@volter/twin-linkedin 0.1.0 → 0.1.2

package/dist/client/linkedin-mirror.js

@@ -14,6 +14,15 @@ const SESSION_TOKEN = 'linkedin-mirror.token';
 function readSession() {
     if (typeof sessionStorage === 'undefined')
         return null;
+    // the World signed these screens in as the member its config names (`signIn.as`): taken once, as a sign-in would
+    // (off the page once taken, and not again in this tab once the person signs out)
+    const w = window;
+    const given = sessionStorage.getItem('volter.signedOut') ? undefined : w.__VOLTER_SIGN_IN__;
+    delete w.__VOLTER_SIGN_IN__;
+    if (given && !sessionStorage.getItem(SESSION_TOKEN)) {
+        sessionStorage.setItem(SESSION_EMAIL, given.account);
+        sessionStorage.setItem(SESSION_TOKEN, given.token);
+    }
     const email = sessionStorage.getItem(SESSION_EMAIL);
     const token = sessionStorage.getItem(SESSION_TOKEN);
     return email && token ? { email, token } : null;
@@ -374,6 +383,7 @@ function App() {
     const signOut = () => {
         sessionStorage.removeItem(SESSION_EMAIL);
         sessionStorage.removeItem(SESSION_TOKEN);
+        sessionStorage.setItem('volter.signedOut', '1');
         setSession(null);
         go('login');
     };

package/dist/src/linkedin-mirror-ui.d.ts

@@ -57,3 +57,18 @@ export declare function createLinkedinMirrorServer(options: {
 export declare function linkedinMirrorHtml(): string;
 /** The mirror's stylesheet, for a host serving the shell's `assets/styles.css` itself (the hosted mirror mount). */
 export declare function linkedinMirrorStyles(): Promise<string>;
+/** How the World reaches this twin while it serves: its root, and the twin's own fetch (same-origin paths). */
+export type MirrorSignInContext = {
+    root: string;
+    twin: (path: string, init?: RequestInit) => Promise<Response>;
+};
+/** The member `as` names (an email, a member id, or the vanity name of an organization it administers; with or without
+ *  a leading @, any case) and a fresh token minted for it through the twin's own `/_twin/tokens` door, as the World's
+ *  seed issues one: what LinkedIn's screens sign in with when the World's config says `signIn: { as }` (the World hands
+ *  them over, served-world.ts). `account` is the member's email, the identity the screens' own sign-in keeps. No stored
+ *  bearer is read back (the twin keeps a token as its own id, as the seed's are kept). Null when the World holds no
+ *  such member, or the door refuses the token. */
+export declare function linkedinMirrorSignIn(as: string, ctx: MirrorSignInContext): Promise<{
+    account: string;
+    token: string;
+} | null>;

