@rmdes/indiekit-endpoint-activitypub 2.9.2 → 2.10.1

package/assets/reader.css

@@ -1094,6 +1094,58 @@
   outline-offset: -2px;
 }
 
+.ap-compose__cw {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-xs);
+}
+
+.ap-compose__cw-toggle {
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  gap: var(--space-xs);
+  font-size: var(--font-size-s);
+  color: var(--color-on-offset);
+}
+
+.ap-compose__cw-input {
+  border: var(--border-width-thin) solid var(--color-outline);
+  border-radius: var(--border-radius-small);
+  background: var(--color-offset);
+  color: var(--color-on-background);
+  font: inherit;
+  font-size: var(--font-size-s);
+  padding: var(--space-s);
+  width: 100%;
+}
+
+.ap-compose__cw-input:focus {
+  border-color: var(--color-primary);
+  outline: none;
+}
+
+.ap-compose__visibility {
+  border: var(--border-width-thin) solid var(--color-outline);
+  border-radius: var(--border-radius-small);
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--space-s) var(--space-m);
+  padding: var(--space-m);
+}
+
+.ap-compose__visibility legend {
+  font-weight: 600;
+}
+
+.ap-compose__visibility-option {
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  gap: var(--space-xs);
+  font-size: var(--font-size-s);
+}
+
 .ap-compose__syndication {
   border: var(--border-width-thin) solid var(--color-outline);
   border-radius: var(--border-radius-small);
@@ -2996,6 +3048,53 @@
   z-index: 2;
 }
 
+/* ==========================================================================
+   Poll / Question
+   ========================================================================== */
+
+.ap-poll {
+  margin-top: var(--space-s);
+}
+
+.ap-poll__option {
+  position: relative;
+  padding: var(--space-xs) var(--space-s);
+  margin-bottom: var(--space-xs);
+  border-radius: var(--border-radius-small);
+  background: var(--color-offset);
+  overflow: hidden;
+}
+
+.ap-poll__bar {
+  position: absolute;
+  top: 0;
+  left: 0;
+  bottom: 0;
+  background: var(--color-primary);
+  opacity: 0.15;
+  border-radius: var(--border-radius-small);
+}
+
+.ap-poll__label {
+  position: relative;
+  font-size: var(--font-size-s);
+  color: var(--color-on-background);
+}
+
+.ap-poll__votes {
+  position: relative;
+  float: right;
+  font-size: var(--font-size-s);
+  font-weight: 600;
+  color: var(--color-on-offset);
+}
+
+.ap-poll__footer {
+  font-size: var(--font-size-xs);
+  color: var(--color-on-offset);
+  margin-top: var(--space-xs);
+}
+
 /* ==========================================================================
    Dark Mode Overrides
    Softens saturated colors that are uncomfortable on dark backgrounds.

package/index.js

@@ -97,6 +97,7 @@ import { startBatchRefollow } from "./lib/batch-refollow.js";
 import { logActivity } from "./lib/activity-log.js";
 import { scheduleCleanup } from "./lib/timeline-cleanup.js";
 import { runSeparateMentionsMigration } from "./lib/migrations/separate-mentions.js";
+import { deleteFederationController } from "./lib/controllers/federation-delete.js";
 
 const defaults = {
   mountPath: "/activitypub",
@@ -118,6 +119,7 @@ const defaults = {
   notificationRetentionDays: 30,
   debugDashboard: false,
   debugPassword: "",
+  defaultVisibility: "public", // "public" | "unlisted" | "followers"
 };
 
 export default class ActivityPubEndpoint {
@@ -309,6 +311,7 @@ export default class ActivityPubEndpoint {
     router.post("/admin/refollow/pause", refollowPauseController(mp, this));
     router.post("/admin/refollow/resume", refollowResumeController(mp, this));
     router.get("/admin/refollow/status", refollowStatusController(mp));
+    router.post("/admin/federation/delete", deleteFederationController(mp, this));
 
     return router;
   }
@@ -376,6 +379,7 @@ export default class ActivityPubEndpoint {
           post.properties,
           actorUrl,
           self._publicationUrl,
+          { visibility: self.options.defaultVisibility },
         );
 
         const object = activity.object || activity;
@@ -470,6 +474,7 @@ export default class ActivityPubEndpoint {
             {
               replyToActorUrl: replyToActor?.url,
               replyToActorHandle: replyToActor?.handle,
+              visibility: self.options.defaultVisibility,
             },
           );
 
