fedipod-server 0.29.0 → 0.31.0

package/lib/client/webpush.mjs

@@ -1,98 +0,0 @@
-// webpush.mjs — Mastodon-style Web Push from the agent itself. The VAPID
-// keypair is minted once into state; each client login keeps one subscription;
-// payloads go straight from this process to the browser's push service, so a
-// closed client still hears about mentions. No relay, no third party account,
-// and nothing here touches the pod.
-import crypto from 'node:crypto';
-import webpush from 'web-push';
-
-export class Push {
-  constructor({ store, subject, log = () => {} }) {
-    this.store = store;
-    this.subject = subject;             // () => the actor URL, VAPID's contact
-    this.log = log;
-  }
-
-  state() { return this.store.read('webpush.json', { subs: {} }); }
-  save(s) { this.store.write('webpush.json', s); }
-
-  vapid() {
-    const st = this.state();
-    if (!st.vapid) {
-      st.vapid = webpush.generateVAPIDKeys();
-      this.save(st);
-      this.log('webpush: VAPID keypair minted');
-    }
-    return st.vapid;
-  }
-
-  publicKey() { return this.vapid().publicKey; }
-
-  // One subscription per client login, keyed by a hash of its bearer token —
-  // the token itself is never written down twice.
-  keyOf(token) { return crypto.createHash('sha256').update(String(token)).digest('hex').slice(0, 16); }
-
-  get(token) { return this.state().subs[this.keyOf(token)] || null; }
-
-  set(token, { endpoint, keys, alerts }) {
-    if (!/^https:\/\//.test(String(endpoint || ''))) return null;
-    if (!keys?.p256dh || !keys?.auth) return null;
-    const st = this.state();
-    st.subs[this.keyOf(token)] = { endpoint, keys: { p256dh: keys.p256dh, auth: keys.auth }, alerts: alerts || {} };
-    this.save(st);
-    return st.subs[this.keyOf(token)];
-  }
-
-  setAlerts(token, alerts) {
-    const st = this.state();
-    const sub = st.subs[this.keyOf(token)];
-    if (!sub) return null;
-    sub.alerts = { ...sub.alerts, ...(alerts || {}) };
-    this.save(st);
-    return sub;
-  }
-
-  drop(token) {
-    const st = this.state();
-    delete st.subs[this.keyOf(token)];
-    this.save(st);
-  }
-
-  json(token, sub) {
-    return {
-      id: this.keyOf(token), endpoint: sub.endpoint,
-      alerts: sub.alerts || {}, policy: 'all',
-      server_key: this.publicKey(),
-    };
-  }
-
-  // Push one notification to every subscription whose alerts allow the type.
-  // A push service answering 404/410 means the browser dropped the
-  // subscription — it is removed rather than retried forever.
-  async notify(n, payload) {
-    const st = this.state();
-    const entries = Object.entries(st.subs);
-    if (!entries.length) return;
-    const { publicKey, privateKey } = this.vapid();
-    const details = { subject: this.subject(), publicKey, privateKey };
-    let dropped = false;
-    for (const [key, sub] of entries) {
-      if (sub.alerts && sub.alerts[n.type] === false) continue;
-      try {
-        await webpush.sendNotification(
-          { endpoint: sub.endpoint, keys: sub.keys },
-          JSON.stringify(payload),
-          { vapidDetails: details, contentEncoding: 'aes128gcm', TTL: 3600 },
-        );
-      } catch (e) {
-        if (e?.statusCode === 404 || e?.statusCode === 410) {
-          delete st.subs[key];
-          dropped = true;
-        } else {
-          this.log(`webpush: ${e?.statusCode || ''} ${e?.message || e}`);
-        }
-      }
-    }
-    if (dropped) this.save(st);
-  }
-}

package/lib/connections/acctfeed.mjs

@@ -1,257 +0,0 @@
-// acctfeed.mjs — polls each connected fediverse account's home timeline and
-// notifications and merges them into the statuses index as kind 'acct'. View
-// cache only: none of it is written to the pod, which holds followed and own
-// content. Modeled on bskyfeed.mjs, which is modeled on tagfeed.mjs.
-//
-// A note is NOT re-fetched at its origin before being stored. The dereference
-// rule guards material an unauthenticated stranger chose for us; this is the
-// owner's own authenticated account answering with the result of the owner's
-// own follow decisions there — the same trust anchor that lets bskyfeed skip
-// it. A local block still applies, because that is the owner's decision.
-//
-// Config in fediacctfeed.json: { intervalMin, accounts: { <id>: marks } }.