package/dist/src/linkedin-mirror-ui.js

@@ -16,10 +16,10 @@
 // PURE FRONTEND (R3): the mirror imports no handler and no twin internals — it MOUNTS the pack's own
 // fetch adapter as its API backend and reads every byte of state back over the wire.
 import { readFile } from 'node:fs/promises';
-import { bundleClient, fileResponse, serveHttp } from '@volter/world-core';
+import { filePathOf, bundleClient, fileResponse, ownFields, serveHttp, twinResources } from '@volter/world-core';
 import { createLinkedinTwinFetch } from "./linkedin-server.js";
-const CLIENT_ENTRY = () => new URL('../client/linkedin-mirror.tsx', import.meta.url).pathname; // lazy: workerd rejects a top-level relative import.meta.url
-const CLIENT_CSS = () => new URL('../client/linkedin-mirror.css', import.meta.url).pathname;
+const CLIENT_ENTRY = () => filePathOf(new URL('../client/linkedin-mirror.tsx', import.meta.url)); // lazy: workerd rejects a top-level relative import.meta.url
+const CLIENT_CSS = () => filePathOf(new URL('../client/linkedin-mirror.css', import.meta.url));
 /** The version the mirror's reads pin — the twin's newest. */
 export const MIRROR_VERSION = '202609';
 /** linkedin.com's feed timestamp: "now", "5m", "3h", "2d", "1w", "3mo", "1yr". `nowMs` is passed in. */
@@ -172,3 +172,37 @@ export function linkedinMirrorHtml() {
 export function linkedinMirrorStyles() {
     return readFile(CLIENT_CSS(), 'utf8');
 }
+/** Only what the screens read: who is signed in (with the email the screens compare), the organizations the member
+ *  administers, and their posts. The member's organization roles still gate each read. */
+const SIGN_IN_SCOPES = ['openid', 'email', 'r_organization_admin', 'r_organization_social'];
+/** The member `as` names (an email, a member id, or the vanity name of an organization it administers; with or without
+ *  a leading @, any case) and a fresh token minted for it through the twin's own `/_twin/tokens` door, as the World's
+ *  seed issues one: what LinkedIn's screens sign in with when the World's config says `signIn: { as }` (the World hands
+ *  them over, served-world.ts). `account` is the member's email, the identity the screens' own sign-in keeps. No stored
+ *  bearer is read back (the twin keeps a token as its own id, as the seed's are kept). Null when the World holds no
+ *  such member, or the door refuses the token. */
+export async function linkedinMirrorSignIn(as, ctx) {
+    const rows = twinResources('linkedin', ctx.root);
+    const f = (r) => ownFields(r);
+    const want = as.trim().replace(/^@/, '').toLowerCase();
+    const members = rows.filter((r) => r.type === 'member');
+    let member = members.find((m) => String(f(m).email ?? '').toLowerCase() === want || m.id.toLowerCase() === want);
+    if (!member) {
+        // an organization's vanity name signs in as the member who administers it, when exactly one does (with two, which
+        // would depend on the order of the rows, so nobody is signed in)
+        const org = rows.find((r) => r.type === 'organization' && String(f(r).vanityName ?? '').toLowerCase() === want);
+        const admins = org ? rows.filter((r) => r.type === 'organization_acl' && f(r).organization === `urn:li:organization:${org.id}` && f(r).role === 'ADMINISTRATOR' && (f(r).state ?? 'APPROVED') === 'APPROVED') : [];
+        const acl = admins.length === 1 ? admins[0] : undefined;
+        const person = acl ? /^urn:li:person:(.+)$/.exec(String(f(acl).roleAssignee)) : null;
+        member = person ? members.find((m) => m.id === person[1]) : undefined;
+    }
+    const email = member ? f(member).email : undefined;
+    if (!member || typeof email !== 'string')
+        return null;
+    const token = `volter-view-${crypto.randomUUID()}`;
+    const minted = await ctx.twin('/_twin/tokens', {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ token, member: `urn:li:person:${member.id}`, scopes: SIGN_IN_SCOPES }),
+    });
+    return minted.ok ? { account: email, token } : null;
+}