@@ -871,6 +876,97 @@ export default class ActivityPubEndpoint {
     }
   }
 
+  /**
+   * Send Delete activity to all followers for a removed post.
+   * Mirrors broadcastActorUpdate() pattern: batch delivery with shared inbox dedup.
+   * @param {string} postUrl - Full URL of the deleted post
+   */
+  async broadcastDelete(postUrl) {
+    if (!this._federation) return;
+
+    try {
+      const { Delete } = await import("@fedify/fedify/vocab");
+      const handle = this.options.actor.handle;
+      const ctx = this._federation.createContext(
+        new URL(this._publicationUrl),
+        { handle, publicationUrl: this._publicationUrl },
+      );
+
+      const del = new Delete({
+        actor: ctx.getActorUri(handle),
+        object: new URL(postUrl),
+      });
+
+      const followers = await this._collections.ap_followers
+        .find({})
+        .project({ actorUrl: 1, inbox: 1, sharedInbox: 1 })
+        .toArray();
+
+      const inboxMap = new Map();
+      for (const f of followers) {
+        const key = f.sharedInbox || f.inbox;
+        if (key && !inboxMap.has(key)) {
+          inboxMap.set(key, f);
+        }
+      }
+
+      const uniqueRecipients = [...inboxMap.values()];
+      const BATCH_SIZE = 25;
+      const BATCH_DELAY_MS = 5000;
+      let delivered = 0;
+      let failed = 0;
+
+      console.info(
+        `[ActivityPub] Broadcasting Delete for ${postUrl} to ${uniqueRecipients.length} ` +
+          `unique inboxes (${followers.length} followers)`,
+      );
+
+      for (let i = 0; i < uniqueRecipients.length; i += BATCH_SIZE) {
+        const batch = uniqueRecipients.slice(i, i + BATCH_SIZE);
+        const recipients = batch.map((f) => ({
+          id: new URL(f.actorUrl),
+          inboxId: new URL(f.inbox || f.sharedInbox),
+          endpoints: f.sharedInbox
+            ? { sharedInbox: new URL(f.sharedInbox) }
+            : undefined,
+        }));
+
+        try {
+          await ctx.sendActivity(
+            { identifier: handle },
+            recipients,
+            del,
+            { preferSharedInbox: true },
+          );
+          delivered += batch.length;
+        } catch (error) {
+          failed += batch.length;
+          console.warn(
+            `[ActivityPub] Delete batch ${Math.floor(i / BATCH_SIZE) + 1} failed: ${error.message}`,
+          );
+        }
+
+        if (i + BATCH_SIZE < uniqueRecipients.length) {
+          await new Promise((resolve) => setTimeout(resolve, BATCH_DELAY_MS));
+        }
+      }
+
+      console.info(
+        `[ActivityPub] Delete broadcast complete for ${postUrl}: ${delivered} delivered, ${failed} failed`,
+      );
+
+      await logActivity(this._collections.ap_activities, {
+        direction: "outbound",
+        type: "Delete",
+        actorUrl: this._publicationUrl,
+        objectUrl: postUrl,
+        summary: `Sent Delete for ${postUrl} to ${delivered} inboxes`,
+      }).catch(() => {});
+    } catch (error) {
+      console.warn("[ActivityPub] broadcastDelete failed:", error.message);
+    }
+  }
+
   /**
    * Build the full actor URL from config.
    * @returns {string}
@@ -908,6 +1004,8 @@ export default class ActivityPubEndpoint {
     Indiekit.addCollection("ap_messages");
     // Explore tab collections
     Indiekit.addCollection("ap_explore_tabs");
+    // Reports collection
+    Indiekit.addCollection("ap_reports");
 