-
-import { sanitizeHtml } from '../core/wire.mjs';
-
-const DEFAULTS = { intervalMin: 5 };
-const PER_SWEEP = 40;
-const MAX_PER_ACCT = 150;
-const MAX_ACCT_ENTRIES = 400;
-const BACKOFF_MIN_MS = 5 * 60_000;
-const BACKOFF_MAX_MS = 2 * 60 * 60_000;
-// Mastodon allows 300 requests per five minutes per token. Four go per sweep,
-// so the floor is only ever reached by something else using the same token.
-const RATE_FLOOR = 20;
-
-const MEDIA_TYPES = {
-  image: 'image/jpeg', gifv: 'image/gif', video: 'video/mp4', audio: 'audio/mpeg',
-};
-
-export class AcctFeed {
-  constructor({ store, accounts, log = console.log, onNotification = null }) {
-    Object.assign(this, { store, accounts, log, onNotification });
-    this.state = new Map();          // account id → { failures, quietUntil }
-    this.lastSweep = null;
-    this.lastAdded = 0;
-  }
-
-  config() { return { ...DEFAULTS, ...this.store.read('fediacctfeed.json', {}) }; }
-
-  setConfig(patch) {
-    const clean = {};
-    if (patch.intervalMin) clean.intervalMin = Math.max(1, Number(patch.intervalMin) || DEFAULTS.intervalMin);
-    this.store.write('fediacctfeed.json', { ...this.config(), ...clean });
-    this.stop();
-    this.start();
-    return this.config();
-  }
-
-  marks(id) { return this.config().accounts?.[id] || {}; }
-
-  setMarks(id, patch) {
-    const cfg = this.config();
-    this.store.write('fediacctfeed.json', {
-      ...cfg, accounts: { ...(cfg.accounts || {}), [id]: { ...(cfg.accounts?.[id] || {}), ...patch } },
-    });
-  }
-
-  start() {
-    this.stopped = false;
-    this.sweep().catch(e => this.log(`acctfeed: ${e.message}`));
-    const tick = () => {
-      this.timer = setTimeout(() => {
-        this.sweep()
-          .catch(e => this.log(`acctfeed: ${e.message}`))
-          .finally(() => { if (!this.stopped) tick(); });
-      }, Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3)));
-      this.timer.unref?.();
-    };
-    tick();
-  }
-
-  stop() { this.stopped = true; clearTimeout(this.timer); }
-
-  // Per account, not per feed: one server being down must not silence the rest.
-  _stateOf(id) {
-    if (!this.state.has(id)) this.state.set(id, { failures: 0, quietUntil: 0 });
-    return this.state.get(id);
-  }
-
-  _backOff(id, handle, status, retryAfter) {
-    const st = this._stateOf(id);
-    st.failures += 1;
-    const ladder = Math.min(BACKOFF_MIN_MS * 2 ** (st.failures - 1), BACKOFF_MAX_MS);
-    const wait = retryAfter || Math.round(ladder * (0.85 + Math.random() * 0.3));
-    st.quietUntil = Date.now() + wait;
-    this.log(`acctfeed: ${handle} ${status ? `answered ${status}` : 'did not answer'} — not asking again for ${Math.round(wait / 60_000)} min`);
-  }
-
-  // One author into the shared actor cache. `uri` is the ActivityPub id, so a
-  // person the pod already knows from its own inbox stays one actor here.
-  _rememberAuthor(a) {
-    const url = a?.uri || a?.url;
-    if (!url) return null;
-    if (!this.store.getActors()[url]) {
-      this.store.cacheActor(url, {
-        name: a.display_name || a.username, preferredUsername: a.username,
-        icon: a.avatar || null, type: a.bot ? 'Service' : 'Person',
-      });
-    }
-    return url;
-  }
-
-  // One Mastodon status into the statuses index. Never pre-checks for a
-  // duplicate: a repeat sighting is what carries the second account's
-  // provenance, and addStatus is the only thing that knows how to merge it.
-  _mirror(st, { acct, via = null, parents = null }) {
-    const noteId = st.uri;
-    if (!noteId) return false;
-    const actor = this._rememberAuthor(st.account);
-    if (!actor || this.store.isBlocked(actor)) return false;
-    const inReplyTo = st.in_reply_to_id ? parents?.get(String(st.in_reply_to_id)) : null;
-    const out = this.store.addStatus({
-      noteId, actor,
-      content: sanitizeHtml(st.content || ''),
-      published: st.created_at,
-      kind: 'acct',
-      sourceAccts: [{ acct, remoteId: String(st.id) }],
-      ...(st.url && st.url !== noteId ? { link: st.url } : {}),
-      ...(inReplyTo ? { inReplyTo } : {}),
-      ...(via ? { via } : {}),
-      ...(st.spoiler_text ? { spoiler: st.spoiler_text } : {}),
-      ...(st.media_attachments?.length ? {
-        attachments: st.media_attachments.map(m => ({
-          url: m.url, mediaType: MEDIA_TYPES[m.type] || 'image/jpeg', description: m.description || '',
-        })),
-      } : {}),
-    });
-    return !!out?.added;
-  }
-
-  // Mastodon threads by its own local ids, which mean nothing anywhere else.
