@rmdes/indiekit-endpoint-microsub 1.0.60 → 1.0.63

package/index.js

@@ -3,6 +3,7 @@ import { fileURLToPath } from "node:url";
 
 import express from "express";
 import rateLimit from "express-rate-limit";
+import { waitForReady } from "@rmdes/indiekit-startup-gate";
 
 import { microsubController } from "./lib/controllers/microsub.js";
 import { opmlController } from "./lib/controllers/opml.js";
@@ -11,11 +12,11 @@ import { asyncHandler } from "./lib/utils/async-handler.js";
 import { handleMediaProxy } from "./lib/media/proxy.js";
 import { csrfToken, csrfValidate } from "./lib/utils/csrf.js";
 import { startScheduler, stopScheduler } from "./lib/polling/scheduler.js";
-import { ensureActivityPubChannel } from "./lib/storage/channels.js";
 import { createIndexes } from "./lib/storage/items.js";
 import {
   cleanupAllReadItems,
   cleanupStaleItems,
+  removeActivityPubData,
 } from "./lib/storage/items-retention.js";
 import { webmentionReceiver } from "./lib/webmention/receiver.js";
 import { websubHandler } from "./lib/websub/handler.js";
@@ -132,9 +133,6 @@ export default class MicrosubEndpoint {
     readerRouter.get("/search", asyncHandler(readerController.searchPage));
     readerRouter.post("/search", asyncHandler(readerController.searchFeeds));
     readerRouter.post("/subscribe", asyncHandler(readerController.subscribe));
-    readerRouter.get("/actor", asyncHandler(readerController.actorProfile));
-    readerRouter.post("/actor/follow", asyncHandler(readerController.followActorAction));
-    readerRouter.post("/actor/unfollow", asyncHandler(readerController.unfollowActorAction));
     readerRouter.post("/api/mark-read", asyncHandler(readerController.markAllRead));
     readerRouter.post("/api/mark-view-read", asyncHandler(readerController.markViewRead));
     readerRouter.get("/opml", opmlController.exportOpml);
@@ -202,38 +200,45 @@ export default class MicrosubEndpoint {
     // Start feed polling scheduler when server starts
     // This will be called after the server is ready
     if (indiekit.database) {
-      console.info("[Microsub] Database available, starting scheduler");
-      startScheduler(indiekit);
-
-      // Ensure system channels exist
-      ensureActivityPubChannel(indiekit).catch((error) => {
-        console.warn(
-          "[Microsub] ActivityPub channel creation failed:",
-          error.message,
-        );
-      });
-
-      // Create indexes for optimal performance (runs in background)
+      // Indexes are cheap and idempotent — create immediately
       createIndexes(indiekit).catch((error) => {
         console.warn("[Microsub] Index creation failed:", error.message);
       });
 
-      // Cleanup old read items on startup
-      cleanupAllReadItems(indiekit).catch((error) => {
-        console.warn("[Microsub] Startup cleanup failed:", error.message);
-      });
+      // Defer heavy tasks until host is ready
+      this._stopGate = waitForReady(
+        () => {
+          console.info("[Microsub] Starting scheduler and maintenance tasks");
+          startScheduler(indiekit);
 
-      // Delete stale items (stripped skeletons + unread older than 30 days)
-      cleanupStaleItems(indiekit).catch((error) => {
-        console.warn("[Microsub] Stale cleanup failed:", error.message);
-      });
+          // One-time migration: drop the abandoned "Fediverse" channel and its
+          // items. Idempotent — does nothing once the channel is gone.
+          removeActivityPubData(indiekit).catch((error) => {
+            console.warn(
+              "[Microsub] ActivityPub data removal failed:",
+              error.message,
+            );
+          });
 
-      // Schedule daily stale cleanup (items accumulate between restarts)
-      setInterval(() => {
-        cleanupStaleItems(indiekit).catch((error) => {
-          console.warn("[Microsub] Scheduled stale cleanup failed:", error.message);
-        });
-      }, 24 * 60 * 60 * 1000);
+          // Cleanup old read items on startup
+          cleanupAllReadItems(indiekit).catch((error) => {
+            console.warn("[Microsub] Startup cleanup failed:", error.message);
+          });
+
+          // Delete stale items (stripped skeletons + unread older than 30 days)
+          cleanupStaleItems(indiekit).catch((error) => {
+            console.warn("[Microsub] Stale cleanup failed:", error.message);
+          });
+
+          // Schedule daily stale cleanup (items accumulate between restarts)
+          setInterval(() => {
+            cleanupStaleItems(indiekit).catch((error) => {
+              console.warn("[Microsub] Scheduled stale cleanup failed:", error.message);
+            });
+          }, 24 * 60 * 60 * 1000);
+        },
+        { label: "Microsub" },
+      );
     } else {
       console.warn(
         "[Microsub] Database not available at init, scheduler not started",
@@ -245,6 +250,7 @@ export default class MicrosubEndpoint {
    * Cleanup on shutdown
    */
   destroy() {
+    this._stopGate?.();
     stopScheduler();
   }
 }

package/lib/controllers/reader/channel.js

@@ -18,7 +18,13 @@ import {
   validateChannelName,
   validateExcludeTypes,
   validateExcludeRegex,
+  validateRetentionSetting,
 } from "../../utils/validation.js";
+import {
+  DEFAULT_MAX_ITEMS,
+  DEFAULT_MAX_ITEMS_PER_FEED,
+  DEFAULT_MAX_UNREAD_AGE_DAYS,
+} from "../../storage/items-retention.js";
 import { proxyItemImages } from "../../media/proxy.js";
 
 /**
@@ -212,6 +218,14 @@ export async function channelHtml(request, response) {
  * @param {object} response - Express response
  * @returns {Promise<void>}
  */
+// Defaults exposed to the settings template so placeholders show what the
+// channel falls back to when a field is left blank.
+const RETENTION_DEFAULTS = {
+  maxItems: DEFAULT_MAX_ITEMS,
+  maxItemsPerFeed: DEFAULT_MAX_ITEMS_PER_FEED,
+  maxUnreadAgeDays: DEFAULT_MAX_UNREAD_AGE_DAYS,
+};
+
 export async function settings(request, response) {
   const { application } = request.app.locals;
   const userId = getUserId(request);
@@ -236,6 +250,7 @@ export async function settings(request, response) {
       { text: channelDocument.name, href: `${request.baseUrl}/channels/${uid}` },
       { text: "Settings" },
     ],
+    retentionDefaults: RETENTION_DEFAULTS,
   });
 }
 