     // Store collection references (posts resolved lazily)
     const indiekitCollections = Indiekit.collections;
@@ -931,6 +1029,8 @@ export default class ActivityPubEndpoint {
       ap_messages: indiekitCollections.get("ap_messages"),
       // Explore tab collections
       ap_explore_tabs: indiekitCollections.get("ap_explore_tabs"),
+      // Reports collection
+      ap_reports: indiekitCollections.get("ap_reports"),
       get posts() {
         return indiekitCollections.get("posts");
       },
@@ -1106,6 +1206,22 @@ export default class ActivityPubEndpoint {
         { order: 1 },
         { background: true },
       );
+
+      // ap_reports indexes
+      if (notifRetention > 0) {
+        this._collections.ap_reports.createIndex(
+          { createdAt: 1 },
+          { expireAfterSeconds: notifRetention * 86_400 },
+        );
+      }
+      this._collections.ap_reports.createIndex(
+        { reporterUrl: 1 },
+        { background: true },
+      );
+      this._collections.ap_reports.createIndex(
+        { reportedUrls: 1 },
+        { background: true },
+      );
     } catch {
       // Index creation failed — collections not yet available.
       // Indexes already exist from previous startups; non-fatal.

package/lib/controllers/compose.js

@@ -168,7 +168,8 @@ export function submitComposeController(mountPath, plugin) {
       }
 
       const { application } = request.app.locals;
-      const { content } = request.body;
+      const { content, visibility, summary } = request.body;
+      const cwEnabled = request.body["cw-enabled"];
       const inReplyTo = request.body["in-reply-to"];
       const syndicateTo = request.body["mp-syndicate-to"];
 
@@ -209,6 +210,15 @@ export function submitComposeController(mountPath, plugin) {
         micropubData.append("in-reply-to", inReplyTo);
       }
 
+      if (visibility && visibility !== "public") {
+        micropubData.append("visibility", visibility);
+      }
+
+      if (cwEnabled && summary && summary.trim()) {
+        micropubData.append("summary", summary.trim());
+        micropubData.append("sensitive", "true");
+      }
+
       if (syndicateTo) {
         const targets = Array.isArray(syndicateTo)
           ? syndicateTo

package/lib/controllers/federation-delete.js

@@ -0,0 +1,55 @@
+/**
+ * POST /admin/federation/delete — Send Delete activity to all followers.
+ * Removes a post from the fediverse after local deletion.
+ * @param {string} mountPath - Plugin mount path
+ * @param {object} plugin - ActivityPub plugin instance
+ */
+import { validateToken } from "../csrf.js";
+
+export function deleteFederationController(mountPath, plugin) {
+  return async (request, response, next) => {
+    try {
+      if (!validateToken(request)) {
+        return response.status(403).json({
+          success: false,
+          error: "Invalid CSRF token",
+        });
+      }
+
+      const { url } = request.body;
+      if (!url) {
+        return response.status(400).json({
+          success: false,
+          error: "Missing post URL",
+        });
+      }
+
+      try {
+        new URL(url);
+      } catch {
+        return response.status(400).json({
+          success: false,
+          error: "Invalid post URL",
+        });
+      }
+
+      if (!plugin._federation) {
+        return response.status(503).json({
+          success: false,
+          error: "Federation not initialized",
+        });
+      }
+
+      await plugin.broadcastDelete(url);
+
+      if (request.headers.accept?.includes("application/json")) {
+        return response.json({ success: true, url });
+      }
+
+      const referrer = request.get("Referrer") || `${mountPath}/admin/activities`;
+      return response.redirect(referrer);
+    } catch (error) {
+      next(error);
+    }
+  };
+}

