@volter/twin-instagram 0.1.0

package/dist/src/instagram-twin.js

@@ -0,0 +1,884 @@
+// The Instagram Platform surface a professional account PUBLISHES REELS through, twinned: the IG
+// User node, its media edge (list; create a Reels container for a resumable upload), the container's
+// status_code lifecycle, media_publish, the IG Media node, content_publishing_limit, and the
+// rupload.facebook.com upload the container's `uri` names — offline, against local state.
+//
+// SCOPE. What this pack exists for: a company posts release videos to its Instagram professional
+// account as Reels, and each Reel must be previewable as instagram.com shows it before a gated deploy
+// sends it. So the write half is a Reel (a resumable upload, caption, share_to_feed, a cover or a
+// thumbnail offset) and its deletion; the read half is everything a profile (and the mirror,
+// instagram-mirror-ui.ts) needs to show it. Images, carousels, stories, video_url uploads, tags,
+// collaborators, locations, comments, insights, hashtag search and business discovery are real
+// Instagram this pack does not model: each has a manifest todo, and a request that reaches one is
+// refused by name (instagram-errors.ts `unmodeled`).
+//
+// GROUNDING. developers.facebook.com/docs/instagram-platform, read 2026-09-27: Content Publishing,
+// the IG User, IG User Media, IG Container, IG User Media Publish, IG Media and IG User Content
+// Publishing Limit references, Error Codes; and the Graph API guides for Versioning, Handle Errors
+// and Resumable Upload. Shapes below quote those pages' samples.
+//
+// VERSIONED. A path may start with `/vNN.0/`. The version table (Graph API changelog) lists v21.0 …
+// v26.0 as usable on 2026-09-27 (v20.0 expired 2026-09-24); "once a version is no longer usable, any
+// calls made to it will be defaulted to the next oldest, usable version", so an older one is served
+// as v21.0, and an unversioned call is served too. A version above v26.0 does not exist yet.
+//
+// AUTH. A token rides `access_token` (query or body) or `Authorization: Bearer|OAuth <token>`. Tokens
+// are seeded through `/_twin/tokens` and held ONLY as their SHA-256 under the `_token` bookkeeping
+// type (never deployed, never in the clear in the log). The rupload host takes the SAME token as
+// `Authorization: OAuth <token>`.
+//
+// STATE. Subjects are stored in Instagram's own response shape (architecture "shape parity"): a
+// media IS its `GET /{ig-media-id}` fields, keyed by its id, with bookkeeping under `_` fields that
+// never reach the wire. Containers are staging, not kernel state (instagram-media.ts says why).
+//
+// DETERMINISM. Every served READ is a function of (request, stored state), and a media id is a digest
+// of its write. Times are the write's `occurredAt`; a container's status is a fold of its stored
+// instants and the request's (PROCESSING_MS, CONTAINER_LIFETIME_MS), never a timer and never a read
+// that writes. The one exception is a container's id, drawn from entropy (as LinkedIn's asset ids): a
+// container is staging a branch inherits from its ancestors' annex, where an ordinal or a digest could
+// collide between a parent and a child; the determinism replay captures it and never compares it.
+import { applyTwinWrite, applyTwinWriteAtomic, blobDigest, ownFields, projectResources, resolveSubjectId, subjectAliases } from '@volter/world-core';
+import { graphError, invalidParam, invalidToken, missingParam, noToken, ok, permissionDenied, readOnlyRefusal, ruploadFailure, ruploadOk, unknownPath, unmodeled, unsupported, } from "./instagram-errors.js";
+import { clearChunks, CONTAINER_LIFETIME_MS, containerStatus, isNumericId, listContainers, MAX_REEL_BYTES, putChunk, putInstagramBlob, readChunks, readContainer, reelSpecViolation, sniffImage, sniffVideo, withContainer, writeContainer, } from "./instagram-media.js";
+const SERVICE = 'instagram';
+/** The newest Graph API version (the references' "The latest version is: v26.0"). */
+export const LATEST_VERSION = 'v26.0';
+/** The Graph API changelog's version table (read 2026-09-27): each version's release and expiry. A
+ *  version is usable until its expiry, judged at the request's (World) instant — its release date is
+ *  not held against a World whose clock is set back (an app's code names today's versions). */
+export const GRAPH_VERSIONS = [
+    { major: 19, released: '2024-01-23', expires: '2026-05-21' },
+    { major: 20, released: '2024-05-21', expires: '2026-09-24' },
+    { major: 21, released: '2024-10-02', expires: '2027-01-21' },
+    { major: 22, released: '2025-01-21', expires: '2027-05-20' },
+    { major: 23, released: '2025-05-29', expires: '2027-10-08' },
+    { major: 24, released: '2025-10-08', expires: '2028-02-18' },
+    { major: 25, released: '2026-02-18', expires: '2028-07-29' },
+    { major: 26, released: '2026-07-29', expires: null },
+];
+/** The versions usable at `nowMs`, oldest first. */
+export function usableVersions(nowMs) {
+    return GRAPH_VERSIONS.filter((v) => v.expires === null || nowMs < Date.parse(v.expires)).map((v) => v.major);
+}
+/** Meta's own hosts, minted when no served base is known. */
+const RUPLOAD_HOST = 'https://rupload.facebook.com';
+const CDN_HOST = 'https://scontent.cdninstagram.com';
+const GRAPH_HOST = 'https://graph.facebook.com';
+/** Content Publishing guide: "100 API-published posts within a 24-hour moving period"; the IG User
+ *  Media Publish and Content Publishing Limit references: 50, "quota_total … (currently 50)". The twin
+ *  serves and enforces the references' 50 — the stricter figure, and the one the endpoint reports. */
+export const PUBLISH_QUOTA_TOTAL = 50;
+export const PUBLISH_QUOTA_DURATION_S = 86_400;
+/** IG User Media: "An Instagram account can only create 400 containers within a rolling 24 hour period". */
+export const CONTAINER_QUOTA = 400;
+/** IG User Media, caption: "Maximum 2200 characters, 30 hashtags, and 20 @ tags." */
+export const MAX_CAPTION_CHARS = 2200;
+export const MAX_HASHTAGS = 30;
+export const MAX_MENTIONS = 20;
