedOut') ? undefined : w.__VOLTER_SIGN_IN__;
+    delete w.__VOLTER_SIGN_IN__;
+    if (given && !sessionStorage.getItem(SESSION_TOKEN)) {
+        sessionStorage.setItem(SESSION_USER, given.account);
+        sessionStorage.setItem(SESSION_TOKEN, given.token);
+    }
     const username = sessionStorage.getItem(SESSION_USER);
     const token = sessionStorage.getItem(SESSION_TOKEN);
     return username && token ? { username, token } : null;
@@ -242,6 +251,7 @@ function App() {
     const signOut = () => {
         sessionStorage.removeItem(SESSION_USER);
         sessionStorage.removeItem(SESSION_TOKEN);
+        sessionStorage.setItem('volter.signedOut', '1');
         setSession(null);
     };
     if (!session)

package/dist/src/instagram-mirror-ui.d.ts

@@ -55,3 +55,15 @@ export declare function createInstagramMirrorServer(options: {
 export declare function instagramMirrorHtml(): string;
 /** The mirror's stylesheet, for a host serving the shell's `assets/styles.css` itself (the hosted mirror mount). */
 export declare function instagramMirrorStyles(): Promise<string>;
+/** The professional account `as` names (a username, with or without its @) and a token minted for it now: what
+ *  Instagram's screens sign in with when the World's config says `signIn: { as }` (the World hands them over,
+ *  served-world.ts). The account is read from the twin's state; the token is a fresh one, seeded through the twin's
+ *  own `/_twin/tokens` exactly as a World's seed does (tokens are held only as their SHA-256, never read back), with
+ *  the read permissions the screens use. Null when the World holds no such account, or the twin refuses the token. */
+export declare function instagramMirrorSignIn(as: string, ctx: {
+    root: string;
+    twin: (path: string, init?: RequestInit) => Promise<Response>;
+}): Promise<{
+    account: string;
+    token: string;
+} | null>;

package/dist/src/instagram-mirror-ui.js

@@ -19,10 +19,10 @@
 // PURE FRONTEND (R3): the mirror imports no handler and no twin internals — it MOUNTS the pack's own
 // fetch adapter as its API backend and reads every byte of state back over the wire.
 import { readFile } from 'node:fs/promises';
-import { bundleClient, fileResponse, serveHttp } from '@volter/world-core';
+import { filePathOf, bundleClient, fileResponse, ownFields, serveHttp, twinResources } from '@volter/world-core';
 import { createInstagramTwinFetch } from "./instagram-server.js";
-const CLIENT_ENTRY = () => new URL('../client/instagram-mirror.tsx', import.meta.url).pathname; // lazy: workerd rejects a top-level relative import.meta.url
-const CLIENT_CSS = () => new URL('../client/instagram-mirror.css', import.meta.url).pathname;
+const CLIENT_ENTRY = () => filePathOf(new URL('../client/instagram-mirror.tsx', import.meta.url)); // lazy: workerd rejects a top-level relative import.meta.url
+const CLIENT_CSS = () => filePathOf(new URL('../client/instagram-mirror.css', import.meta.url));
 /** The version the mirror's reads pin — the twin's newest. */
 export const MIRROR_VERSION = 'v26.0';
 /** The account fields the profile header reads. */
@@ -156,3 +156,20 @@ export function instagramMirrorHtml() {
 export function instagramMirrorStyles() {
     return readFile(CLIENT_CSS(), 'utf8');
 }
+/** The professional account `as` names (a username, with or without its @) and a token minted for it now: what
+ *  Instagram's screens sign in with when the World's config says `signIn: { as }` (the World hands them over,
+ *  served-world.ts). The account is read from the twin's state; the token is a fresh one, seeded through the twin's
+ *  own `/_twin/tokens` exactly as a World's seed does (tokens are held only as their SHA-256, never read back), with
+ *  the read permissions the screens use. Null when the World holds no such account, or the twin refuses the token. */
+export async function instagramMirrorSignIn(as, ctx) {
+    const username = as.replace(/^@/, '').toLowerCase();
+    const user = twinResources('instagram', ctx.root).find((r) => r.type === 'ig_user' && String(ownFields(r).username ?? '').toLowerCase() === username);
+    if (!user)
+        return null;
+    const token = crypto.randomUUID();
+    const res = await ctx.twin('/_twin/tokens', {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ token, user: String(user.id), permissions: ['instagram_basic', 'pages_read_engagement', 'pages_show_list'] }),
+    });
+    return res.ok ? { account: String(ownFields(user).username), token } : null;
+}

