@volter/twin-x 0.1.1 → 0.1.2

package/dist/client/x-mirror.js

@@ -15,6 +15,15 @@ const SESSION_TOKEN = 'x-mirror.token';
 function readSession() {
     if (typeof sessionStorage === 'undefined')
         return null;
+    // the World signed these screens in as the account its config names (`signIn.as`): taken once, as a sign-in would
+    // (off the page once taken, and not again in this tab once the person signs out)
+    const w = window;
+    const given = sessionStorage.getItem('volter.signedOut') ? undefined : w.__VOLTER_SIGN_IN__;
+    delete w.__VOLTER_SIGN_IN__;
+    if (given && !sessionStorage.getItem(SESSION_TOKEN)) {
+        sessionStorage.setItem(SESSION_HANDLE, given.account);
+        sessionStorage.setItem(SESSION_TOKEN, given.token);
+    }
     const handle = sessionStorage.getItem(SESSION_HANDLE);
     const token = sessionStorage.getItem(SESSION_TOKEN);
     return handle && token ? { handle, token } : null;
@@ -391,6 +400,7 @@ function App() {
     const signOut = () => {
         sessionStorage.removeItem(SESSION_HANDLE);
         sessionStorage.removeItem(SESSION_TOKEN);
+        sessionStorage.setItem('volter.signedOut', '1');
         setSession(null);
         setMe(null);
         go('i/flow/login');

package/dist/src/x-mirror-ui.d.ts

@@ -59,3 +59,15 @@ export declare function createXMirrorServer(options: {
 export declare function xMirrorHtml(): string;
 /** The mirror's stylesheet, for a host serving the shell's `assets/styles.css` itself (the hosted mirror mount). */
 export declare function xMirrorStyles(): Promise<string>;
+/** The account `as` names (a username, with or without its @) and a fresh token minted for it through the twin's own
+ *  `/_twin/tokens` door, as the World's seed issues one: what X's screens sign in with when the World's config says
+ *  `signIn: { as }` (the World hands them over, served-world.ts). A stored token (the app's own, perhaps) is never read
+ *  back; this one carries only what the screens do: read posts and people, and post. Null when the World holds no such
+ *  account, or the door refuses the token. */
+export declare function xMirrorSignIn(as: string, ctx: {
+    root: string;
+    twin: (path: string, init?: RequestInit) => Promise<Response>;
+}): Promise<{
+    account: string;
+    token: string;
+} | null>;

package/dist/src/x-mirror-ui.js

@@ -14,11 +14,11 @@
 // PURE FRONTEND (R3): the mirror imports no handler and no twin internals — it MOUNTS the pack's
 // own fetch adapter as its API backend and reads every byte of state back over the wire.
 import { readFile } from 'node:fs/promises';
-import { bundleClient, fileResponse } from '@volter/world-core';
+import { twinResources, bundleClient, fileResponse, filePathOf } from '@volter/world-core';
 import { serveHttp } from '@volter/world-core';
 import { createXTwinFetch } from "./x-server.js";
-const CLIENT_ENTRY = () => new URL('../client/x-mirror.tsx', import.meta.url).pathname; // lazy: workerd rejects a top-level relative import.meta.url
-const CLIENT_CSS = () => new URL('../client/x-mirror.css', import.meta.url).pathname; // lazy: same reason
+const CLIENT_ENTRY = () => filePathOf(new URL('../client/x-mirror.tsx', import.meta.url)); // lazy: workerd rejects a top-level relative import.meta.url
+const CLIENT_CSS = () => filePathOf(new URL('../client/x-mirror.css', import.meta.url)); // lazy: same reason
 const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
 const LONG_MONTHS = ['January', 'February', 'March', 'April', 'May', 'June', 'July', 'August', 'September', 'October', 'November', 'December'];
 /** A wall-clock reading of an instant in a time zone. x.com shows the VIEWER'S local time, so the
@@ -251,3 +251,20 @@ export function xMirrorHtml() {
 export function xMirrorStyles() {
     return readFile(CLIENT_CSS(), 'utf8');
 }
+/** The account `as` names (a username, with or without its @) and a fresh token minted for it through the twin's own
+ *  `/_twin/tokens` door, as the World's seed issues one: what X's screens sign in with when the World's config says
+ *  `signIn: { as }` (the World hands them over, served-world.ts). A stored token (the app's own, perhaps) is never read
+ *  back; this one carries only what the screens do: read posts and people, and post. Null when the World holds no such
+ *  account, or the door refuses the token. */
+export async function xMirrorSignIn(as, ctx) {
+    const handle = as.replace(/^@/, '').toLowerCase();
+    const account = twinResources('x', ctx.root).find((r) => r.type === 'account' && String(r.username ?? '').toLowerCase() === handle);
+    if (!account)
+        return null;
+    const token = `volter-view-${crypto.randomUUID()}`;
+    const minted = await ctx.twin('/_twin/tokens', {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ token, account_id: account.id, scopes: ['tweet.read', 'users.read', 'tweet.write'] }),
+    });
+    return minted.ok ? { account: String(account.username), token } : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-x",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Local X (Twitter) API v2 twin (post, reply, delete, timelines, user lookup) with an x.com mirror, built on @volter/world-core.",
   "author": "Volter (https://github.com/volter-ai)",
   "license": "Apache-2.0",
@@ -36,14 +36,14 @@
     "postpack": "node ../../../scripts/publish/prepare-publish.mjs postpack"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.1"
+    "@volter/world-core": "2.0.2"
   },
   "devDependencies": {
     "@types/bun": "^1.2.20",
     "@types/node": "^24.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@volter/world-core": "2.0.1",
+    "@volter/world-core": "2.0.2",
     "@volter/world-tooling": "0.1.0",
     "twitter-api-v2": "^1.29.1",
     "typescript": "^5.9.0"