+/** Media ids the twin mints: 18 digits starting 9 — above every real IG media id (17-18 digits
+ *  starting 17/18 in 2026), so a pulled id and a minted one cannot meet. */
+const MEDIA_ID_FLOOR = 900000000000000000n;
+/** Container ids: 18 digits starting 8, drawn from entropy (containers are staging, never replayed). */
+const CONTAINER_ID_FLOOR = 800000000000000000n;
+// ── the documented closed sets ──────────────────────────────────────────────────────────────
+/** Permissions a seeded token may carry — the ones these pages name (Facebook Login and Instagram Login). */
+const PERMISSIONS = new Set([
+    'instagram_basic', 'instagram_content_publish', 'pages_read_engagement', 'pages_show_list', 'ads_management', 'ads_read',
+    'business_management', 'instagram_manage_comments', 'instagram_manage_contents', 'instagram_business_basic',
+    'instagram_business_content_publish', 'instagram_business_manage_comments',
+]);
+const IG_LOGIN_READ = ['instagram_business_basic'];
+const IG_LOGIN_PUBLISH = ['instagram_business_basic', 'instagram_business_content_publish'];
+/** IG User: instagram_basic, pages_read_engagement. */
+const READ_USER = [['instagram_basic', 'pages_read_engagement'], IG_LOGIN_READ];
+/** IG User Media, Reading: instagram_basic and pages_read_engagement or pages_show_list. */
+const LIST_MEDIA = [['instagram_basic', 'pages_read_engagement'], ['instagram_basic', 'pages_show_list'], IG_LOGIN_READ];
+/** IG Media, Reading: instagram_basic, pages_read_engagement. */
+const READ_MEDIA = [['instagram_basic', 'pages_read_engagement'], IG_LOGIN_READ];
+/** IG User Media, Creating; IG Container; Content Publishing Limit: instagram_basic,
+ *  instagram_content_publish, pages_read_engagement. */
+const CREATE = [['instagram_basic', 'instagram_content_publish', 'pages_read_engagement'], IG_LOGIN_PUBLISH];
+/** IG User Media Publish: instagram_basic, instagram_content_publish. */
+const PUBLISH = [['instagram_basic', 'instagram_content_publish'], IG_LOGIN_PUBLISH];
+/** A resumable upload session and its rupload POSTs: "Only for apps that have implemented Facebook
+ *  Login for Business" — the Facebook Login family alone. */
+const RESUMABLE = [['instagram_basic', 'instagram_content_publish']];
+/** IG Media, Deleting (Facebook Login only): instagram_basic, instagram_manage_contents. */
+const DELETE = [['instagram_basic', 'instagram_manage_contents']];
+/** IG User fields this twin serves, and the documented ones it does not. */
+const USER_FIELDS = new Set(['id', 'username', 'name', 'biography', 'website', 'followers_count', 'follows_count', 'media_count', 'profile_picture_url', 'has_profile_pic']);
+const USER_FIELDS_UNMODELED = new Set(['alt_text', 'is_published', 'legacy_instagram_user_id', 'shopping_product_tag_eligibility', 'collaborative_media_search', 'business_discovery', 'ig_id']);
+/** IG Media fields this twin serves, and the documented ones it does not. */
+const MEDIA_FIELDS = new Set(['id', 'media_type', 'media_product_type', 'media_url', 'permalink', 'caption', 'timestamp', 'thumbnail_url', 'shortcode', 'username', 'owner', 'is_shared_to_feed', 'is_comment_enabled', 'comments_count', 'like_count', 'is_ai_generated']);
+const MEDIA_FIELDS_UNMODELED = new Set(['alt_text', 'boost_ads_list', 'boost_eligibility_info', 'copyright_check_information', 'legacy_instagram_media_id', 'media_audio_type', 'view_count', 'reposts_count', 'saved_count', 'shares_count', 'total_comments_count', 'total_like_count', 'total_views_count', 'children', 'collaborators', 'comments', 'insights']);
+const CONTAINER_FIELDS = new Set(['id', 'status_code', 'status']);
+/** IG User edges this twin does not model (the IG User reference's edge table). */
+const USER_EDGES_UNMODELED = new Set(['agencies', 'authorized_adaccounts', 'connected_threads_user', 'insights', 'instagram_backed_threads_user', 'live_media', 'mentions', 'mentioned_comment', 'mentioned_media', 'recently_searched_hashtags', 'stories', 'tags', 'upcoming_events', 'collaboration_invites', 'collaborative_media', 'available_catalogs', 'catalog_product_search', 'product_appeal']);
+/** Container parameters this twin does not model on a Reel. */
+const REEL_PARAMS_UNMODELED = ['collaborators', 'user_tags', 'location_id', 'trial_params', 'product_tags', 'branded_content_sponsor_ids', 'is_paid_partnership'];
+// ── helpers ─────────────────────────────────────────────────────────────────────────────────
+function header(headers, name) {
+    if (!headers)
+        return undefined;
+    for (const [k, v] of Object.entries(headers))
+        if (k.toLowerCase() === name)
+            return v;
+    return undefined;
+}
+/** The request's parameters: the query string, then a JSON-object or form-encoded body over it
+ *  (the Graph API takes either). Values stay as sent — a JSON body may carry booleans and numbers. */
+function params(url, req) {
+    const out = {};
+    for (const [k, v] of url.searchParams)
+        out[k] = v;
+    const raw = req.body;
+    if (raw === undefined || raw.trim() === '')
+        return out;
+    const type = (header(req.headers, 'content-type') ?? '').toLowerCase();
+    if (type.includes('application/x-www-form-urlencoded') || (!type.includes('json') && !raw.trim().startsWith('{'))) {
+        for (const [k, v] of new URLSearchParams(raw))
+            out[k] = v;
+        return out;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return 'malformed';
+        return { ...out, ...parsed };
+    }
+    catch {
+        return 'malformed';
+    }
+}
+function resources(root) {
+    return projectResources(SERVICE, root);
+}
+const ofType = (all, type) => all.filter((r) => r.type === type);
+const fields = (r) => ownFields(r);
+const nowMs = (req) => Date.parse(req.occurredAt ?? new Date().toISOString());
+const at = (req) => req.occurredAt ?? new Date().toISOString();
+/** Meta's timestamp format: `2019-09-26T22:36:43+0000`. */
+export function igTimestamp(iso) {
+    return `${new Date(iso).toISOString().slice(0, 19)}+0000`;
+}
+/** A Meta timestamp back to epoch ms. */
+function timestampMs(v) {