package/dist/src/instagram-twin.js

@@ -37,7 +37,7 @@
 // that writes. The one exception is a container's id, drawn from entropy (as LinkedIn's asset ids): a
 // container is staging a branch inherits from its ancestors' annex, where an ordinal or a digest could
 // collide between a parent and a child; the determinism replay captures it and never compares it.
-import { applyTwinWrite, applyTwinWriteAtomic, blobDigest, ownFields, projectResources, resolveSubjectId, subjectAliases } from '@volter/world-core';
+import { applyTwinWrite, applyTwinWriteAtomic, blobDigest, ownFields, projectResources, resolveSubjectId, subjectAliases, worldNow } from '@volter/world-core';
 import { graphError, invalidParam, invalidToken, missingParam, noToken, ok, permissionDenied, readOnlyRefusal, ruploadFailure, ruploadOk, unknownPath, unmodeled, unsupported, } from "./instagram-errors.js";
 import { clearChunks, CONTAINER_LIFETIME_MS, containerStatus, isNumericId, listContainers, MAX_REEL_BYTES, putChunk, putInstagramBlob, readChunks, readContainer, reelSpecViolation, sniffImage, sniffVideo, withContainer, writeContainer, } from "./instagram-media.js";
 const SERVICE = 'instagram';
@@ -155,8 +155,8 @@ function resources(root) {
 }
 const ofType = (all, type) => all.filter((r) => r.type === type);
 const fields = (r) => ownFields(r);
-const nowMs = (req) => Date.parse(req.occurredAt ?? new Date().toISOString());
-const at = (req) => req.occurredAt ?? new Date().toISOString();
+const nowMs = (req) => Date.parse(req.occurredAt ?? worldNow());
+const at = (req) => req.occurredAt ?? worldNow();
 /** Meta's timestamp format: `2019-09-26T22:36:43+0000`. */
 export function igTimestamp(iso) {
     return `${new Date(iso).toISOString().slice(0, 19)}+0000`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-instagram",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Local Instagram twin (a professional account's Reels: resumable containers, the rupload upload, status_code, media_publish) with an instagram.com profile mirror, built on @volter/world-core.",
   "author": "Volter (https://github.com/volter-ai)",
   "license": "Apache-2.0",
@@ -36,14 +36,14 @@
     "postpack": "node ../../../scripts/publish/prepare-publish.mjs postpack"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.0"
+    "@volter/world-core": "2.0.2"
   },
   "devDependencies": {
     "@types/bun": "^1.2.20",
     "@types/node": "^24.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@volter/world-core": "2.0.0",
+    "@volter/world-core": "2.0.2",
     "@volter/world-tooling": "0.1.0",
     "typescript": "^5.9.0"
   },

package/src/instagram-mirror-ui.ts

@@ -19,11 +19,11 @@
 // PURE FRONTEND (R3): the mirror imports no handler and no twin internals — it MOUNTS the pack's own
 // fetch adapter as its API backend and reads every byte of state back over the wire.
 import { readFile } from 'node:fs/promises';
-import { bundleClient, fileResponse, serveHttp } from '@volter/world-core';
+import { filePathOf, bundleClient, fileResponse, ownFields, serveHttp, twinResources } from '@volter/world-core';
 import { createInstagramTwinFetch } from './instagram-server.ts';
 
-const CLIENT_ENTRY = () => new URL('../client/instagram-mirror.tsx', import.meta.url).pathname; // lazy: workerd rejects a top-level relative import.meta.url
-const CLIENT_CSS = () => new URL('../client/instagram-mirror.css', import.meta.url).pathname;
+const CLIENT_ENTRY = () => filePathOf(new URL('../client/instagram-mirror.tsx', import.meta.url)); // lazy: workerd rejects a top-level relative import.meta.url
+const CLIENT_CSS = () => filePathOf(new URL('../client/instagram-mirror.css', import.meta.url));
 
 // ---------------------------------------------------------------------------
 // Pure, dependency-free render/format helpers (importable by the React client; Bun tree-shakes the
@@ -171,3 +171,20 @@ export function instagramMirrorHtml(): string {
 export function instagramMirrorStyles(): Promise<string> {
   return readFile(CLIENT_CSS(), 'utf8');
 }
+
+/** The professional account `as` names (a username, with or without its @) and a token minted for it now: what
+ *  Instagram's screens sign in with when the World's config says `signIn: { as }` (the World hands them over,
+ *  served-world.ts). The account is read from the twin's state; the token is a fresh one, seeded through the twin's
+ *  own `/_twin/tokens` exactly as a World's seed does (tokens are held only as their SHA-256, never read back), with
+ *  the read permissions the screens use. Null when the World holds no such account, or the twin refuses the token. */
+export async function instagramMirrorSignIn(as: string, ctx: { root: string; twin: (path: string, init?: RequestInit) => Promise<Response> }): Promise<{ account: string; token: string } | null> {
+  const username = as.replace(/^@/, '').toLowerCase();
+  const user = twinResources('instagram', ctx.root).find((r) => r.type === 'ig_user' && String(ownFields(r).username ?? '').toLowerCase() === username);
+  if (!user) return null;
+  const token = crypto.randomUUID();
+  const res = await ctx.twin('/_twin/tokens', {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ token, user: String(user.id), permissions: ['instagram_basic', 'pages_read_engagement', 'pages_show_list'] }),
+  });
+  return res.ok ? { account: String(ownFields(user).username), token } : null;
+}

package/src/instagram-twin.ts

@@ -37,7 +37,7 @@
 // that writes. The one exception is a container's id, drawn from entropy (as LinkedIn's asset ids): a
 // container is staging a branch inherits from its ancestors' annex, where an ordinal or a digest could
 // collide between a parent and a child; the determinism replay captures it and never compares it.
-import { applyTwinWrite, applyTwinWriteAtomic, blobDigest, ownFields, projectResources, resolveSubjectId, subjectAliases } from '@volter/world-core';
+import { applyTwinWrite, applyTwinWriteAtomic, blobDigest, ownFields, projectResources, resolveSubjectId, subjectAliases, worldNow } from '@volter/world-core';
 import {
   graphError,
   invalidParam,
@@ -211,8 +211,8 @@ function resources(root?: string): Resource[] {
 }
 const ofType = (all: Resource[], type: string): Resource[] => all.filter((r) => r.type === type);
 const fields = (r: Resource): Record<string, any> => ownFields(r as never) as Record<string, any>;
-const nowMs = (req: InstagramRequest): number => Date.parse(req.occurredAt ?? new Date().toISOString());
-const at = (req: InstagramRequest): string => req.occurredAt ?? new Date().toISOString();
+const nowMs = (req: InstagramRequest): number => Date.parse(req.occurredAt ?? worldNow());
+const at = (req: InstagramRequest): string => req.occurredAt ?? worldNow();
 
 /** Meta's timestamp format: `2019-09-26T22:36:43+0000`. */
 export function igTimestamp(iso: string): string {