package/lib/controllers/reader.js

@@ -117,7 +117,7 @@ export function readerController(mountPath) {
 }
 
 export function notificationsController(mountPath) {
-  const validTabs = ["all", "reply", "like", "boost", "follow", "dm"];
+  const validTabs = ["all", "reply", "like", "boost", "follow", "dm", "report"];
 
   return async (request, response, next) => {
     try {

package/lib/inbox-listeners.js

@@ -13,6 +13,7 @@ import {
   Block,
   Create,
   Delete,
+  Flag,
   Follow,
   Like,
   Move,
@@ -747,6 +748,67 @@ export function registerInboxListeners(inboxChain, options) {
     })
     .on(Remove, async () => {
       // Mastodon uses Remove for unpinning posts from featured collections — safe to ignore
+    })
+    // ── Flag (Report) ──────────────────────────────────────────────
+    .on(Flag, async (ctx, flag) => {
+      try {
+        const authLoader = await getAuthLoader(ctx);
+        const actorObj = await flag.getActor({ documentLoader: authLoader }).catch(() => null);
+
+        const reporterUrl = actorObj?.id?.href || flag.actorId?.href || "";
+        const reporterName = actorObj?.name?.toString() || actorObj?.preferredUsername?.toString() || reporterUrl;
+
+        // Extract reported objects — Flag can report actors or posts
+        const reportedIds = flag.objectIds?.map((u) => u.href) || [];
+        const reason = flag.content?.toString() || flag.summary?.toString() || "";
+
+        if (reportedIds.length === 0 && !reason) {
+          console.info("[ActivityPub] Ignoring empty Flag from", reporterUrl);
+          return;
+        }
+
+        // Store report
+        if (collections.ap_reports) {
+          await collections.ap_reports.insertOne({
+            reporterUrl,
+            reporterName,
+            reportedUrls: reportedIds,
+            reason,
+            createdAt: new Date().toISOString(),
+            read: false,
+          });
+        }
+
+        // Create notification
+        if (collections.ap_notifications) {
+          await addNotification(collections, {
+            uid: `flag:${reporterUrl}:${Date.now()}`,
+            type: "report",
+            actorUrl: reporterUrl,
+            actorName: reporterName,
+            actorPhoto: actorObj?.iconUrl?.href || actorObj?.icon?.url?.href || "",
+            actorHandle: actorObj?.preferredUsername
+              ? `@${actorObj.preferredUsername}@${new URL(reporterUrl).hostname}`
+              : reporterUrl,
+            objectUrl: reportedIds[0] || "",
+            summary: reason ? reason.slice(0, 200) : "Report received",
+            published: new Date().toISOString(),
+            createdAt: new Date().toISOString(),
+          });
+        }
+
+        await logActivity(collections, storeRawActivities, {
+          direction: "inbound",
+          type: "Flag",
+          actorUrl: reporterUrl,
+          objectUrl: reportedIds[0] || "",
+          summary: `Report from ${reporterName}: ${reason.slice(0, 100)}`,
+        });
+
+        console.info(`[ActivityPub] Flag received from ${reporterName} — ${reportedIds.length} objects reported`);
+      } catch (error) {
+        console.warn("[ActivityPub] Flag handler error:", error.message);
+      }
     });
 }
 

package/lib/jf2-to-as2.js

@@ -48,7 +48,7 @@ function linkifyUrls(html) {
  * @param {string} publicationUrl - Publication base URL with trailing slash
  * @returns {object} ActivityStreams activity (Create, Like, or Announce)
  */
-export function jf2ToActivityStreams(properties, actorUrl, publicationUrl) {
+export function jf2ToActivityStreams(properties, actorUrl, publicationUrl, options = {}) {
   const postType = properties["post-type"];
 
   if (postType === "like") {
@@ -60,6 +60,7 @@ export function jf2ToActivityStreams(properties, actorUrl, publicationUrl) {
     };
   }
 