+    return Date.parse(String(v).replace(/([+-]\d\d)(\d\d)$/, '$1:$2'));
+}
+/** The SHA-256 a token is held under — never the token itself. */
+export function tokenDigest(token) {
+    return blobDigest(new TextEncoder().encode(token));
+}
+/** A boolean parameter as the Graph API takes it: a JSON boolean or the strings true/false. */
+function boolParam(v) {
+    if (v === undefined)
+        return undefined;
+    if (v === true || v === 'true')
+        return true;
+    if (v === false || v === 'false')
+        return false;
+    return 'invalid';
+}
+const isResponse = (v) => typeof v === 'object' && v !== null && 'status' in v && 'body' in v;
+function presentedToken(req, p, schemes) {
+    const auth = header(req.headers, 'authorization');
+    const m = auth ? schemes.exec(auth.trim()) : null;
+    if (m)
+        return m[1];
+    return typeof p.access_token === 'string' && p.access_token !== '' ? p.access_token : undefined;
+}
+function authorize(all, token) {
+    if (!token)
+        return noToken();
+    const row = ofType(all, '_token').find((t) => String(t.id) === tokenDigest(token));
+    if (!row)
+        return invalidToken();
+    const f = fields(row);
+    return { user: String(f.user), permissions: new Set(Array.isArray(f.permissions) ? f.permissions.map(String) : []) };
+}
+const holds = (auth, families) => families.some((f) => f.every((p) => auth.permissions.has(p)));
+function need(auth, families, what) {
+    return holds(auth, families) ? undefined : permissionDenied(`${what} needs ${families.map((f) => f.join(' + ')).join(', or ')}`);
+}
+// ── field selection ──────────────────────────────────────────────────────────────────────────
+/** `fields=a,b,owner{id}` → ['a','b','owner'] (field expansion's braces dropped: owner answers {id}). */
+function parseFields(raw) {
+    if (typeof raw !== 'string' || raw.trim() === '')
+        return undefined;
+    const out = [];
+    let depth = 0;
+    let cur = '';
+    for (const ch of raw) {
+        if (ch === '{')
+            depth += 1;
+        else if (ch === '}')
+            depth = Math.max(0, depth - 1);
+        else if (ch === ',' && depth === 0) {
+            if (cur.trim())
+                out.push(cur.trim());
+            cur = '';
+            continue;
+        }
+        if (depth === 0 && ch !== '}')
+            cur += ch;
+    }
+    if (cur.trim())
+        out.push(cur.trim());
+    return out;
+}
+function select(node, full, requested, served, unmodeledSet) {
+    const want = requested ?? ['id'];
+    for (const f of want) {
+        if (unmodeledSet.has(f))
+            return unmodeled(`The ${f} field on ${node}`);
+        if (!served.has(f))
+            return invalidParam(`Tried accessing nonexisting field (${f}) on node type (${node})`);
+    }
+    const out = {};
+    for (const f of want)
+        if (full[f] !== undefined)
+            out[f] = full[f];
+    out.id = full.id;
+    return out;
+}
+// ── ids ───────────────────────────────────────────────────────────────────────────────────────
+/** A new media id, 18 digits in 9.0e17 … 9.9e17: a digest of the write (instant, owner, the Reel's
+ *  digest and caption — never the container's entropy-drawn id)
+ *  and the media already held, re-drawn while any held id or re-keyed local id matches — so an id a
+ *  client was once answered is never handed out again, and two identical fresh worlds replaying the
+ *  same writes serve the same ids (R9). */
+function mintMediaId(all, root, seed) {
+    const taken = new Set(ofType(all, 'media').map((m) => String(m.id)));
+    for (const key of subjectAliases(SERVICE, root).keys())
+        if (key.startsWith('media:'))
+            taken.add(key.slice('media:'.length));
+    for (let attempt = 0;; attempt += 1) {
+        const digest = blobDigest(new TextEncoder().encode(`${seed}|${taken.size}|${attempt}`));
+        const id = String(MEDIA_ID_FLOOR + BigInt(`0x${digest.slice(0, 16)}`) % 99000000000000000n);
+        if (!taken.has(id))
+            return id;
+    }
+}
+/** A new container id from entropy, re-drawn while any container this branch or its ancestors hold matches. */
+async function mintContainerId(root) {
+    const held = new Set((await listContainers(root)).map((c) => c.id));
+    for (;;) {
+        const r = crypto.getRandomValues(new Uint32Array(2));
+        const id = String(CONTAINER_ID_FLOOR + (BigInt(r[0]) * 4294967296n + BigInt(r[1])) % 99000000000000000n);
+        if (!held.has(id))
+            return id;
+    }
+}
+/** instagram.com's 11-character shortcode for a media id (a digest: stable for the id). */
+export function shortcodeFor(mediaId) {
+    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+    const hex = blobDigest(new TextEncoder().encode(`shortcode|${mediaId}`));
+    let out = '';
+    for (let i = 0; i < 11; i += 1)
+        out += alphabet[parseInt(hex.slice(i * 2, i * 2 + 2), 16) % 64];
+    return out;
+}
+// ── projection: THE one place a stored subject becomes a response body ────────────────────────
+const base = (req, host) => (req.publicBase ?? host).replace(/\/+$/, '');
+/** Where a held Reel's bytes are served: instagram's CDN path shape under the twin's base. */
+export function reelVideoUrl(req, sha256) {
+    return `${(req.publicBase ?? CDN_HOST).replace(/\/+$/, '')}/o1/v/t16/f2/m86/${sha256}.mp4`;
+}
+function isDeleted(r) {
+    return fields(r)._deleted === true || fields(r).deleted === true;
+}
+/** The account's API-published posts at or after `sinceMs`: media published through media_publish here
+ *  (carrying `_container`) — a deleted one still counts ("the number of times the app user has
+ *  published an IG Container"); a Reel pulled by a refresh does not, since it may have been posted in
+ *  the Instagram app and Meta counts API publishes. */
+function apiPublishedSince(all, owner, sinceMs) {
+    return ofType(all, 'media').filter((m) => { const f = fields(m); return typeof f._container === 'string' && String(f.owner?.id) === owner && timestampMs(f.timestamp) >= sinceMs; }).length;
+}