@@ -249,7 +264,13 @@ export async function updateSettings(request, response) {
   const { application } = request.app.locals;
   const userId = getUserId(request);
   const { uid } = request.params;
-  const { excludeTypes, excludeRegex } = request.body;
+  const {
+    excludeTypes,
+    excludeRegex,
+    maxItems,
+    maxItemsPerFeed,
+    maxUnreadAgeDays,
+  } = request.body;
 
   const channelDocument = await getChannel(application, uid, userId);
   if (!channelDocument) {
@@ -261,12 +282,30 @@ export async function updateSettings(request, response) {
   );
   const validatedRegex = validateExcludeRegex(excludeRegex);
 
+  // Retention overrides. Empty/invalid input falls back to the global default
+  // (stored as undefined so future global default changes apply automatically).
+  const validatedMaxItems = validateRetentionSetting(maxItems, {
+    min: 10,
+    max: 100_000,
+  });
+  const validatedMaxItemsPerFeed = validateRetentionSetting(maxItemsPerFeed, {
+    min: 1,
+    max: 10_000,
+  });
+  const validatedMaxUnreadAgeDays = validateRetentionSetting(
+    maxUnreadAgeDays,
+    { min: 1, max: 3650 },
+  );
+
   await updateChannelSettings(
     application,
     uid,
     {
       excludeTypes: validatedTypes,
       excludeRegex: validatedRegex,
+      maxItems: validatedMaxItems,
+      maxItemsPerFeed: validatedMaxItemsPerFeed,
+      maxUnreadAgeDays: validatedMaxUnreadAgeDays,
     },
     userId,
   );
@@ -286,7 +325,7 @@ export async function deleteChannelAction(request, response) {
   const { uid } = request.params;
 
   // Don't allow deleting system channels
-  if (uid === "notifications" || uid === "activitypub") {
+  if (uid === "notifications") {
     return response.redirect(`${request.baseUrl}/channels`);
   }
 

package/lib/controllers/reader/index.js

@@ -38,12 +38,6 @@ export { compose, submitCompose } from "./compose.js";
 
 export { searchPage, searchFeeds, subscribe } from "./search.js";
 
-export {
-  actorProfile,
-  followActorAction,
-  unfollowActorAction,
-} from "./actor.js";
-
 export { deck, deckSettings, saveDeckSettings } from "./deck.js";
 
 import {
@@ -81,12 +75,6 @@ import { compose, submitCompose } from "./compose.js";
 
 import { searchPage, searchFeeds, subscribe } from "./search.js";
 
-import {
-  actorProfile,
-  followActorAction,
-  unfollowActorAction,
-} from "./actor.js";
-
 import { deck, deckSettings, saveDeckSettings } from "./deck.js";
 
 export const readerController = {
@@ -115,9 +103,6 @@ export const readerController = {
   searchPage,
   searchFeeds,
   subscribe,
-  actorProfile,
-  followActorAction,
-  unfollowActorAction,
   timeline,
   timelineHtml,
   deck,

package/lib/storage/channels.js

@@ -298,7 +298,7 @@ export async function deleteChannel(application, uid, userId) {
   if (userId) query.userId = userId;
 
   // Don't allow deleting system channels
-  if (uid === "notifications" || uid === "activitypub") {
+  if (uid === "notifications") {
     return false;
   }
 
@@ -396,39 +396,3 @@ export async function ensureNotificationsChannel(application, userId) {
   await collection.insertOne(channel);
   return channel;
 }
-
-/**
- * Ensure ActivityPub channel exists
- * @param {object} application - Indiekit application
- * @param {string} [userId] - User ID
- * @returns {Promise<object>} ActivityPub channel
- */
-export async function ensureActivityPubChannel(application, userId) {
-  const collection = getCollection(application);
-
-  const existing = await collection.findOne({
-    uid: "activitypub",
-    ...(userId && { userId }),
-  });
-
-  if (existing) {
-    return existing;
-  }
-
-  const channel = {
-    uid: "activitypub",
-    name: "Fediverse",
-    userId,
-    source: "activitypub",
-    order: -0.5, // After notifications (-1), before user channels (0+)
-    settings: {
-      excludeTypes: [],
-      excludeRegex: undefined,
-    },
-    createdAt: new Date().toISOString(),
-    updatedAt: new Date().toISOString(),
-  };
-
-  await collection.insertOne(channel);
-  return channel;
-}

package/lib/storage/items-retention.js

@@ -8,13 +8,18 @@ import { getCollection } from "./items.js";
 // Maximum number of full read items to keep per channel before stripping content.
 const MAX_FULL_READ_ITEMS = 200;
 
-// Maximum age (in days) for stripped skeletons and unread items.
-// After this period, both are hard-deleted to prevent unbounded growth.
-const MAX_ITEM_AGE_DAYS = 30;
+// Global retention defaults. Each can be overridden per channel via
+// channel.settings.{maxItems,maxItemsPerFeed,maxUnreadAgeDays}. The "notifications"
+// channel is exempt from these caps entirely — webmentions are high-signal and
+// users may want long history there.
+export const DEFAULT_MAX_ITEMS = 1000;
+export const DEFAULT_MAX_ITEMS_PER_FEED = 50;
+export const DEFAULT_MAX_UNREAD_AGE_DAYS = 30;
 