+  // Reposts are always public — Mastodon and other implementations expect this
   if (postType === "repost") {
     return {
       "@context": "https://www.w3.org/ns/activitystreams",
@@ -72,14 +73,25 @@ export function jf2ToActivityStreams(properties, actorUrl, publicationUrl) {
   const isArticle = postType === "article" && properties.name;
   const postUrl = resolvePostUrl(properties.url, publicationUrl);
 
+  const visibility = properties.visibility || options.visibility || "public";
+  const followersUrl = `${actorUrl.replace(/\/$/, "")}/followers`;
+
   const object = {
     type: isArticle ? "Article" : "Note",
     id: postUrl,
     attributedTo: actorUrl,
     published: properties.published,
     url: postUrl,
-    to: ["https://www.w3.org/ns/activitystreams#Public"],
-    cc: [`${actorUrl.replace(/\/$/, "")}/followers`],
+    to: visibility === "unlisted"
+      ? [followersUrl]
+      : visibility === "followers"
+        ? [followersUrl]
+        : ["https://www.w3.org/ns/activitystreams#Public"],
+    cc: visibility === "unlisted"
+      ? ["https://www.w3.org/ns/activitystreams#Public"]
+      : visibility === "followers"
+        ? []
+        : [followersUrl],
   };
 
   if (postType === "bookmark") {
@@ -111,6 +123,10 @@ export function jf2ToActivityStreams(properties, actorUrl, publicationUrl) {
     }
   }
 
+  if (properties.sensitive || properties["post-status"] === "sensitive") {
+    object.sensitive = true;
+  }
+
   if (properties["in-reply-to"]) {
     object.inReplyTo = properties["in-reply-to"];
   }
@@ -161,6 +177,7 @@ export function jf2ToAS2Activity(properties, actorUrl, publicationUrl, options =
     });
   }
 
+  // Reposts are always public — Mastodon and other implementations expect this
   if (postType === "repost") {
     const repostOf = properties["repost-of"];
     if (!repostOf) return null;
@@ -180,17 +197,39 @@ export function jf2ToAS2Activity(properties, actorUrl, publicationUrl, options =
     attributedTo: actorUri,
   };
 
-  // Addressing: for replies, include original author in CC so their server
-  // threads the reply and notifies them
+  // Determine visibility: per-post override > option default > "public"
+  const visibility = properties.visibility || options.visibility || "public";
+
+  // Addressing based on visibility:
+  // - "public":    to: PUBLIC, cc: followers (+ reply author)
+  // - "unlisted":  to: followers, cc: PUBLIC (+ reply author)
+  // - "followers": to: followers (+ reply author), no PUBLIC
+  const PUBLIC = new URL("https://www.w3.org/ns/activitystreams#Public");
+  const followersUri = new URL(followersUrl);
+
   if (replyToActorUrl && properties["in-reply-to"]) {
-    noteOptions.to = new URL("https://www.w3.org/ns/activitystreams#Public");
-    noteOptions.ccs = [
-      new URL(followersUrl),
-      new URL(replyToActorUrl),
-    ];
+    const replyAuthor = new URL(replyToActorUrl);
+    if (visibility === "unlisted") {
+      noteOptions.to = followersUri;
+      noteOptions.ccs = [PUBLIC, replyAuthor];
+    } else if (visibility === "followers") {
+      noteOptions.tos = [followersUri, replyAuthor];
+    } else {
+      // public (default)
+      noteOptions.to = PUBLIC;
+      noteOptions.ccs = [followersUri, replyAuthor];
+    }
   } else {
-    noteOptions.to = new URL("https://www.w3.org/ns/activitystreams#Public");
-    noteOptions.cc = new URL(followersUrl);
+    if (visibility === "unlisted") {
+      noteOptions.to = followersUri;
+      noteOptions.cc = PUBLIC;
+    } else if (visibility === "followers") {
+      noteOptions.to = followersUri;
+    } else {
+      // public (default)
+      noteOptions.to = PUBLIC;
+      noteOptions.cc = followersUri;
+    }
   }
 
   if (postUrl) {
@@ -230,6 +269,19 @@ export function jf2ToAS2Activity(properties, actorUrl, publicationUrl, options =
     }
   }
 