+function liveMedia(all, owner) {
+    return ofType(all, 'media').filter((m) => !isDeleted(m) && (owner === undefined || String(fields(m).owner?.id) === owner));
+}
+function findUser(all, id) {
+    return ofType(all, 'ig_user').find((u) => String(u.id) === id);
+}
+/** A held user as the IG User node answers it (every field it holds). */
+function projectUser(req, all, user) {
+    const f = fields(user);
+    const pic = f._profile_picture;
+    const picUrl = pic ? `${base(req, CDN_HOST)}/v/t51.2885-19/${pic.sha256}.${pic.media_type === 'image/png' ? 'png' : 'jpg'}` : typeof f.profile_picture_url === 'string' ? f.profile_picture_url : undefined;
+    return {
+        id: String(user.id),
+        username: f.username,
+        ...(typeof f.name === 'string' ? { name: f.name } : {}),
+        ...(typeof f.biography === 'string' ? { biography: f.biography } : {}),
+        ...(typeof f.website === 'string' ? { website: f.website } : {}),
+        ...(typeof f.followers_count === 'number' ? { followers_count: f.followers_count } : {}),
+        ...(typeof f.follows_count === 'number' ? { follows_count: f.follows_count } : {}),
+        media_count: liveMedia(all, String(user.id)).length,
+        ...(picUrl ? { profile_picture_url: picUrl } : {}),
+        has_profile_pic: picUrl !== undefined,
+    };
+}
+/** A held media as the IG Media node answers it: its vendor fields, the URLs of the bytes the twin
+ *  holds, no `_` bookkeeping. */
+export function projectMedia(req, all, media) {
+    const f = fields(media);
+    const out = {};
+    for (const [k, v] of Object.entries(f))
+        if (!k.startsWith('_'))
+            out[k] = v;
+    const video = f._video;
+    if (video) {
+        out.media_url = reelVideoUrl(req, video.sha256);
+        out.thumbnail_url = typeof f._cover_url === 'string' ? f._cover_url : `${(req.publicBase ?? CDN_HOST).replace(/\/+$/, '')}/v/t51.71878-15/${video.sha256}_poster.svg`;
+    }
+    const owner = findUser(all, String(f.owner?.id ?? ''));
+    if (owner)
+        out.username = fields(owner).username;
+    out.id = String(media.id);
+    return out;
+}
+function findMedia(all, id, root) {
+    const resolved = resolveSubjectId(SERVICE, 'media', id, root);
+    const m = ofType(all, 'media').find((r) => String(r.id) === resolved);
+    return m && !isDeleted(m) ? m : undefined;
+}
+/** Whether a published media names this container (the PUBLISHED status_code). */
+function publishedFrom(all, containerId) {
+    return ofType(all, 'media').some((m) => String(fields(m)._container ?? '') === containerId);
+}
+// ── the IG User node and its edges ────────────────────────────────────────────────────────────
+function getUser(req, all, auth, user, p) {
+    const refusal = need(auth, READ_USER, 'Reading an IG User');
+    if (refusal)
+        return refusal;
+    if (String(user.id) !== auth.user)
+        return unsupported('GET', String(user.id));
+    const selected = select('IGUser', projectUser(req, all, user), parseFields(p.fields), USER_FIELDS, USER_FIELDS_UNMODELED);
+    return isResponse(selected) ? selected : ok(selected);
+}
+function listMedia(req, url, all, auth, user, p, version) {
+    const refusal = need(auth, LIST_MEDIA, 'Reading an IG User\'s media');
+    if (refusal)
+        return refusal;
+    if (String(user.id) !== auth.user)
+        return unsupported('GET', String(user.id));
+    if (p.since !== undefined || p.until !== undefined)
+        return unmodeled('Time-based pagination (since / until) on /{ig-user-id}/media');
+    const requested = parseFields(p.fields);
+    for (const f of requested ?? []) {
+        if (MEDIA_FIELDS_UNMODELED.has(f))
+            return unmodeled(`The ${f} field on IGMedia`);
+        if (!MEDIA_FIELDS.has(f))
+            return invalidParam(`Tried accessing nonexisting field (${f}) on node type (IGMedia)`);
+    }
+    const rawLimit = p.limit;
+    const limit = rawLimit === undefined ? 25 : Number(rawLimit);
+    if (!Number.isInteger(limit) || limit < 1)
+        return invalidParam(`The parameter limit must be a positive integer`);
+    const pageSize = Math.min(limit, 100);
+    // newest first by timestamp; one instant newest-written first (the tree keeps write order)
+    const media = liveMedia(all, String(user.id)).map((m, i) => ({ m, i }))
+        .sort((a, b) => String(fields(b.m).timestamp).localeCompare(String(fields(a.m).timestamp)) || (b.i - a.i)).map(({ m }) => m);
+    const cursorOf = (id) => btoa(`cursor:${id}`).replace(/=+$/, '');
+    const idOf = (cursor) => { if (typeof cursor !== 'string')
+        return undefined; try {
+        const d = atob(cursor);
+        return d.startsWith('cursor:') ? d.slice(7) : undefined;
+    }
+    catch {
+        return undefined;
+    } };
+    let start = 0;
+    if (p.after !== undefined) {
+        const i = media.findIndex((m) => String(m.id) === idOf(p.after));
+        if (i < 0)
+            return invalidParam('The after cursor is not valid');
+        start = i + 1;
+    }
+    const page = media.slice(start, start + pageSize);
+    const data = page.map((m) => { const full = projectMedia(req, all, m); const out = {}; for (const f of requested ?? ['id'])
+        if (full[f] !== undefined)
+            out[f] = full[f]; out.id = full.id; return out; });
+    const body = { data };
+    if (page.length > 0) {
+        const paging = { cursors: { before: cursorOf(String(page[0].id)), after: cursorOf(String(page[page.length - 1].id)) } };
+        if (start + pageSize < media.length) {
+            const next = new URLSearchParams(url.searchParams);
+            next.delete('access_token');
+            next.set('limit', String(pageSize));
+            next.set('after', cursorOf(String(page[page.length - 1].id)));
+            paging.next = `${base(req, GRAPH_HOST)}/${version}/${user.id}/media?${next.toString()}`;
+        }
+        body.paging = paging;
+    }
+    return ok(body);
+}
+async function createContainer(req, all, auth, user, p, version) {
+    const refusal = need(auth, CREATE, 'Creating a media container');