package/dist/src/linkedin-twin.js

@@ -28,7 +28,7 @@
 //
 // DETERMINISM. Every served answer is a function of (request, stored state). Times are the write's
 // `occurredAt`; a video's processing is a fold of its finalize instant and the request's (PROCESSING_MS), never a timer and never a read that writes.
-import { applyTwinWrite, applyTwinWriteAtomic, blobDigest, ownFields, projectResources, resolveSubjectId, subjectAliases } from '@volter/world-core';
+import { applyTwinWrite, applyTwinWriteAtomic, blobDigest, ownFields, projectResources, resolveSubjectId, subjectAliases, worldNow } from '@volter/world-core';
 import { accessDenied, emptyAccessToken, invalidAccessToken, invalidUrnId, invalidUrnType, invalidValue, missingField, noContent, notFound, ok, problem, readOnlyRefusal, unmodeled, versionInactive, versionMissing, } from "./linkedin-errors.js";
 import { aspectRatio, clearParts, isAssetId, listAssetIds, MAX_IMAGE_PIXELS, MAX_VIDEO_BYTES, MAX_VIDEO_MS, MIN_VIDEO_BYTES, MIN_VIDEO_MS, putLinkedinBlob, putPart, readAsset, readPart, assetAsOf, newUploadSecret, signUpload, withAsset, assetIsOwn, hasUploadSecret, sniffImage, sniffVideo, UPLOAD_URL_LIFETIME_MS, verifyUpload, VIDEO_PART_BYTES, writeAsset, } from "./linkedin-media.js";
 const SERVICE = 'linkedin';
@@ -93,8 +93,8 @@ function resources(root) {
 }
 const ofType = (all, type) => all.filter((r) => r.type === type);
 const fields = (r) => ownFields(r);
-const nowMs = (req) => Date.parse(req.occurredAt ?? new Date().toISOString());
-const at = (req) => req.occurredAt ?? new Date().toISOString();
+const nowMs = (req) => Date.parse(req.occurredAt ?? worldNow());
+const at = (req) => req.occurredAt ?? worldNow();
 const ORG_URN = /^urn:li:organization:(\d{1,19})$/;
 const PERSON_URN = /^urn:li:person:([A-Za-z0-9_-]{1,40})$/;
 const POST_URN = /^urn:li:(share|ugcPost):(\d{1,19})$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-linkedin",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Local LinkedIn twin (organization posts with image, video or article; the Images and Videos upload protocols; admin roles) with a linkedin.com company-page mirror, built on @volter/world-core.",
   "author": "Volter (https://github.com/volter-ai)",
   "license": "Apache-2.0",
@@ -36,14 +36,14 @@
     "postpack": "node ../../../scripts/publish/prepare-publish.mjs postpack"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.0"
+    "@volter/world-core": "2.0.2"
   },
   "devDependencies": {
     "@types/bun": "^1.2.20",
     "@types/node": "^24.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@volter/world-core": "2.0.0",
+    "@volter/world-core": "2.0.2",
     "@volter/world-tooling": "0.1.0",
     "linkedin-api-client": "^0.3.0",
     "typescript": "^5.9.0"

package/src/linkedin-mirror-ui.ts

@@ -16,11 +16,11 @@
 // PURE FRONTEND (R3): the mirror imports no handler and no twin internals — it MOUNTS the pack's own
 // fetch adapter as its API backend and reads every byte of state back over the wire.
 import { readFile } from 'node:fs/promises';
-import { bundleClient, fileResponse, serveHttp } from '@volter/world-core';
+import { filePathOf, bundleClient, fileResponse, ownFields, serveHttp, twinResources } from '@volter/world-core';
 import { createLinkedinTwinFetch } from './linkedin-server.ts';
 
-const CLIENT_ENTRY = () => new URL('../client/linkedin-mirror.tsx', import.meta.url).pathname; // lazy: workerd rejects a top-level relative import.meta.url
-const CLIENT_CSS = () => new URL('../client/linkedin-mirror.css', import.meta.url).pathname;
+const CLIENT_ENTRY = () => filePathOf(new URL('../client/linkedin-mirror.tsx', import.meta.url)); // lazy: workerd rejects a top-level relative import.meta.url
+const CLIENT_CSS = () => filePathOf(new URL('../client/linkedin-mirror.css', import.meta.url));
 