+  // Content warning / sensitive flag
+  if (properties.sensitive) {
+    noteOptions.sensitive = true;
+  }
+  if (properties["post-status"] === "sensitive") {
+    noteOptions.sensitive = true;
+  }
+  // Summary doubles as CW text in Mastodon (notes only — articles already use summary for description)
+  if (properties.summary && !isArticle) {
+    noteOptions.summary = properties.summary;
+    noteOptions.sensitive = true;
+  }
+
   if (properties["in-reply-to"]) {
     noteOptions.replyTarget = new URL(properties["in-reply-to"]);
   }

package/lib/storage/notifications.js

@@ -126,7 +126,7 @@ export async function getNotificationCountsByType(collections, unreadOnly = fals
 
   const results = await ap_notifications.aggregate(pipeline).toArray();
 
-  const counts = { all: 0, reply: 0, like: 0, boost: 0, follow: 0, dm: 0 };
+  const counts = { all: 0, reply: 0, like: 0, boost: 0, follow: 0, dm: 0, report: 0 };
   for (const { _id, count } of results) {
     counts.all += count;
     if (_id === "reply" || _id === "mention") {

package/lib/timeline-store.js

@@ -3,7 +3,7 @@
  * @module timeline-store
  */
 
-import { Article, Application, Emoji, Hashtag, Mention, Service } from "@fedify/fedify/vocab";
+import { Article, Application, Emoji, Hashtag, Mention, Question, Service } from "@fedify/fedify/vocab";
 import sanitizeHtml from "sanitize-html";
 
 /**
@@ -132,6 +132,9 @@ export async function extractObjectData(object, options = {}) {
   if (object instanceof Article) {
     type = "article";
   }
+  if (object instanceof Question) {
+    type = "question";
+  }
   if (options.boostedBy) {
     type = "boost";
   }
@@ -152,6 +155,39 @@ export async function extractObjectData(object, options = {}) {
   const summary = object.summary?.toString() || "";
   const sensitive = object.sensitive || false;
 
+  // Poll options (Question type)
+  let pollOptions = [];
+  let votersCount = 0;
+  let pollClosed = false;
+  let pollEndTime = "";
+
+  if (object instanceof Question) {
+    try {
+      const exclusive = [];
+      for await (const opt of object.getExclusiveOptions?.() || []) {
+        exclusive.push({
+          name: opt.name?.toString() || "",
+          votes: typeof opt.replies?.totalItems === "number" ? opt.replies.totalItems : 0,
+        });
+      }
+      const inclusive = [];
+      for await (const opt of object.getInclusiveOptions?.() || []) {
+        inclusive.push({
+          name: opt.name?.toString() || "",
+          votes: typeof opt.replies?.totalItems === "number" ? opt.replies.totalItems : 0,
+        });
+      }
+      pollOptions = exclusive.length > 0 ? exclusive : inclusive;
+    } catch {
+      // Poll options couldn't be extracted — show as regular post
+    }
+
+    votersCount = typeof object.voters === "number" ? object.voters : 0;
+    pollEndTime = object.endTime ? String(object.endTime) : "";
+    const closedValue = object.closed;
+    pollClosed = closedValue === true || (closedValue != null && closedValue !== false);
+  }
+
   // Published date — store as ISO string per Indiekit convention
   const published = object.published
     ? String(object.published)
@@ -321,6 +357,10 @@ export async function extractObjectData(object, options = {}) {
     inReplyTo,
     quoteUrl,
     counts,
+    pollOptions,
+    votersCount,
+    pollClosed,
+    pollEndTime,
     createdAt: new Date().toISOString()
   };
 