+    if (refusal)
+        return refusal;
+    if (String(user.id) !== auth.user)
+        return permissionDenied(`Creating media on IG User ${String(user.id)}, which this token's user is not`);
+    const mediaType = p.media_type;
+    if (mediaType === undefined)
+        return p.image_url !== undefined ? unmodeled('Image posts (image_url containers)') : missingParam('image_url');
+    if (mediaType === 'CAROUSEL' || mediaType === 'STORIES' || mediaType === 'VIDEO')
+        return unmodeled(`${mediaType} containers`);
+    if (mediaType !== 'REELS')
+        return graphError(400, 100, `The media type ${String(mediaType)} is unknown.`, { subcode: 2207023, title: 'Unknown media type', userMsg: `The media type ${String(mediaType)} is unknown.` });
+    if (p.upload_type === undefined) {
+        return p.video_url !== undefined ? unmodeled('A Reel from video_url (Meta fetching a hosted video)') : missingParam('video_url');
+    }
+    if (p.upload_type !== 'resumable')
+        return invalidParam(`upload_type must be the lowercase string resumable (got ${JSON.stringify(p.upload_type)})`);
+    if (!holds(auth, RESUMABLE))
+        return permissionDenied('upload_type=resumable is only for apps that have implemented Facebook Login for Business');
+    if (p.video_url !== undefined)
+        return invalidParam('video_url is not taken by a resumable upload session; upload the video to the returned uri');
+    for (const k of REEL_PARAMS_UNMODELED)
+        if (p[k] !== undefined)
+            return unmodeled(`\`${k}\` on a Reel`);
+    if (p.alt_text !== undefined)
+        return invalidParam('alt_text is for image posts only; Reels and stories are not supported');
+    if (p.is_carousel_item !== undefined || p.children !== undefined || p.image_url !== undefined)
+        return invalidParam('A Reel takes no image_url, children or is_carousel_item; Reels cannot appear in carousels');
+    const caption = p.caption;
+    if (caption !== undefined && typeof caption !== 'string')
+        return invalidParam('caption must be a string');
+    if (typeof caption === 'string') {
+        if ([...caption].length > MAX_CAPTION_CHARS) {
+            const msg = `The submitted image's caption was ${[...caption].length} characters long. The maximum number of characters permitted for a caption is ${MAX_CAPTION_CHARS}. Please submit media with a shorter caption.`;
+            return graphError(400, 36004, msg, { subcode: 2207010, title: 'Caption too long', userMsg: msg });
+        }
+        const hashtags = caption.match(/(^|\s)#[\p{L}\p{N}_]+/gu)?.length ?? 0;
+        if (hashtags > MAX_HASHTAGS)
+            return invalidParam(`A caption may carry at most ${MAX_HASHTAGS} hashtags (it has ${hashtags})`);
+        const mentions = caption.match(/(^|\s)@[A-Za-z0-9._]+/g)?.length ?? 0;
+        if (mentions > MAX_MENTIONS)
+            return graphError(400, 100, `Cannot use more than ${MAX_MENTIONS} tags per created media.`, { subcode: 2207040, title: 'Too many tags', userMsg: `Cannot use more than ${MAX_MENTIONS} tags per created media.` });
+    }
+    const share = boolParam(p.share_to_feed);
+    if (share === 'invalid')
+        return invalidParam('share_to_feed must be true or false');
+    const ai = boolParam(p.is_ai_generated);
+    if (ai === 'invalid')
+        return invalidParam('is_ai_generated must be true or false');
+    const cover = p.cover_url;
+    if (cover !== undefined && (typeof cover !== 'string' || !/^https?:\/\/\S+$/i.test(cover)))
+        return invalidParam('cover_url must be an http(s) URL');
+    let thumbOffset;
+    if (p.thumb_offset !== undefined) {
+        thumbOffset = Number(p.thumb_offset);
+        if (!Number.isInteger(thumbOffset) || thumbOffset < 0) {
+            return graphError(400, 1, 'Thumbnail offset must be greater than or equal to 0 and less than video duration', { subcode: 2207057, title: 'Invalid thumbnail offset' });
+        }
+    }
+    const audio = p.audio_name;
+    if (audio !== undefined && (typeof audio !== 'string' || audio.trim() === ''))
+        return invalidParam('audio_name must be a non-empty string');
+    const created = nowMs(req);
+    const recent = (await listContainers(req.root)).filter((c) => c.owner === String(user.id) && created - c.created_ms < CONTAINER_LIFETIME_MS);
+    if (recent.length >= CONTAINER_QUOTA) {
+        // THE TWIN'S OWN CODE: the limit is documented, its refusal is not (the Error Codes table names
+        // code 9 only for the publishing limit); code 9, "API Too Many Calls"-family, is the closest.
+        return graphError(400, 9, `An Instagram account can only create ${CONTAINER_QUOTA} containers within a rolling 24 hour period`);
+    }
+    const id = await mintContainerId(req.root);
+    const record = {
+        id, owner: String(user.id), media_type: 'REELS', upload_type: 'resumable', created_ms: created, received: 0,
+        share_to_feed: share ?? true,
+        ...(typeof caption === 'string' ? { caption } : {}),
+        ...(typeof cover === 'string' ? { cover_url: cover } : {}),
+        ...(thumbOffset !== undefined ? { thumb_offset: thumbOffset } : {}),
+        ...(typeof audio === 'string' ? { audio_name: audio } : {}),
+        ...(ai !== undefined ? { is_ai_generated: ai } : {}),
+    };
+    await writeContainer(record, req.root);
+    // "On success, an ig-container-id and a uri is returned"
+    return ok({ id, uri: `${base(req, RUPLOAD_HOST)}/ig-api-upload/${version}/${id}` });
+}
+function getContainer(req, all, auth, c, p) {
+    const refusal = need(auth, CREATE, 'Reading an IG Container');
+    if (refusal)
+        return refusal;
+    if (c.owner !== auth.user)
+        return unsupported('GET', c.id);
+    const requested = parseFields(p.fields);
+    if (requested?.includes('copyright_check_status'))
+        return unmodeled('copyright_check_status on an IG Container');
+    const status = containerStatus(c, nowMs(req), publishedFrom(all, c.id));
+    // "status — Publishing status. If status_code is ERROR, this value will be an error subcode."