 /**
  * Cleanup all read items across all channels (startup cleanup).
- * RSS items are stripped to dedup skeletons; AP items are hard-deleted.
+ * Read items beyond MAX_FULL_READ_ITEMS are stripped to skeletons (kept for
+ * dedup, content removed).
  * @param {object} application - Indiekit application
  * @returns {Promise<number>} Total number of items cleaned up
  */
@@ -49,59 +54,36 @@ export async function cleanupAllReadItems(application) {
           })
           .sort({ published: -1, _id: -1 })
           .skip(MAX_FULL_READ_ITEMS)
-          .project({ _id: 1, feedId: 1 })
+          .project({ _id: 1 })
           .toArray();
 
         if (itemsToCleanup.length > 0) {
-          const apItemIds = [];
-          const rssItemIds = [];
-          for (const item of itemsToCleanup) {
-            if (item.feedId) {
-              rssItemIds.push(item._id);
-            } else {
-              apItemIds.push(item._id);
-            }
-          }
-
-          // Hard-delete AP items
-          if (apItemIds.length > 0) {
-            const deleted = await collection.deleteMany({
-              _id: { $in: apItemIds },
-            });
-            totalCleaned += deleted.deletedCount;
-            console.info(
-              `[Microsub] Startup cleanup: deleted ${deleted.deletedCount} AP items from channel "${channel.name}"`,
-            );
-          }
-
-          // Strip RSS items to skeletons
-          if (rssItemIds.length > 0) {
-            const stripped = await collection.updateMany(
-              { _id: { $in: rssItemIds } },
-              {
-                $set: { _stripped: true },
-                $unset: {
-                  name: "",
-                  content: "",
-                  summary: "",
-                  author: "",
-                  category: "",
-                  photo: "",
-                  video: "",
-                  audio: "",
-                  likeOf: "",
-                  repostOf: "",
-                  bookmarkOf: "",
-                  inReplyTo: "",
-                  source: "",
-                },
+          const ids = itemsToCleanup.map((item) => item._id);
+          const stripped = await collection.updateMany(
+            { _id: { $in: ids } },
+            {
+              $set: { _stripped: true },
+              $unset: {
+                name: "",
+                content: "",
+                summary: "",
+                author: "",
+                category: "",
+                photo: "",
+                video: "",
+                audio: "",
+                likeOf: "",
+                repostOf: "",
+                bookmarkOf: "",
+                inReplyTo: "",
+                source: "",
               },
-            );
-            totalCleaned += stripped.modifiedCount;
-            console.info(
-              `[Microsub] Startup cleanup: stripped ${stripped.modifiedCount} RSS items from channel "${channel.name}"`,
-            );
-          }
+            },
+          );
+          totalCleaned += stripped.modifiedCount;
+          console.info(
+            `[Microsub] Startup cleanup: stripped ${stripped.modifiedCount} items from channel "${channel.name}"`,
+          );
         }
       }
     }
@@ -117,58 +99,187 @@ export async function cleanupAllReadItems(application) {
 }
 
 /**
- * Delete stale items: stripped skeletons and unread items older than MAX_ITEM_AGE_DAYS.
- * Stripped skeletons have served their dedup purpose; stale unread items are unlikely
- * to be read. Both are hard-deleted to prevent unbounded collection growth.
+ * Per-channel retention cleanup. For each channel (excluding `notifications`):
+ *   1. Drop unread items + stripped skeletons older than `maxUnreadAgeDays`.
+ *   2. Per-feed cap: keep most recent `maxItemsPerFeed` items per feed, drop the rest.
+ *   3. Channel-wide cap: keep most recent `maxItems` items total, drop the rest.
+ *
+ * Each channel uses its own `channel.settings.{maxItems,maxItemsPerFeed,maxUnreadAgeDays}`
+ * when present; otherwise the module-level defaults apply. This makes the policy
+ * configurable per channel — a noisy aggregator channel can set tight caps while
+ * a low-volume curated channel keeps a long tail.
+ *
+ * The order matters: per-feed cap runs before channel cap so a single prolific
+ * feed cannot starve other feeds in the channel of representation after the
+ * channel-wide trim.
+ *
  * @param {object} application - Indiekit application
- * @returns {Promise<number>} Total number of items deleted
+ * @returns {Promise<number>} Total number of items deleted across all channels
  */
 export async function cleanupStaleItems(application) {
-  const collection = getCollection(application);
-  const cutoff = new Date();
-  cutoff.setDate(cutoff.getDate() - MAX_ITEM_AGE_DAYS);
-
-  // Delete stripped skeletons older than cutoff
-  const strippedResult = await collection.deleteMany({
-    _stripped: true,
-    $or: [
-      { published: { $lt: cutoff } },
-      { published: { $exists: false }, createdAt: { $lt: cutoff.toISOString() } },
-    ],
-  });
+  const itemsCollection = getCollection(application);
+  const channelsCollection = application.collections.get("microsub_channels");
 
-  // Delete unread items older than cutoff
-  const unreadResult = await collection.deleteMany({
-    readBy: { $in: [null, []] },
-    _stripped: { $ne: true },
-    $or: [
-      { published: { $lt: cutoff } },
-      { published: { $exists: false }, createdAt: { $lt: cutoff.toISOString() } },
-    ],
-  });
+  const channels = await channelsCollection.find({}).toArray();
+  let totalDeleted = 0;
 
-  // Also catch items with no readBy field at all
-  const noReadByResult = await collection.deleteMany({
-    readBy: { $exists: false },
-    _stripped: { $ne: true },
-    $or: [
-      { published: { $lt: cutoff } },
-      { published: { $exists: false }, createdAt: { $lt: cutoff.toISOString() } },
-    ],
-  });
+  for (const channel of channels) {
+    // Notifications channel (webmentions) is exempt — high-signal, kept indefinitely.
+    if (channel.uid === "notifications") continue;
+
+    const settings = channel.settings || {};
+    const maxItems = settings.maxItems ?? DEFAULT_MAX_ITEMS;
+    const maxItemsPerFeed =
+      settings.maxItemsPerFeed ?? DEFAULT_MAX_ITEMS_PER_FEED;
+    const maxUnreadAgeDays =
+      settings.maxUnreadAgeDays ?? DEFAULT_MAX_UNREAD_AGE_DAYS;
+
+    const cutoff = new Date();
+    cutoff.setDate(cutoff.getDate() - maxUnreadAgeDays);
+    const cutoffIso = cutoff.toISOString();
+    let channelDeleted = 0;
+    let staleDeleted = 0;
+    let perFeedDeleted = 0;
+    let channelCapDeleted = 0;
+
+    // 1. Drop stripped skeletons older than cutoff (served their dedup purpose).
+    const strippedResult = await itemsCollection.deleteMany({
+      channelId: channel._id,
+      _stripped: true,
+      $or: [
+        { published: { $lt: cutoff } },
+        {
+          published: { $exists: false },
+          createdAt: { $lt: cutoffIso },
+        },
+      ],
+    });
+    staleDeleted += strippedResult.deletedCount;
+
+    // 1b. Drop unread (or never-read) items older than cutoff.
+    const unreadAgeResult = await itemsCollection.deleteMany({
+      channelId: channel._id,
+      _stripped: { $ne: true },
+      $and: [
+        {
+          $or: [
+            { readBy: { $exists: false } },
+            { readBy: { $size: 0 } },
+            { readBy: null },
+          ],
+        },
+        {
+          $or: [
+            { published: { $lt: cutoff } },
+            {
+              published: { $exists: false },
+              createdAt: { $lt: cutoffIso },
+            },
+          ],
+        },
+      ],
+    });
+    staleDeleted += unreadAgeResult.deletedCount;
+    channelDeleted += staleDeleted;
+
+    // 2. Per-feed cap. Iterate feeds in the channel; for each, delete oldest
+    //    items beyond maxItemsPerFeed regardless of read state.
+    const feedIds = await itemsCollection.distinct("feedId", {
+      channelId: channel._id,
+      feedId: { $exists: true, $ne: null },
+    });
+
+    for (const feedId of feedIds) {
+      const excess = await itemsCollection
+        .find({ channelId: channel._id, feedId })
+        .sort({ published: -1, _id: -1 })
+        .skip(maxItemsPerFeed)
+        .project({ _id: 1 })
+        .toArray();
+
+      if (excess.length > 0) {
+        const ids = excess.map((item) => item._id);
+        const result = await itemsCollection.deleteMany({
+          _id: { $in: ids },
+        });
+        perFeedDeleted += result.deletedCount;
+        channelDeleted += result.deletedCount;
+      }
+    }
 