-  // A parent we already hold from this same account can be resolved locally,
-  // and one we do not hold simply has no parent here rather than a fetch.
-  _parentMap(acct) {
-    const map = new Map();
-    for (const s of this.store.getStatuses()) {
-      for (const v of s.sourceAccts || []) {
-        if (v.acct === acct && v.remoteId) map.set(String(v.remoteId), s.noteId);
-      }
-    }
-    return map;
-  }
-
-  _rateGuard(id, handle, res) {
-    const left = Number(res.headers.get('x-ratelimit-remaining'));
-    if (!Number.isFinite(left) || left > RATE_FLOOR) return false;
-    const reset = Date.parse(res.headers.get('x-ratelimit-reset') || '');
-    const wait = Number.isFinite(reset) ? Math.max(0, reset - Date.now()) : BACKOFF_MIN_MS;
-    this._stateOf(id).quietUntil = Date.now() + wait;
-    this.log(`acctfeed: ${handle} has ${left} requests left — waiting ${Math.round(wait / 1000)}s`);
-    return true;
-  }
-
-  async sweep() {
-    const rows = (this.accounts?.list() || []).filter(r => r.token && r.enabled !== false);
-    if (!rows.length) return;
-    this.lastSweep = new Date().toISOString();
-    let added = 0;
-    // The 300ms debounce cannot coalesce a sweep that awaits between items —
-    // every fetch outlives it — so the whole sweep is one commit boundary.
-    // Without this, statuses.json is serialized whole once per post.
-    this.store.hold();
-    try {
-      for (const rec of rows) {
-        if (this.stopped) break;
-        added += await this._sweepOne(rec).catch((e) => {
-          this._backOff(rec.id, rec.handle, e.status || 0, null);
-          return 0;
-        });
-      }
-      this._prune();
-    } finally {
-      this.store.release();
-    }
-    this.lastAdded = added;
-    if (added) this.log(`acctfeed: +${added} from ${rows.length} connected account(s)`);
-  }
-
-  async _sweepOne(rec) {
-    const st = this._stateOf(rec.id);
-    if (st.quietUntil && Date.now() < st.quietUntil) return 0;
-    const marks = this.marks(rec.id);
-    const parents = this._parentMap(rec.id);
-    let added = 0;
-
-    const homeQ = marks.homeSinceId ? `&since_id=${encodeURIComponent(marks.homeSinceId)}` : '';
-    const homeRes = await this.accounts.api(rec.id, `/api/v1/timelines/home?limit=${PER_SWEEP}${homeQ}`);
-    if (this._rateGuard(rec.id, rec.handle, homeRes)) return 0;
-    const home = await homeRes.json().catch(() => []);
-    if (!Array.isArray(home)) throw new Error(`${rec.handle} answered with no timeline`);
-    for (const item of home) {
-      if (item?.reblog) {
-        // A boost: the inner post is the content, the booster is the carrier —
-        // the same envelope statusOrBoost already renders for our own timeline.
-        const via = this._rememberAuthor(item.account);
-        if (this._mirror(item.reblog, { acct: rec.id, via, parents })) added++;
-      } else if (item?.uri) {
-        if (this._mirror(item, { acct: rec.id, parents })) added++;
-      }
-    }
-    // Mastodon returns newest first, so the first row is the new mark.
-    // Ids are 19-digit snowflakes: opaque strings, never numbers.
-    if (home.length && home[0]?.id) this.setMarks(rec.id, { homeSinceId: String(home[0].id) });
-
-    const notifQ = marks.notifSinceId ? `&since_id=${encodeURIComponent(marks.notifSinceId)}` : '';
-    const notifRes = await this.accounts.api(rec.id, `/api/v1/notifications?limit=${PER_SWEEP}${notifQ}`);
-    if (this._rateGuard(rec.id, rec.handle, notifRes)) return added;
-    const notes = await notifRes.json().catch(() => []);
-    if (Array.isArray(notes)) {
-      for (const n of notes) {
-        if (!n?.account || String(n.account.id) === String(rec.accountId)) continue;
-        const actor = this._rememberAuthor(n.account);
-        if (!actor || this.store.isBlocked(actor)) continue;
-        // The post a favourite or boost is about is one of this account's own,
-        // so it is mirrored first — a notification pointing at nothing is a
-        // row the client drops.