+    const full = { id: c.id, status_code: status, status: status === 'ERROR' ? String(c.error_subcode) : status };
+    const selected = select('ShadowIGMediaBuilder', full, requested, CONTAINER_FIELDS, new Set());
+    return isResponse(selected) ? selected : ok(selected);
+}
+async function publish(req, all, auth, user, p) {
+    const refusal = need(auth, PUBLISH, 'Publishing media');
+    if (refusal)
+        return refusal;
+    if (String(user.id) !== auth.user)
+        return permissionDenied(`Publishing on IG User ${String(user.id)}, which this token's user is not`);
+    const creation = p.creation_id;
+    if (creation === undefined || creation === '')
+        return missingParam('creation_id');
+    const cid = String(creation);
+    const notFound = () => graphError(400, 24, `The media builder with creation id = ${cid} does not exist or has been expired.`, { subcode: 2207008, title: 'Media builder expired', userMsg: `The media builder with creation id = ${cid} does not exist or has been expired.` });
+    const c = isNumericId(cid) ? await readContainer(cid, req.root) : undefined;
+    if (!c || c.owner !== String(user.id))
+        return notFound();
+    const status = containerStatus(c, nowMs(req), publishedFrom(all, c.id));
+    if (status === 'PUBLISHED')
+        return notFound();
+    if (status === 'EXPIRED')
+        return graphError(400, -2, 'The media you are trying to access has expired. Please try to upload again.', { subcode: 2207020, title: 'Media expired' });
+    if (status === 'IN_PROGRESS')
+        return graphError(400, 9007, 'The media is not ready for publishing, please wait for a moment', { subcode: 2207027, title: 'Media not ready', userMsg: 'The media is not ready for publishing, please wait for a moment' });
+    if (status === 'ERROR')
+        return graphError(400, -1, 'Create media fail, please try to re-create media', { subcode: 2207032, title: 'Create media fail', userMsg: c.error_reason ?? 'Create media fail, please try to re-create media' });
+    // "Instagram accounts are limited to … API-published posts within a 24-hour moving period … enforced
+    // on the POST /<IG_ID>/media_publish endpoint"
+    const now = nowMs(req);
+    if (apiPublishedSince(all, String(user.id), now - PUBLISH_QUOTA_DURATION_S * 1000 + 1) >= PUBLISH_QUOTA_TOTAL) {
+        return graphError(400, 9, 'You reached maximum number of posts that is allowed to be published by Content Publishing API.', { subcode: 2207042, title: 'Publishing limit reached', userMsg: 'You reached maximum number of posts that is allowed to be published by Content Publishing API.' });
+    }
+    const { value: id } = await applyTwinWriteAtomic(SERVICE, (held) => {
+        const minted = mintMediaId(held, req.root, `${at(req)}|${user.id}|${c.sha256}|${c.caption ?? ''}|${c.share_to_feed}`);
+        return {
+            kind: 'write',
+            value: minted,
+            write: {
+                operation: 'instagram.media.publish',
+                subjectType: 'media',
+                subjectId: minted,
+                fields: {
+                    media_type: 'VIDEO',
+                    media_product_type: 'REELS',
+                    ...(c.caption !== undefined ? { caption: c.caption } : {}),
+                    timestamp: igTimestamp(at(req)),
+                    shortcode: shortcodeFor(minted),
+                    permalink: `https://www.instagram.com/reel/${shortcodeFor(minted)}/`,
+                    owner: { id: String(user.id) },
+                    is_shared_to_feed: c.share_to_feed,
+                    is_comment_enabled: true,
+                    comments_count: 0,
+                    like_count: 0,
+                    ...(c.is_ai_generated !== undefined ? { is_ai_generated: c.is_ai_generated } : {}),
+                    // The bytes by digest, and what the container asked of them: how the mirror's player and a
+                    // deploy's upload find the Reel with no staged record needed (bookkeeping — never on the wire).
+                    _video: { sha256: c.sha256, size: c.size, width: c.video?.width, height: c.video?.height, duration_ms: c.video?.durationMs },
+                    _container: c.id,
+                    ...(c.cover_url !== undefined ? { _cover_url: c.cover_url } : {}),
+                    ...(c.thumb_offset !== undefined ? { _thumb_offset: c.thumb_offset } : {}),
+                    ...(c.audio_name !== undefined ? { _audio_name: c.audio_name } : {}),
+                    _deleted: false,
+                },
+                occurredAt: at(req),
+                actor: { kind: 'agent', id: String(user.id) },
+            },
+        };
+    }, req.root);
+    return ok({ id });
+}
+function publishingLimit(req, all, auth, user, p) {
+    const refusal = need(auth, CREATE, 'Reading content_publishing_limit');
+    if (refusal)
+        return refusal;
+    if (String(user.id) !== auth.user)
+        return unsupported('GET', String(user.id));
+    const now = nowMs(req);
+    let since = now - PUBLISH_QUOTA_DURATION_S * 1000;
+    if (p.since !== undefined) {
+        const s = Number(p.since);
+        // "A Unix timestamp no older than 24 hours."
+        if (!Number.isInteger(s) || s * 1000 < now - PUBLISH_QUOTA_DURATION_S * 1000 || s * 1000 > now)
+            return invalidParam('since must be a Unix timestamp no older than 24 hours');
+        since = s * 1000;
+    }
+    const requested = parseFields(p.fields) ?? ['quota_usage'];
+    for (const f of requested) {
+        if (f !== 'quota_usage' && f !== 'config' && f !== 'rate_limit_settings')
+            return invalidParam(`Tried accessing nonexisting field (${f}) on node type (ContentPublishingLimit)`);
+    }
+    const row = {};
+    if (requested.includes('quota_usage'))
+        row.quota_usage = apiPublishedSince(all, String(user.id), since);
+    // the reference's own example asks for `quota_usage,rate_limit_settings` and is answered `config`
+    if (requested.includes('config') || requested.includes('rate_limit_settings'))
+        row.config = { quota_total: PUBLISH_QUOTA_TOTAL, quota_duration: PUBLISH_QUOTA_DURATION_S };
+    return ok({ data: [row] });
+}
+// ── the IG Media node ─────────────────────────────────────────────────────────────────────────
+function getMedia(req, all, auth, media, p) {
+    const refusal = need(auth, READ_MEDIA, 'Reading an IG Media');
+    if (refusal)
+        return refusal;
+    if (String(fields(media).owner?.id) !== auth.user)
+        return unsupported('GET', String(media.id));
+    const selected = select('IGMedia', projectMedia(req, all, media), parseFields(p.fields), MEDIA_FIELDS, MEDIA_FIELDS_UNMODELED);
+    return isResponse(selected) ? selected : ok(selected);
+}
+async function deleteMedia(req, auth, media) {
+    // IG Media reference, Deleting: instagram_basic + instagram_manage_contents, Facebook Login only
+    const refusal = need(auth, DELETE, 'Deleting an IG Media');
+    if (refusal)
+        return refusal;
+    if (String(fields(media).owner?.id) !== auth.user)
+        return unsupported('DELETE', String(media.id));
+    await applyTwinWrite(SERVICE, {
+        operation: 'instagram.media.delete',
+        subjectType: 'media',
+        subjectId: String(media.id),
+        fields: { ...fields(media), _deleted: true },
+        occurredAt: at(req),
+        actor: { kind: 'agent', id: auth.user },
+    }, req.root);
+    return ok({ success: true, deleted_id: String(media.id) });
+}
+// ── rupload.facebook.com/ig-api-upload/{version}/{container-id} ───────────────────────────────
+async function rupload(req, url, containerId) {
+    const all = resources(req.root);
+    const p = Object.fromEntries(url.searchParams);
+    // "-H "Authorization: OAuth <ACCESS_TOKEN>"" — the host's documented scheme; `access_token` is listed
+    // too. No page says the host refuses Bearer, so the twin takes it as the Graph hosts do.
+    const token = presentedToken(req, p, /^(?:OAuth|Bearer)\s+(\S+)$/i);
+    const unauthorized = () => ruploadFailure(400, 'ProcessingFailedError', 'unauthorized user request');
+    const auth = authorize(all, token);
+    if (isResponse(auth))
+        return unauthorized();
+    if (!holds(auth, RESUMABLE))
+        return unauthorized();
+    if (req.method === 'GET') {
+        const c = await readContainer(containerId, req.root);
+        if (!c || c.owner !== auth.user)
+            return ruploadFailure(400, 'ProcessingFailedError', `Invalid container id ${containerId}`);
+        // THE TWIN'S OWN resume read: the rupload pages document no way to ask what the host holds, so the
+        // twin answers as the Graph API's Resumable Upload guide does for graph.facebook.com (`file_offset`)
+        // — the byte a resumed POST starts at (instagram.upload.offset_discovery).