 // ---------------------------------------------------------------------------
 // Pure, dependency-free render/format helpers (importable by the React client; Bun tree-shakes the
@@ -180,3 +180,41 @@ export function linkedinMirrorHtml(): string {
 export function linkedinMirrorStyles(): Promise<string> {
   return readFile(CLIENT_CSS(), 'utf8');
 }
+
+/** How the World reaches this twin while it serves: its root, and the twin's own fetch (same-origin paths). */
+export type MirrorSignInContext = { root: string; twin: (path: string, init?: RequestInit) => Promise<Response> };
+
+/** Only what the screens read: who is signed in (with the email the screens compare), the organizations the member
+ *  administers, and their posts. The member's organization roles still gate each read. */
+const SIGN_IN_SCOPES = ['openid', 'email', 'r_organization_admin', 'r_organization_social'];
+
+/** The member `as` names (an email, a member id, or the vanity name of an organization it administers; with or without
+ *  a leading @, any case) and a fresh token minted for it through the twin's own `/_twin/tokens` door, as the World's
+ *  seed issues one: what LinkedIn's screens sign in with when the World's config says `signIn: { as }` (the World hands
+ *  them over, served-world.ts). `account` is the member's email, the identity the screens' own sign-in keeps. No stored
+ *  bearer is read back (the twin keeps a token as its own id, as the seed's are kept). Null when the World holds no
+ *  such member, or the door refuses the token. */
+export async function linkedinMirrorSignIn(as: string, ctx: MirrorSignInContext): Promise<{ account: string; token: string } | null> {
+  const rows = twinResources('linkedin', ctx.root);
+  const f = (r: (typeof rows)[number]) => ownFields(r);
+  const want = as.trim().replace(/^@/, '').toLowerCase();
+  const members = rows.filter((r) => r.type === 'member');
+  let member = members.find((m) => String(f(m).email ?? '').toLowerCase() === want || m.id.toLowerCase() === want);
+  if (!member) {
+    // an organization's vanity name signs in as the member who administers it, when exactly one does (with two, which
+    // would depend on the order of the rows, so nobody is signed in)
+    const org = rows.find((r) => r.type === 'organization' && String(f(r).vanityName ?? '').toLowerCase() === want);
+    const admins = org ? rows.filter((r) => r.type === 'organization_acl' && f(r).organization === `urn:li:organization:${org.id}` && f(r).role === 'ADMINISTRATOR' && (f(r).state ?? 'APPROVED') === 'APPROVED') : [];
+    const acl = admins.length === 1 ? admins[0] : undefined;
+    const person = acl ? /^urn:li:person:(.+)$/.exec(String(f(acl).roleAssignee)) : null;
+    member = person ? members.find((m) => m.id === person[1]) : undefined;
+  }
+  const email = member ? f(member).email : undefined;
+  if (!member || typeof email !== 'string') return null;
+  const token = `volter-view-${crypto.randomUUID()}`;
+  const minted = await ctx.twin('/_twin/tokens', {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ token, member: `urn:li:person:${member.id}`, scopes: SIGN_IN_SCOPES }),
+  });
+  return minted.ok ? { account: email, token } : null;
+}

package/src/linkedin-twin.ts

@@ -28,7 +28,7 @@
 //
 // DETERMINISM. Every served answer is a function of (request, stored state). Times are the write's
 // `occurredAt`; a video's processing is a fold of its finalize instant and the request's (PROCESSING_MS), never a timer and never a read that writes.
-import { applyTwinWrite, applyTwinWriteAtomic, blobDigest, ownFields, projectResources, resolveSubjectId, subjectAliases } from '@volter/world-core';
+import { applyTwinWrite, applyTwinWriteAtomic, blobDigest, ownFields, projectResources, resolveSubjectId, subjectAliases, worldNow } from '@volter/world-core';
 import {
   accessDenied,
   emptyAccessToken,
@@ -159,8 +159,8 @@ function resources(root?: string): Resource[] {
 
 const ofType = (all: Resource[], type: string): Resource[] => all.filter((r) => r.type === type);
 const fields = (r: Resource): Record<string, any> => ownFields(r as never) as Record<string, any>;
-const nowMs = (req: LinkedinRequest): number => Date.parse(req.occurredAt ?? new Date().toISOString());
-const at = (req: LinkedinRequest): string => req.occurredAt ?? new Date().toISOString();
+const nowMs = (req: LinkedinRequest): number => Date.parse(req.occurredAt ?? worldNow());
+const at = (req: LinkedinRequest): string => req.occurredAt ?? worldNow();
 
 const ORG_URN = /^urn:li:organization:(\d{1,19})$/;
 const PERSON_URN = /^urn:li:person:([A-Za-z0-9_-]{1,40})$/;