-  const total =
-    strippedResult.deletedCount +
-    unreadResult.deletedCount +
-    noReadByResult.deletedCount;
+    // 3. Channel-wide cap. Catches items without feedId plus anything still over
+    //    the per-channel ceiling after the per-feed pass.
+    const excessChannel = await itemsCollection
+      .find({ channelId: channel._id })
+      .sort({ published: -1, _id: -1 })
+      .skip(maxItems)
+      .project({ _id: 1 })
+      .toArray();
 
-  if (total > 0) {
+    if (excessChannel.length > 0) {
+      const ids = excessChannel.map((item) => item._id);
+      const result = await itemsCollection.deleteMany({ _id: { $in: ids } });
+      channelCapDeleted += result.deletedCount;
+      channelDeleted += result.deletedCount;
+    }
+
+    if (channelDeleted > 0) {
+      console.info(
+        `[Microsub] Retention cleanup "${channel.name}": deleted ${channelDeleted} items ` +
+          `(stale: ${staleDeleted}, per-feed: ${perFeedDeleted}, channel-cap: ${channelCapDeleted}; ` +
+          `maxItems=${maxItems}, maxItemsPerFeed=${maxItemsPerFeed}, maxUnreadAgeDays=${maxUnreadAgeDays})`,
+      );
+    }
+    totalDeleted += channelDeleted;
+  }
+
+  if (totalDeleted > 0) {
     console.info(
-      `[Microsub] Stale cleanup: deleted ${strippedResult.deletedCount} stripped skeletons, ` +
-        `${unreadResult.deletedCount + noReadByResult.deletedCount} stale unread items ` +
-        `(cutoff: ${MAX_ITEM_AGE_DAYS} days)`,
+      `[Microsub] Retention cleanup complete: ${totalDeleted} total items deleted across ${channels.length} channels`,
     );
   }
 
-  return total;
+  return totalDeleted;
+}
+
+/**
+ * One-time migration: remove the abandoned "Fediverse" channel and its items.
+ * The microsub reader briefly tried to ingest ActivityPub outboxes into a
+ * dedicated channel (uid: "activitypub"). That feature was abandoned — fediverse
+ * federation lives entirely in the separate `indiekit-endpoint-activitypub`
+ * plugin now. This migration cleans up the leftover channel and items.
+ * Idempotent — safe to run on every startup.
+ * @param {object} application - Indiekit application
+ * @returns {Promise<{ channelsRemoved: number, itemsRemoved: number }>}
+ */
+export async function removeActivityPubData(application) {
+  const itemsCollection = getCollection(application);
+  const channelsCollection = application.collections.get("microsub_channels");
+
+  const apChannels = await channelsCollection
+    .find({ uid: "activitypub" })
+    .toArray();
+
+  if (apChannels.length === 0) {
+    return { channelsRemoved: 0, itemsRemoved: 0 };
+  }
+
+  const channelIds = apChannels.map((c) => c._id);
+
+  const itemsResult = await itemsCollection.deleteMany({
+    channelId: { $in: channelIds },
+  });
+
+  const channelsResult = await channelsCollection.deleteMany({
+    _id: { $in: channelIds },
+  });
+
+  console.info(
+    `[Microsub] Removed abandoned Fediverse channel: ${channelsResult.deletedCount} channel(s), ${itemsResult.deletedCount} item(s)`,
+  );
+
+  return {
+    channelsRemoved: channelsResult.deletedCount,
+    itemsRemoved: itemsResult.deletedCount,
+  };
 }

package/lib/utils/validation.js

@@ -163,6 +163,31 @@ export function validateExcludeTypes(types) {
   return types.filter((type) => VALID_EXCLUDE_TYPES.includes(type));
 }
 
+/**
+ * Validate a per-channel retention numeric setting.
+ * Accepts a positive integer; returns undefined for empty/invalid input so the
+ * caller can fall back to the global default.
+ * @param {string|number|undefined} value - Raw form value
+ * @param {object} [options]
+ * @param {number} [options.min] - Minimum allowed value (inclusive). Default 1.
+ * @param {number} [options.max] - Maximum allowed value (inclusive). Default 1_000_000.
+ * @returns {number|undefined} Validated integer, or undefined if empty/invalid
+ */
+export function validateRetentionSetting(value, options = {}) {
+  const { min = 1, max = 1_000_000 } = options;
+
+  if (value === undefined || value === null || value === "") {
+    return undefined;
+  }
+
+  const parsed = Number.parseInt(String(value), 10);
+  if (!Number.isFinite(parsed) || parsed < min || parsed > max) {
+    return undefined;
+  }
+
+  return parsed;
+}
+
 /**
  * Validate regex pattern
  * @param {string} pattern - Regex pattern to validate