+        return ok({ id: containerId, file_offset: c.received, ...(c.file_size !== undefined ? { file_size: c.file_size } : {}) });
+    }
+    if (header(req.headers, 'file_url') !== undefined)
+        return unmodeled('Uploading a Reel from a hosted file_url (Meta fetching it)');
+    return withContainer(containerId, req.root, async () => {
+        const c = await readContainer(containerId, req.root);
+        if (!c || c.owner !== auth.user)
+            return ruploadFailure(400, 'ProcessingFailedError', `Invalid container id ${containerId}`);
+        const now = nowMs(req);
+        if (now >= c.created_ms + CONTAINER_LIFETIME_MS)
+            return ruploadFailure(400, 'ProcessingFailedError', `Container ${containerId} has expired`);
+        if (c.file_size !== undefined && c.received === c.file_size)
+            return ruploadFailure(400, 'ProcessingFailedError', `Container ${containerId} has already received its whole file`);
+        const offset = Number(header(req.headers, 'offset') ?? '0');
+        const fileSize = Number(header(req.headers, 'file_size'));
+        if (!Number.isInteger(fileSize) || fileSize <= 0)
+            return ruploadFailure(400, 'ProcessingFailedError', 'The file_size header must be the size of the file in bytes');
+        // THE TWIN'S OWN BOUND: a declared file over the Reels maximum is refused before its bytes are staged
+        // (Meta's answer to one is undocumented; the twin will not hold a file no Reel may be)
+        if (fileSize > MAX_REEL_BYTES)
+            return ruploadFailure(400, 'ProcessingFailedError', `file_size ${fileSize} is over the Reels maximum of 300MB`);
+        if (c.file_size !== undefined && c.file_size !== fileSize)
+            return ruploadFailure(400, 'ProcessingFailedError', `file_size ${fileSize} differs from the ${c.file_size} this upload began with`);
+        if (!Number.isInteger(offset) || offset < 0)
+            return ruploadFailure(400, 'ProcessingFailedError', 'The offset header must be the first byte being uploaded');
+        if (offset !== c.received)
+            return ruploadFailure(400, 'ProcessingFailedError', `offset ${offset} does not continue the upload: resume at offset ${c.received}`);
+        const bytes = req.bytes ?? new Uint8Array();
+        if (bytes.length === 0)
+            return ruploadFailure(400, 'ProcessingFailedError', 'The request carries no bytes');
+        if (offset + bytes.length > fileSize)
+            return ruploadFailure(400, 'ProcessingFailedError', `${bytes.length} bytes at offset ${offset} run past file_size ${fileSize}`);
+        await putChunk(c.id, offset, bytes, req.root);
+        const received = offset + bytes.length;
+        if (received < fileSize) {
+            await writeContainer({ ...c, file_size: fileSize, received }, req.root);
+            // An upload that stops short is kept: the next POST resumes at `offset` = the bytes received. THE
+            // TWIN'S OWN ANSWER (the pages document only the whole-file success and the failure): the offset
+            // held, and deliberately no `success`, so no client reads a piece as the whole file.
+            return ok({ offset: received, file_size: fileSize });
+        }
+        const chunks = await readChunks(c.id, req.root);
+        const whole = new Uint8Array(chunks.reduce((n, x) => n + x.length, 0));
+        let o = 0;
+        for (const x of chunks) {
+            whole.set(x, o);
+            o += x.length;
+        }
+        if (whole.length !== fileSize)
+            return ruploadFailure(400, 'ProcessingFailedError', `The stored chunks hold ${whole.length} of ${fileSize} bytes; upload again from offset 0`);
+        const stored = await putInstagramBlob(whole, req.root);
+        await clearChunks(c.id, req.root);
+        // Processing, as Meta does it after the upload: a file outside the Reels specification leaves the
+        // container in ERROR (its subcode on `status`) rather than refusing the upload.
+        const info = sniffVideo(whole);
+        // "If you specify both cover_url and thumb_offset, we use cover_url and ignore thumb_offset."
+        const violation = reelSpecViolation(info, whole.length, c.cover_url === undefined ? c.thumb_offset : undefined);
+        await writeContainer({
+            ...c, file_size: fileSize, received, uploaded_ms: now, sha256: stored.sha256, size: whole.length,
+            ...(info ? { video: info } : {}),
+            ...(violation ? { error_subcode: violation.subcode, error_reason: violation.reason } : {}),
+        }, req.root);
+        return ruploadOk();
+    });
+}
+// ── the twin control plane ───────────────────────────────────────────────────────────────────
+// Not vendor surface. `/_twin/*` is how a WORLD seeds what Instagram's own app and the Facebook Login
+// leg would have made: the professional account, and the access token the OAuth flow would have minted
+// (held only as its SHA-256).
