@volter/twin-x 0.1.2 → 0.1.4

package/README.md

@@ -104,6 +104,39 @@ lookahead and the timeline rules need a trailing segment, so `/2/users/me` match
 and no request is claimable by both. An unclaimed path on that claimed host is refused loudly rather than mis-routed into a
 twin that cannot serve it.
 
+## x.com's public pages
+
+An app that posts links the person to the post where it was published (Postiz:
+`https://twitter.com/<handle>/status/<id>`). Inside a World that link opens here: this pack claims
+`x.com` and `twitter.com` for exactly two anchored path shapes and serves them from its store
+(`src/x-web.ts`), with no sign-in, as X shows a public page to anyone:
+
+- `/<handle>/status/<id>` — the post's page: the author's name, `@handle` and verified mark, the
+  text with its mentions and links, its images or video, a quoted post, and the full time (drawn in
+  UTC — the page has no viewer's zone). Under another handle, or the author's in another case, it is
+  a 307 to the author's own URL, as x.com answers; a deleted post or an id no post has is a 404 with
+  X's "this page doesn't exist" words; a protected account's post shows X's protected notice.
+- `/<handle>` — the profile (name, handle, bio, location, website, joined date) over its posts, newest
+  first, each linking to its page; replies stay off it (X's Posts tab). The handle is
+  case-insensitive; a handle no account has is a 404 ("This account doesn't exist").
+- An account without a photo is drawn with X's default avatar — the grey silhouette at the default
+  `profile_image_url` the API answers for it, redrawn inline (the pack claims no `abs.twimg.com`). A
+  photo an account set is not drawn yet (todo `x.web.profile_photo`): it keeps a lettered placeholder.
+- A trailing slash is a 307 to the path without it. `twitter.com` answers with a 301 to `x.com`,
+  `www.x.com` and `www.twitter.com` with a 301 to `twitter.com`, `mobile.twitter.com` with a 302 to
+  `twitter.com` and `mobile.x.com` with a 302 to `x.com`.
+
+Those status codes are x.com's own, observed logged out on 2026-09-28 (`curl -A 'Mozilla/5.0'`; the
+requests are in `src/x-web.ts`). X's top-level routes (`home`, `grok`, `premium`, …) are never read
+as a handle.
+
+Images and video on those pages load from `pbs.twimg.com` and `video.twimg.com` — X's own media
+hosts — which this pack also claims, for exactly the paths it serves from its blob store. `x.com` is
+shared with xidentity (its OAuth consent screen at `/i/oauth2/authorize` and its `/_twin/` doors);
+the handle rule never admits `i` or `_twin`, so the two claims are disjoint
+(`scripts/vendor-hosts.test.ts`). Replies under a post and x.com's logged-out chrome are manifest
+todos (`x.web.*`).
+
 ## The mirror — x.com's view of the twin
 
 A person doing X's core job opens a browser, so this pack ships a mirror: x.com's own look over the