package/locales/en.json

@@ -75,6 +75,14 @@
       "excludeRegex": "Exclude pattern",
       "excludeRegexHelp": "Regular expression to filter out matching content",
       "save": "Save settings",
+      "retentionTitle": "Retention",
+      "retentionHelp": "Control how many items this channel keeps in MongoDB. Useful for high-volume aggregator channels that would otherwise grow without bound. Leave any field blank to use the global default.",
+      "maxItems": "Maximum items in channel",
+      "maxItemsHelp": "Keep at most this many items total. Oldest items are deleted regardless of read state. Default: {{default}}.",
+      "maxItemsPerFeed": "Maximum items per feed",
+      "maxItemsPerFeedHelp": "Keep at most this many items per feed inside this channel. Prevents one prolific feed from monopolising the channel cap. Default: {{default}}.",
+      "maxUnreadAgeDays": "Drop unread items older than (days)",
+      "maxUnreadAgeDaysHelp": "Unread items older than this are deleted, even if the channel is below its item cap. Default: {{default}}.",
       "dangerZone": "Danger zone",
       "deleteWarning": "Deleting this channel will permanently remove all feeds and items. This action cannot be undone.",
       "deleteConfirm": "Are you sure you want to delete this channel and all its content?",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-microsub",
-  "version": "1.0.60",
+  "version": "1.0.63",
   "description": "Microsub endpoint for Indiekit. Enables subscribing to feeds and reading content using the Microsub protocol.",
   "keywords": [
     "indiekit",
@@ -37,6 +37,7 @@
   },
   "dependencies": {
     "@indiekit/error": "^1.0.0-beta.25",
+    "@rmdes/indiekit-startup-gate": "^1.0.0",
     "@indiekit/frontend": "^1.0.0-beta.25",
     "@indiekit/util": "^1.0.0-beta.25",
     "debug": "^4.3.2",

package/views/partials/item-card.njk

@@ -153,12 +153,6 @@
 
   {# Inline actions (Aperture pattern) #}
   <div class="ms-item-actions">
-    {% if item._source and item._source.type === "activitypub" and item.author and item.author.url %}
-    <a href="{{ baseUrl }}/actor?url={{ item.author.url | urlencode }}" class="ms-item-actions__button" title="View actor profile">
-      {{ icon("mention") }}
-      <span class="-!-visually-hidden">Actor profile</span>
-    </a>
-    {% endif %}
     {% if item.url %}
     <a href="{{ item.url }}" class="ms-item-actions__button" target="_blank" rel="noopener" title="View original">
       {{ icon("syndicate") }}

package/views/settings.njk

@@ -49,6 +49,43 @@
         value: channel.settings.excludeRegex
       }) }}
 
+      {% if channel.uid !== "notifications" %}
+      <fieldset class="ms-retention-settings">
+        <legend>{{ __("microsub.settings.retentionTitle") }}</legend>
+        <p class="hint">{{ __("microsub.settings.retentionHelp") }}</p>
+
+        {{ input({
+          id: "maxItems",
+          name: "maxItems",
+          type: "number",
+          label: __("microsub.settings.maxItems"),
+          hint: __("microsub.settings.maxItemsHelp", { default: retentionDefaults.maxItems }),
+          attributes: { min: 10, max: 100000, placeholder: retentionDefaults.maxItems },
+          value: channel.settings.maxItems
+        }) }}
+
+        {{ input({
+          id: "maxItemsPerFeed",
+          name: "maxItemsPerFeed",
+          type: "number",
+          label: __("microsub.settings.maxItemsPerFeed"),
+          hint: __("microsub.settings.maxItemsPerFeedHelp", { default: retentionDefaults.maxItemsPerFeed }),
+          attributes: { min: 1, max: 10000, placeholder: retentionDefaults.maxItemsPerFeed },
+          value: channel.settings.maxItemsPerFeed
+        }) }}
+
+        {{ input({
+          id: "maxUnreadAgeDays",
+          name: "maxUnreadAgeDays",
+          type: "number",
+          label: __("microsub.settings.maxUnreadAgeDays"),
+          hint: __("microsub.settings.maxUnreadAgeDaysHelp", { default: retentionDefaults.maxUnreadAgeDays }),
+          attributes: { min: 1, max: 3650, placeholder: retentionDefaults.maxUnreadAgeDays },
+          value: channel.settings.maxUnreadAgeDays
+        }) }}
+      </fieldset>
+      {% endif %}
+
       <div class="button-group">
         {{ button({
           text: __("microsub.settings.save")