package/locales/en.json

@@ -145,7 +145,13 @@
       "syndicateLabel": "Syndicate to",
       "submitMicropub": "Post reply",
       "cancel": "Cancel",
-      "errorEmpty": "Reply content cannot be empty"
+      "errorEmpty": "Reply content cannot be empty",
+      "visibilityLabel": "Visibility",
+      "visibilityPublic": "Public",
+      "visibilityUnlisted": "Unlisted",
+      "visibilityFollowers": "Followers only",
+      "cwLabel": "Content warning",
+      "cwPlaceholder": "Write your warning here…"
     },
     "notifications": {
       "title": "Notifications",
@@ -166,7 +172,8 @@
         "likes": "Likes",
         "boosts": "Boosts",
         "follows": "Follows",
-        "dms": "DMs"
+        "dms": "DMs",
+        "reports": "Reports"
       },
       "emptyTab": "No %s notifications yet."
     },
@@ -304,6 +311,20 @@
         "likes": "Likes",
         "boosts": "Boosts"
       }
+    },
+    "poll": {
+      "voters": "voters",
+      "votes": "votes",
+      "closed": "Poll closed",
+      "endsAt": "Ends"
+    },
+    "federation": {
+      "deleteSuccess": "Delete activity sent to followers",
+      "deleteButton": "Delete from fediverse"
+    },
+    "reports": {
+      "sentReport": "filed a report",
+      "title": "Reports"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "2.9.2",
+  "version": "2.10.1",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",

package/views/activitypub-compose.njk

@@ -27,6 +27,18 @@
       <input type="hidden" name="in-reply-to" value="{{ replyTo }}">
     {% endif %}
 
+    {# Content warning toggle + summary #}
+    <div class="ap-compose__cw">
+      <label class="ap-compose__cw-toggle">
+        <input type="checkbox" name="cw-enabled" id="cw-toggle"
+          onchange="document.getElementById('cw-text').style.display = this.checked ? 'block' : 'none'">
+        {{ __("activitypub.compose.cwLabel") }}
+      </label>
+      <input type="text" name="summary" id="cw-text" class="ap-compose__cw-input"
+        placeholder="{{ __('activitypub.compose.cwPlaceholder') }}"
+        style="display: none">
+    </div>
+
     {# Content textarea #}
     <div class="ap-compose__editor">
       <textarea name="content" class="ap-compose__textarea"
@@ -35,6 +47,23 @@
         required></textarea>
     </div>
 
+    {# Visibility #}
+    <fieldset class="ap-compose__visibility">
+      <legend>{{ __("activitypub.compose.visibilityLabel") }}</legend>
+      <label class="ap-compose__visibility-option">
+        <input type="radio" name="visibility" value="public" checked>
+        {{ __("activitypub.compose.visibilityPublic") }}
+      </label>
+      <label class="ap-compose__visibility-option">
+        <input type="radio" name="visibility" value="unlisted">
+        {{ __("activitypub.compose.visibilityUnlisted") }}
+      </label>
+      <label class="ap-compose__visibility-option">
+        <input type="radio" name="visibility" value="followers">
+        {{ __("activitypub.compose.visibilityFollowers") }}
+      </label>
+    </fieldset>
+
     {# Syndication targets #}
     {% if syndicationTargets.length > 0 %}
       <fieldset class="ap-compose__syndication">

package/views/activitypub-notifications.njk

@@ -27,6 +27,10 @@
       {{ __("activitypub.notifications.tabs.dms") }}
       {% if tabCounts.dm %}<span class="ap-tab__count">{{ tabCounts.dm }}</span>{% endif %}
     </a>
+    <a href="{{ notifBase }}?tab=report" class="ap-tab{% if tab == 'report' %} ap-tab--active{% endif %}">
+      {{ __("activitypub.notifications.tabs.reports") }}
+      {% if tabCounts.report %}<span class="ap-tab__count">{{ tabCounts.report }}</span>{% endif %}
+    </a>
     <a href="{{ notifBase }}?tab=all" class="ap-tab{% if tab == 'all' %} ap-tab--active{% endif %}">
       {{ __("activitypub.notifications.tabs.all") }}
       {% if tabCounts.all %}<span class="ap-tab__count">{{ tabCounts.all }}</span>{% endif %}