package/src/x-mirror-ui.ts

@@ -14,12 +14,12 @@
 // PURE FRONTEND (R3): the mirror imports no handler and no twin internals — it MOUNTS the pack's
 // own fetch adapter as its API backend and reads every byte of state back over the wire.
 import { readFile } from 'node:fs/promises';
-import { bundleClient, fileResponse } from '@volter/world-core';
+import { twinResources, bundleClient, fileResponse, filePathOf } from '@volter/world-core';
 import { serveHttp } from '@volter/world-core';
 import { createXTwinFetch } from './x-server.ts';
 
-const CLIENT_ENTRY = () => new URL('../client/x-mirror.tsx', import.meta.url).pathname;  // lazy: workerd rejects a top-level relative import.meta.url
-const CLIENT_CSS = () => new URL('../client/x-mirror.css', import.meta.url).pathname;    // lazy: same reason
+const CLIENT_ENTRY = () => filePathOf(new URL('../client/x-mirror.tsx', import.meta.url));  // lazy: workerd rejects a top-level relative import.meta.url
+const CLIENT_CSS = () => filePathOf(new URL('../client/x-mirror.css', import.meta.url));    // lazy: same reason
 
 // ---------------------------------------------------------------------------
 // Pure, dependency-free render/format helpers (importable by the React client; Bun tree-shakes
@@ -261,3 +261,20 @@ export function xMirrorHtml(): string {
 export function xMirrorStyles(): Promise<string> {
   return readFile(CLIENT_CSS(), 'utf8');
 }
+
+/** The account `as` names (a username, with or without its @) and a fresh token minted for it through the twin's own
+ *  `/_twin/tokens` door, as the World's seed issues one: what X's screens sign in with when the World's config says
+ *  `signIn: { as }` (the World hands them over, served-world.ts). A stored token (the app's own, perhaps) is never read
+ *  back; this one carries only what the screens do: read posts and people, and post. Null when the World holds no such
+ *  account, or the door refuses the token. */
+export async function xMirrorSignIn(as: string, ctx: { root: string; twin: (path: string, init?: RequestInit) => Promise<Response> }): Promise<{ account: string; token: string } | null> {
+  const handle = as.replace(/^@/, '').toLowerCase();
+  const account = twinResources('x', ctx.root).find((r) => r.type === 'account' && String(r.username ?? '').toLowerCase() === handle);
+  if (!account) return null;
+  const token = `volter-view-${crypto.randomUUID()}`;
+  const minted = await ctx.twin('/_twin/tokens', {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ token, account_id: account.id, scopes: ['tweet.read', 'users.read', 'tweet.write'] }),
+  });
+  return minted.ok ? { account: String(account.username), token } : null;
+}