package/lib/activitypub/outbox-fetcher.js

@@ -1,267 +0,0 @@
-/**
- * Fetch a remote ActivityPub actor's outbox for on-demand reading.
- * Returns ephemeral jf2 items — nothing is stored in MongoDB.
- *
- * @module activitypub/outbox-fetcher
- */
-
-import sanitizeHtml from "sanitize-html";
-
-import { isPrivateUrl } from "../media/proxy.js";
-import { SANITIZE_OPTIONS } from "../utils/sanitize.js";
-
-const AP_ACCEPT =
-  'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
-const FETCH_TIMEOUT = 10_000;
-const USER_AGENT = "Indiekit/1.0 (Microsub reader)";
-
-/**
- * Fetch a remote actor's profile and recent posts from their outbox.
- *
- * @param {string} actorUrl - Full URL of the AP actor
- * @param {object} [options]
- * @param {number} [options.limit=20] - Max items to return
- * @returns {Promise<{ actor: object, items: Array }>}
- */
-export async function fetchActorOutbox(actorUrl, options = {}) {
-  const limit = options.limit || 20;
-
-  // 1. Fetch actor profile
-  const actor = await fetchJson(actorUrl);
-  if (!actor || !actor.outbox) {
-    throw new Error("Could not resolve actor or outbox URL");
-  }
-
-  const actorInfo = {
-    name:
-      actor.name ||
-      actor.preferredUsername ||
-      new URL(actorUrl).pathname.split("/").pop(),
-    url: actor.url || actor.id || actorUrl,
-    photo: actor.icon?.url || actor.icon || "",
-    summary: stripHtml(actor.summary || ""),
-    handle: actor.preferredUsername || "",
-    followersCount: 0,
-    followingCount: 0,
-  };
-
-  // Resolve follower/following counts if available
-  if (typeof actor.followers === "string") {
-    try {
-      const followersCollection = await fetchJson(actor.followers);
-      actorInfo.followersCount = followersCollection?.totalItems || 0;
-    } catch {
-      /* ignore */
-    }
-  }
-  if (typeof actor.following === "string") {
-    try {
-      const followingCollection = await fetchJson(actor.following);
-      actorInfo.followingCount = followingCollection?.totalItems || 0;
-    } catch {
-      /* ignore */
-    }
-  }
-
-  // 2. Fetch outbox (OrderedCollection)
-  const outboxUrl =
-    typeof actor.outbox === "string" ? actor.outbox : actor.outbox?.id;
-  const outbox = await fetchJson(outboxUrl);
-  if (!outbox) {
-    return { actor: actorInfo, items: [] };
-  }
-
-  // 3. Get items — may be inline or on a first page
-  let activities = [];
-
-  if (outbox.orderedItems?.length > 0) {
-    activities = outbox.orderedItems;
-  } else if (outbox.first) {
-    const firstPageUrl =
-      typeof outbox.first === "string" ? outbox.first : outbox.first?.id;
-    if (firstPageUrl) {
-      const firstPage = await fetchJson(firstPageUrl);
-      activities = firstPage?.orderedItems || firstPage?.items || [];
-    }
-  }
-
-  // 4. Convert Create activities to jf2 items
-  const items = [];
-  for (const activity of activities) {
-    if (items.length >= limit) break;
-
-    const item = activityToJf2(activity, actorInfo);
-    if (item) items.push(item);
-  }
-
-  return { actor: actorInfo, items };
-}
-
-/**
- * Convert a single AP activity (or bare object) to jf2 format.
- * @param {object} activity - AP activity or object
- * @param {object} actorInfo - Actor profile info
- * @returns {object|null} jf2 item or null if not displayable
- */
-function activityToJf2(activity, actorInfo) {
-  // Unwrap Create/Announce — the displayable content is the inner object
-  let object = activity;
-  const activityType = activity.type;
-
-  if (activityType === "Create" || activityType === "Announce") {
-    object = activity.object;
-    if (!object || typeof object === "string") return null; // Unresolved reference
-  }
-
-  // Skip non-content types (Follow, Like, etc.)
-  const contentTypes = new Set([
-    "Note",
-    "Article",
-    "Page",
-    "Video",
-    "Audio",
-    "Image",
-    "Event",
-    "Question",
-  ]);
-  if (!contentTypes.has(object.type)) return null;
-
-  const rawHtml = object.content || "";
-  const contentHtml = rawHtml ? sanitizeHtml(rawHtml, SANITIZE_OPTIONS) : "";
-  const contentText = stripHtml(rawHtml);
-
-  const jf2 = {
-    type: "entry",
-    url: object.url || object.id || "",
-    uid: object.id || object.url || "",
-    name: object.name || undefined,
-    content: contentHtml ? { text: contentText, html: contentHtml } : undefined,
-    summary: object.summary ? stripHtml(object.summary) : undefined,
-    published: object.published || activity.published || undefined,
-    author: {
-      name: actorInfo.name,
-      url: actorInfo.url,
-      photo: actorInfo.photo,
-    },
-    category: extractTags(object.tag),
-    photo: extractMedia(object.attachment, "image"),
-    video: extractMedia(object.attachment, "video"),
-    audio: extractMedia(object.attachment, "audio"),
-    _source: { type: "activitypub", actorUrl: actorInfo.url },
-  };
-
-  // Boost attribution
-  if (activityType === "Announce" && activity.actor) {
-    jf2._boostedBy = actorInfo;
-    // The inner object may have its own author
-    if (object.attributedTo) {
-      const attributedUrl =
-        typeof object.attributedTo === "string"
-          ? object.attributedTo
-          : object.attributedTo?.id || object.attributedTo?.url;
-      if (attributedUrl) {
-        jf2.author = {
-          name:
-            object.attributedTo?.name ||
-            object.attributedTo?.preferredUsername ||
-            attributedUrl,
-          url: attributedUrl,
-          photo: object.attributedTo?.icon?.url || "",
-        };
-      }
-    }
-  }
-
-  if (object.inReplyTo) {
-    const replyUrl =
-      typeof object.inReplyTo === "string"
-        ? object.inReplyTo
-        : object.inReplyTo?.id;
-    if (replyUrl) jf2["in-reply-to"] = [replyUrl];
-  }
-
-  return jf2;
-}
-
-/**
- * Extract hashtags from AP tag array.
- * @param {Array} tags - AP tag objects
- * @returns {Array<string>}
- */
-function extractTags(tags) {
-  if (!Array.isArray(tags)) return [];
-  return tags
-    .filter((t) => t.type === "Hashtag" || t.type === "Tag")
-    .map((t) => (t.name || "").replace(/^#/, ""))
-    .filter(Boolean);
-}
-
-/**
- * Extract media URLs from AP attachment array.
- * @param {Array} attachments - AP attachment objects
- * @param {string} mediaPrefix - "image", "video", or "audio"
- * @returns {Array<string>}
- */
-function extractMedia(attachments, mediaPrefix) {
-  if (!Array.isArray(attachments)) return [];
-  return attachments
-    .filter((a) => (a.mediaType || "").startsWith(`${mediaPrefix}/`))
-    .map((a) => a.url || a.href || "")
-    .filter(Boolean);
-}
-
-/**
- * Fetch a URL as ActivityPub JSON.
- * @param {string} url
- * @returns {Promise<object|null>}
- */
-async function fetchJson(url) {
-  if (!url) return null;
-
-  // SSRF protection — block private/internal IPs (including DNS rebinding)
-  if (await isPrivateUrl(url)) {
-    console.warn(`[Microsub] AP fetch blocked private URL: ${url}`);
-    return null;
-  }
-
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT);
-
-  try {
-    const response = await fetch(url, {
-      headers: {
-        Accept: AP_ACCEPT,
-        "User-Agent": USER_AGENT,
-      },
-      signal: controller.signal,
-      redirect: "follow",
-    });
-
-    if (!response.ok) {
-      console.warn(
-        `[Microsub] AP fetch failed: ${response.status} for ${url}`,
-      );
-      return null;
-    }
-
-    return await response.json();
-  } catch (error) {
-    if (error.name === "AbortError") {
-      console.warn(`[Microsub] AP fetch timeout for ${url}`);
-    } else {
-      console.warn(`[Microsub] AP fetch error for ${url}: ${error.message}`);
-    }
-    return null;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-/**
- * Strip HTML tags for plain text.
- * @param {string} html
- * @returns {string}
- */
-function stripHtml(html) {
-  return (html || "").replace(/<[^>]*>/g, "").trim();
-}