package/views/partials/ap-item-card.njk

@@ -100,6 +100,11 @@
 
         {# Media hidden behind CW #}
         {% include "partials/ap-item-media.njk" %}
+
+        {# Poll options #}
+        {% if item.type == "question" or (item.pollOptions and item.pollOptions.length > 0) %}
+          {% include "partials/ap-poll-options.njk" %}
+        {% endif %}
       </div>
     </div>
   {% else %}
@@ -118,6 +123,11 @@
 
     {# Media visible directly #}
     {% include "partials/ap-item-media.njk" %}
+
+    {# Poll options #}
+    {% if item.type == "question" or (item.pollOptions and item.pollOptions.length > 0) %}
+      {% include "partials/ap-poll-options.njk" %}
+    {% endif %}
   {% endif %}
 
   {# Mentions and hashtags #}

package/views/partials/ap-notification-card.njk

@@ -15,7 +15,7 @@
     {% endif %}
     <span class="ap-notification__avatar ap-notification__avatar--default" aria-hidden="true">{{ item.actorName[0] | upper if item.actorName else "?" }}</span>
     <span class="ap-notification__type-badge">
-      {% if item.type == "like" %}❤{% elif item.type == "boost" %}🔁{% elif item.type == "follow" %}👤{% elif item.type == "reply" %}💬{% elif item.type == "mention" %}@{% elif item.type == "dm" %}✉{% endif %}
+      {% if item.type == "like" %}❤{% elif item.type == "boost" %}🔁{% elif item.type == "follow" %}👤{% elif item.type == "reply" %}💬{% elif item.type == "mention" %}@{% elif item.type == "dm" %}✉{% elif item.type == "report" %}⚑{% endif %}
     </span>
   </div>
 
@@ -38,6 +38,8 @@
         {{ __("activitypub.notifications.mentionedYou") }}
       {% elif item.type == "dm" %}
         {{ __("activitypub.messages.sentYouDM") }}
+      {% elif item.type == "report" %}
+        {{ __("activitypub.reports.sentReport") }}
       {% endif %}
     </span>
 

package/views/partials/ap-poll-options.njk

@@ -0,0 +1,30 @@
+{# Poll options partial — renders vote results for Question-type posts #}
+{% if item.pollOptions and item.pollOptions.length > 0 %}
+  {% set totalVotes = 0 %}
+  {% for opt in item.pollOptions %}
+    {% set totalVotes = totalVotes + opt.votes %}
+  {% endfor %}
+
+  <div class="ap-poll">
+    {% for opt in item.pollOptions %}
+      {% set pct = (totalVotes > 0) and ((opt.votes / totalVotes * 100) | round) or 0 %}
+      <div class="ap-poll__option">
+        <div class="ap-poll__bar" style="width: {{ pct }}%"></div>
+        <span class="ap-poll__label">{{ opt.name }}</span>
+        <span class="ap-poll__votes">{{ pct }}%</span>
+      </div>
+    {% endfor %}
+    <div class="ap-poll__footer">
+      {% if item.votersCount > 0 %}
+        {{ item.votersCount }} {{ __("activitypub.poll.voters") }}
+      {% elif totalVotes > 0 %}
+        {{ totalVotes }} {{ __("activitypub.poll.votes") }}
+      {% endif %}
+      {% if item.pollClosed %}
+        · {{ __("activitypub.poll.closed") }}
+      {% elif item.pollEndTime %}
+        · {{ __("activitypub.poll.endsAt") }} <time datetime="{{ item.pollEndTime }}">{{ item.pollEndTime | date("PPp") }}</time>
+      {% endif %}
+    </div>
+  </div>
+{% endif %}