+async function handleTwinControl(req, all, path, body) {
+    if (req.method !== 'POST')
+        return unknownPath(path);
+    if (path === '/_twin/users') {
+        const id = String(body.id ?? '');
+        if (!isNumericId(id))
+            return invalidParam('id must be a numeric IG user id');
+        if (typeof body.username !== 'string' || !/^[a-z0-9._]{1,30}$/.test(body.username))
+            return invalidParam('username must be 1-30 of a-z 0-9 . _');
+        if (ofType(all, 'ig_user').some((u) => String(u.id) !== id && fields(u).username === body.username))
+            return invalidParam(`username ${body.username} is already another account's`);
+        for (const k of ['name', 'biography', 'website'])
+            if (body[k] !== undefined && typeof body[k] !== 'string')
+                return invalidParam(`${k} must be a string`);
+        for (const k of ['followers_count', 'follows_count'])
+            if (body[k] !== undefined && (!Number.isInteger(body[k]) || body[k] < 0))
+                return invalidParam(`${k} must be a non-negative integer`);
+        let picture;
+        if (body.profile_picture !== undefined) {
+            if (typeof body.profile_picture !== 'string')
+                return invalidParam('profile_picture must be base64 JPEG or PNG bytes');
+            const bytes = Uint8Array.from(atob(body.profile_picture), (ch) => ch.charCodeAt(0));
+            const info = sniffImage(bytes);
+            if (!info)
+                return invalidParam('profile_picture must be base64 JPEG or PNG bytes');
+            picture = { sha256: (await putInstagramBlob(bytes, req.root)).sha256, media_type: info.mediaType };
+        }
+        const f = {
+            username: body.username,
+            ...(body.name !== undefined ? { name: body.name } : {}),
+            ...(body.biography !== undefined ? { biography: body.biography } : {}),
+            ...(body.website !== undefined ? { website: body.website } : {}),
+            ...(body.followers_count !== undefined ? { followers_count: body.followers_count } : {}),
+            ...(body.follows_count !== undefined ? { follows_count: body.follows_count } : {}),
+            ...(picture ? { _profile_picture: picture } : {}),
+        };
+        await applyTwinWrite(SERVICE, { operation: 'instagram.twin.seed_user', subjectType: 'ig_user', subjectId: id, fields: f, occurredAt: at(req) }, req.root);
+        return ok({ id, username: body.username });
+    }
+    if (path === '/_twin/tokens') {
+        const token = body.token;
+        if (typeof token !== 'string' || !/^[A-Za-z0-9._~-]{8,512}$/.test(token))
+            return invalidParam('token must be 8-512 characters of A-Z a-z 0-9 . _ ~ -');
+        const user = String(body.user ?? '');
+        if (!findUser(all, user))
+            return invalidParam(`user ${user} is not a seeded IG user id`);
+        const permissions = Array.isArray(body.permissions) ? body.permissions.map(String) : String(body.permissions ?? '').split(/[\s,]+/).filter((s) => s !== '');
+        for (const x of permissions)
+            if (!PERMISSIONS.has(x))
+                return invalidParam(`permission ${x} is not one these pages name`);
+        // held as its SHA-256 under a bookkeeping type: the token never enters the log in the clear
+        await applyTwinWrite(SERVICE, { operation: 'instagram.twin.seed_token', subjectType: '_token', subjectId: tokenDigest(token), fields: { user, permissions }, occurredAt: at(req) }, req.root);
+        return ok({ user, permissions });
+    }
+    return unknownPath(path);
+}
+// ── the router ───────────────────────────────────────────────────────────────────────────────
+const RUPLOAD = /^\/ig-api-upload\/(?:(v\d+\.\d+)\/)?(\d{1,25})$/;
+const VERSIONED = /^\/(v(\d+)\.(\d+))(\/.*)?$/;
+export async function handleInstagramTwinRequest(req) {
+    const url = new URL(req.path, 'http://twin.local');
+    const rawPath = url.pathname.replace(/\/+$/, '') || '/';
+    const method = req.method.toUpperCase();
+    const up = RUPLOAD.exec(rawPath);
+    // a rupload version the changelog table does not hold is no upload path (the twin's own refusal)
+    if (up && up[1] !== undefined && !GRAPH_VERSIONS.some((v) => up[1] === `v${v.major}.0`))
+        return ruploadFailure(400, 'ProcessingFailedError', 'Invalid upload path');
+    if (up) {
+        if (method !== 'POST' && method !== 'GET')
+            return ruploadFailure(405, 'ProcessingFailedError', `${method} is not an upload`);
+        if (method === 'POST' && req.readOnly)
+            return readOnlyRefusal();
+        return rupload(req, url, up[2]);
+    }
+    if (rawPath.startsWith('/ig-api-upload'))
+        return ruploadFailure(400, 'ProcessingFailedError', 'Invalid upload path');
+    const p = params(url, req);
+    if (p === 'malformed')
+        return invalidParam('The request body could not be parsed');
+    const all = resources(req.root);
+    if (rawPath.startsWith('/_twin/')) {
+        if (req.readOnly)
+            return readOnlyRefusal();
+        return handleTwinControl(req, all, rawPath, p);
+    }
+    // the version: served, defaulted to the oldest usable (the versioning guide), or one newer than the
+    // table knows (the twin's refusal wording: the pages read give none)
+    const usable = usableVersions(nowMs(req));
+    let version = `v${usable[usable.length - 1] ?? 26}.0`;
+    let path = rawPath;
+    const v = VERSIONED.exec(rawPath);
+    if (v) {
+        const major = Number(v[2]);
+        if (v[3] !== '0' || major > (usable[usable.length - 1] ?? 26))
+            return unknownPath(rawPath);
+        version = major < (usable[0] ?? major) ? `v${usable[0]}.0` : v[1];
+        path = v[4] ?? '/';
+    }
+    const segments = path.split('/').filter(Boolean);
+    if (segments.length === 0 || segments.length > 2)
+        return unknownPath(rawPath);
+    const auth = authorize(all, presentedToken(req, p, /^(?:Bearer|OAuth)\s+(\S+)$/i));
+    if (isResponse(auth))
+        return auth;
+    const write = method !== 'GET' && method !== 'HEAD';
+    if (write && req.readOnly)
+        return readOnlyRefusal();
+    const [node, edge] = segments;
+    const id = node === 'me' ? auth.user : node;
+    if (!isNumericId(id))
+        return unsupported(method, id);
+    const user = findUser(all, id);
+    if (user) {
+        if (edge === undefined) {
+            if (method === 'GET')
+                return getUser(req, all, auth, user, p);
+            return unsupported(method, id);
+        }
+        if (edge === 'media') {
+            if (method === 'GET')
+                return listMedia(req, url, all, auth, user, p, version);
+            if (method === 'POST')
+                return createContainer(req, all, auth, user, p, version);
+            return unsupported(method, id);
+        }
+        if (edge === 'media_publish') {
+            if (method === 'POST')
+                return publish(req, all, auth, user, p);
+            return unsupported(method, id);
+        }
+        if (edge === 'content_publishing_limit') {
+            if (method === 'GET')
+                return publishingLimit(req, all, auth, user, p);
+            return unsupported(method, id);
+        }
+        if (USER_EDGES_UNMODELED.has(edge))
+            return unmodeled(`The ${edge} edge on an IG User`);
+        return invalidParam(`Tried accessing nonexisting field (${edge}) on node type (IGUser)`);
+    }
+    const media = findMedia(all, id, req.root);
+    if (media) {
+        if (edge !== undefined) {
+            if (edge === 'children' || edge === 'comments' || edge === 'insights' || edge === 'collaborators')
+                return unmodeled(`The ${edge} edge on an IG Media`);
+            return invalidParam(`Tried accessing nonexisting field (${edge}) on node type (IGMedia)`);
+        }
+        if (method === 'GET')
+            return getMedia(req, all, auth, media, p);
+        if (method === 'DELETE')
+            return deleteMedia(req, auth, media);
+        if (method === 'POST')
+            return unmodeled('Updating an IG Media (comment_enabled)');
+        return unsupported(method, id);
+    }
+    const container = edge === undefined ? await readContainer(id, req.root) : undefined;
+    if (container && method === 'GET')
+        return getContainer(req, all, auth, container, p);
+    return unsupported(method, id);
+}