package/lib/controllers/reader/actor.js

@@ -1,142 +0,0 @@
-/**
- * ActivityPub actor profiles
- * @module controllers/reader/actor
- */
-
-import { fetchActorOutbox } from "../../activitypub/outbox-fetcher.js";
-
-const ACTOR_OUTBOX_LIMIT = 30;
-
-/**
- * Find the ActivityPub plugin instance from installed plugins.
- * @param {object} request - Express request
- * @returns {object|undefined} The AP plugin instance
- */
-function getApPlugin(request) {
-  const installedPlugins = request.app.locals.installedPlugins;
-  if (!installedPlugins) return undefined;
-  return [...installedPlugins].find(
-    (p) => p.name === "ActivityPub endpoint",
-  );
-}
-
-/**
- * Actor profile — fetch and display a remote AP actor's recent posts
- * @param {object} request - Express request
- * @param {object} response - Express response
- */
-export async function actorProfile(request, response) {
-  const actorUrl = request.query.url;
-  if (!actorUrl) {
-    return response.status(400).render("404");
-  }
-
-  // Check if we already follow this actor
-  const { application } = request.app.locals;
-  const apFollowing = application?.collections?.get("ap_following");
-  let isFollowing = false;
-  if (apFollowing) {
-    const existing = await apFollowing.findOne({ actorUrl });
-    isFollowing = !!existing;
-  }
-
-  // Check if AP plugin is available (for follow button visibility)
-  const apPlugin = getApPlugin(request);
-  const canFollow = !!apPlugin;
-
-  try {
-    const { actor, items } = await fetchActorOutbox(actorUrl, { limit: ACTOR_OUTBOX_LIMIT });
-
-    response.render("actor", {
-      title: actor.name || "Actor",
-      actor,
-      items,
-      actorUrl,
-      isFollowing,
-      canFollow,
-      baseUrl: request.baseUrl,
-      readerBaseUrl: request.baseUrl,
-      activeView: "channels",
-      breadcrumbs: [
-        { text: "Reader", href: request.baseUrl },
-        { text: actor.name || "Actor" },
-      ],
-    });
-  } catch (error) {
-    console.error(`[Microsub] Actor profile fetch failed: ${error.message}`);
-    response.render("actor", {
-      title: "Actor",
-      actor: { name: actorUrl, url: actorUrl, photo: "", summary: "" },
-      items: [],
-      actorUrl,
-      isFollowing,
-      canFollow,
-      baseUrl: request.baseUrl,
-      readerBaseUrl: request.baseUrl,
-      activeView: "channels",
-      error: "Could not fetch this actor's profile. They may have restricted access.",
-      breadcrumbs: [
-        { text: "Reader", href: request.baseUrl },
-        { text: "Actor" },
-      ],
-    });
-  }
-}
-
-/**
- * Follow an ActivityPub actor
- * @param {object} request - Express request
- * @param {object} response - Express response
- */
-export async function followActorAction(request, response) {
-  const { actorUrl, actorName } = request.body;
-  if (!actorUrl) {
-    return response.status(400).redirect(request.baseUrl + "/channels/activitypub");
-  }
-
-  const apPlugin = getApPlugin(request);
-  if (!apPlugin) {
-    console.error("[Microsub] Cannot follow: ActivityPub plugin not installed");
-    return response.redirect(
-      `${request.baseUrl}/actor?url=${encodeURIComponent(actorUrl)}`,
-    );
-  }
-
-  const result = await apPlugin.followActor(actorUrl, { name: actorName });
-  if (!result.ok) {
-    console.error(`[Microsub] Follow via AP plugin failed: ${result.error}`);
-  }
-
-  return response.redirect(
-    `${request.baseUrl}/actor?url=${encodeURIComponent(actorUrl)}`,
-  );
-}
-
-/**
- * Unfollow an ActivityPub actor
- * @param {object} request - Express request
- * @param {object} response - Express response
- */
-export async function unfollowActorAction(request, response) {
-  const { actorUrl } = request.body;
-  if (!actorUrl) {
-    return response.status(400).redirect(request.baseUrl + "/channels/activitypub");
-  }
-
-  const apPlugin = getApPlugin(request);
-  if (!apPlugin) {
-    console.error("[Microsub] Cannot unfollow: ActivityPub plugin not installed");
-    return response.redirect(
-      `${request.baseUrl}/actor?url=${encodeURIComponent(actorUrl)}`,
-    );
-  }
-
-  const result = await apPlugin.unfollowActor(actorUrl);
-  if (!result.ok) {
-    console.error(`[Microsub] Unfollow via AP plugin failed: ${result.error}`);
-  }
-
-  return response.redirect(
-    `${request.baseUrl}/actor?url=${encodeURIComponent(actorUrl)}`,
-  );
-}

package/views/actor.njk

@@ -1,188 +0,0 @@
-{% extends "layouts/reader.njk" %}
-
-{% block reader %}
-  <div class="ms-channel">
-    <header class="ms-channel__header">
-      <a href="{{ baseUrl }}/channels/activitypub" class="back-link">
-        {{ icon("previous") }} Fediverse
-      </a>
-    </header>
-
-    {# Actor profile card #}
-    <div class="ms-actor-profile">
-      <div class="ms-actor-profile__header">
-        <div class="ms-actor-profile__avatar-wrap" data-avatar-fallback>
-          {% if actor.photo %}
-          <img src="{{ actor.photo }}"
-               alt=""
-               class="ms-actor-profile__avatar"
-               width="80"
-               height="80">
-          {% endif %}
-          <span class="ms-actor-profile__avatar ms-actor-profile__avatar--default" aria-hidden="true">{{ actor.name[0] | upper if actor.name else "?" }}</span>
-        </div>
-        <div class="ms-actor-profile__info">
-          <h2 class="ms-actor-profile__name">{{ actor.name }}</h2>
-          {% if actor.handle %}
-          <span class="ms-actor-profile__handle">@{{ actor.handle }}</span>
-          {% endif %}
-          {% if actor.summary %}
-          <p class="ms-actor-profile__summary">{{ actor.summary }}</p>
-          {% endif %}
-          <div class="ms-actor-profile__stats">
-            {% if actor.followersCount %}
-            <span>{{ actor.followersCount }} followers</span>
-            {% endif %}
-            {% if actor.followingCount %}
-            <span>{{ actor.followingCount }} following</span>
-            {% endif %}
-          </div>
-        </div>
-      </div>
-      <div class="ms-actor-profile__actions">
-        <a href="{{ actor.url }}" class="button button--secondary button--small" target="_blank" rel="noopener">
-          {{ icon("syndicate") }} View profile
-        </a>
-        {% if canFollow %}
-          {% if isFollowing %}
-          <form action="{{ baseUrl }}/actor/unfollow" method="POST" style="display: inline;">
-      <input type="hidden" name="_csrf" value="{{ csrfToken }}">
-            <input type="hidden" name="actorUrl" value="{{ actorUrl }}">
-            <button type="submit" class="button button--secondary button--small">
-              {{ icon("tick") }} Following
-            </button>
-          </form>
-          {% else %}
-          <form action="{{ baseUrl }}/actor/follow" method="POST" style="display: inline;">
-      <input type="hidden" name="_csrf" value="{{ csrfToken }}">
-            <input type="hidden" name="actorUrl" value="{{ actorUrl }}">
-            <input type="hidden" name="actorName" value="{{ actor.name }}">
-            <button type="submit" class="button button--primary button--small">
-              {{ icon("syndicate") }} Follow
-            </button>
-          </form>
-          {% endif %}
-        {% endif %}
-      </div>
-    </div>
-
-    {% if error %}
-    <div class="ms-reader__empty">
-      {{ icon("warning") }}
-      <p>{{ error }}</p>
-    </div>
-    {% elif items.length > 0 %}
-    <div class="ms-timeline" id="timeline">
-      {% for item in items %}
-      <article class="ms-item-card">
-        {# Author #}
-        {% if item.author %}
-        <div class="ms-item-card__author" style="padding: 12px 16px 0;">
-          <div class="ms-item-card__avatar-wrap" data-avatar-fallback>
-            {% if item.author.photo %}
-            <img src="{{ item.author.photo }}"
-                 alt=""
-                 class="ms-item-card__author-photo"
-                 width="40"
-                 height="40"
-                 loading="lazy">
-            {% endif %}
-            <span class="ms-item-card__author-photo ms-item-card__author-photo--default" aria-hidden="true">{{ item.author.name[0] | upper if item.author.name else "?" }}</span>
-          </div>
-          <div class="ms-item-card__author-info">
-            <span class="ms-item-card__author-name">{{ item.author.name or "Unknown" }}</span>
-            {% if item.author.url %}
-            <span class="ms-item-card__source">{{ item.author.url | replace("https://", "") | replace("http://", "") }}</span>
-            {% endif %}
-          </div>
-        </div>
-        {% endif %}
-
-        <a href="{{ item.url }}" class="ms-item-card__link" target="_blank" rel="noopener">
-          {# Reply context #}
-          {% if item["in-reply-to"] and item["in-reply-to"].length > 0 %}
-          <div class="ms-item-card__context">
-            {{ icon("reply") }}
-            <span>Reply to</span>
-            <span>{{ item["in-reply-to"][0] | replace("https://", "") | replace("http://", "") | truncate(50) }}</span>
-          </div>
-          {% endif %}
-
-          {# Title #}
-          {% if item.name %}
-          <h3 class="ms-item-card__title">{{ item.name }}</h3>
-          {% endif %}
-
-          {# Content #}
-          {% if item.content %}
-          <div class="ms-item-card__content{% if (item.content.text or '') | length > 300 %} ms-item-card__content--truncated{% endif %}">
-            {% if item.content.html %}
-            {{ item.content.html | safe | striptags | truncate(400) }}
-            {% elif item.content.text %}
-            {{ item.content.text | truncate(400) }}
-            {% endif %}
-          </div>
-          {% endif %}
-
-          {# Tags #}
-          {% if item.category and item.category.length > 0 %}
-          <div class="ms-item-card__categories">
-            {% for cat in item.category %}
-            {% if loop.index0 < 5 %}
-            <span class="ms-item-card__category">#{{ cat }}</span>
-            {% endif %}
-            {% endfor %}
-          </div>
-          {% endif %}
-
-          {# Photos #}
-          {% if item.photo and item.photo.length > 0 %}
-          {% set photoCount = item.photo.length if item.photo.length <= 4 else 4 %}
-          <div class="ms-item-card__photos ms-item-card__photos--{{ photoCount }}">
-            {% for photo in item.photo %}
-            {% if loop.index0 < 4 %}
-            <img src="{{ photo }}" alt="" class="ms-item-card__photo" loading="lazy">
-            {% endif %}
-            {% endfor %}
-          </div>
-          {% endif %}
-
-          {# Footer #}
-          <footer class="ms-item-card__footer">
-            {% if item.published %}
-            <time datetime="{{ item.published }}" class="ms-item-card__date">
-              {{ item.published | date("PP", { locale: locale, timeZone: application.timeZone }) }}
-            </time>
-            {% endif %}
-          </footer>
-        </a>
-
-        {# Actions #}
-        <div class="ms-item-actions">
-          <a href="{{ item.url }}" class="ms-item-actions__button" target="_blank" rel="noopener" title="View original">
-            {{ icon("syndicate") }}
-          </a>
-          <a href="{{ baseUrl }}/compose?reply={{ item.url | urlencode }}" class="ms-item-actions__button" title="Reply">
-            {{ icon("reply") }}
-          </a>
-          <a href="{{ baseUrl }}/compose?like={{ item.url | urlencode }}" class="ms-item-actions__button" title="Like">
-            {{ icon("like") }}
-          </a>
-          <a href="{{ baseUrl }}/compose?repost={{ item.url | urlencode }}" class="ms-item-actions__button" title="Repost">
-            {{ icon("repost") }}
-          </a>
-          <a href="{{ baseUrl }}/compose?bookmark={{ item.url | urlencode }}" class="ms-item-actions__button" title="Bookmark">
-            {{ icon("bookmark") }}
-          </a>
-        </div>
-      </article>
-      {% endfor %}
-    </div>
-    {% else %}
-    <div class="ms-reader__empty">
-      {{ icon("syndicate") }}
-      <p>No posts found for this actor.</p>
-    </div>
-    {% endif %}
-  </div>
-{% endblock %}