-        if (n.status?.uri) this._mirror(n.status, { acct: rec.id, parents });
-        if (n.type === 'favourite' || n.type === 'reblog') {
-          this.store.addNotification({
-            type: n.type === 'favourite' ? 'favourite' : 'reblog',
-            actor, noteId: n.status?.uri, via: rec.id,
-          });
-        } else if (n.type === 'follow' || n.type === 'follow_request') {
-          this.store.addNotification({ type: 'follow', actor, via: rec.id });
-          await this.onNotification?.(n, { actor, acct: rec.id });
-        } else if (n.type === 'mention') {
-          this.store.addNotification({ type: 'mention', actor, noteId: n.status?.uri, via: rec.id });
-          await this.onNotification?.(n, { actor, acct: rec.id });
-        }
-      }
-      if (notes.length && notes[0]?.id) this.setMarks(rec.id, { notifSinceId: String(notes[0].id) });
-    }
-
-    st.failures = 0;
-    return added;
-  }
-
-  // Two caps. The per-account one keeps a busy account from crowding out a
-  // quiet one; the total keeps every connected account together from evicting
-  // the pod's own posts and the timeline it already had.
-  _prune() {
-    const all = this.store.getStatuses();
-    const mine = all.filter(s => s.kind === 'acct');
-    if (!mine.length) return;
-    const drop = new Set();
-    const seen = new Map();
-    for (const s of mine) {
-      const acct = s.sourceAccts?.[0]?.acct || '?';
-      const n = (seen.get(acct) || 0) + 1;
-      seen.set(acct, n);
-      if (n > MAX_PER_ACCT) drop.add(s.noteId);
-    }
-    for (const s of mine.slice(MAX_ACCT_ENTRIES)) drop.add(s.noteId);
-    if (!drop.size) return;
-    this.store.write('statuses.json', all.filter(s => !drop.has(s.noteId)));
-  }
-}

package/lib/connections/atproto.mjs

@@ -1,309 +0,0 @@
-// atproto.mjs — the agent's connection to an ATProto (Bluesky) account. The
-// agent is an API CLIENT of an existing account on bsky.social or any PDS —
-// the same relationship a Mastodon app has to this agent. Nothing here hosts
-// ATProto; the pod stays the only public surface.
-//
-// Credential at AP_HOME/atproto.json (0600, atomic, stamped with the actor it
-// was connected for — the keys.json rules). The app password is kept so an
-// expired refresh token re-logins instead of demanding a reconnect.
-
-import { fileVault } from './vault.mjs';
-import { safeFetch, retryAfterMs } from '../shared/safefetch.mjs';
-
-const FILE = 'atproto.json';
-const POST_NSID = 'app.bsky.feed.post';
-const MAX_GRAPHEMES = 300;
-const MAX_IMAGES = 4;
-const MAX_BLOB_BYTES = 950_000;
-
-const enc = new TextEncoder();
-const seg = new Intl.Segmenter();
-const graphemes = (s) => { let n = 0; for (const _ of seg.segment(s)) n++; return n; };
-const byteLen = (s) => enc.encode(s).length;
-
-// Facet byte offsets are UTF-8 BYTE indexes into the text, not code units.
-function detectFacets(text) {
-  const facets = [];
-  for (const m of text.matchAll(/https?:\/\/[^\s<>"'\])]+/g)) {
-    facets.push({
-      index: { byteStart: byteLen(text.slice(0, m.index)), byteEnd: byteLen(text.slice(0, m.index + m[0].length)) },
-      features: [{ $type: 'app.bsky.richtext.facet#link', uri: m[0] }],
-    });
-  }
-  for (const m of text.matchAll(/(^|\s)#([\p{L}\p{N}_]+)/gu)) {
-    const start = m.index + m[1].length;
-    const tagText = '#' + m[2];
-    facets.push({
-      index: { byteStart: byteLen(text.slice(0, start)), byteEnd: byteLen(text.slice(0, start + tagText.length)) },
-      features: [{ $type: 'app.bsky.richtext.facet#tag', tag: m[2] }],
-    });
-  }
-  return facets;
-}
-
-// The post text Bluesky gets: the note's own text when it fits, otherwise a
-// grapheme-safe cut with a link to the pod note, which holds the whole thing.
-export function bskyText(text, noteUrl) {
-  const clean = String(text || '').trim();
-  if (graphemes(clean) <= MAX_GRAPHEMES) {
-    return { text: clean, facets: detectFacets(clean), truncated: false };
-  }
-  const tail = '… ' + noteUrl;
-  const budget = MAX_GRAPHEMES - graphemes(tail);
-  let cut = '';
-  let used = 0;
-  for (const s of seg.segment(clean)) {
-    if (used >= budget) break;
-    cut += s.segment;
-    used++;
-  }
-  const out = cut.trimEnd() + tail;
-  const facets = detectFacets(out);
-  return { text: out, facets, truncated: true };
-}
-
-export class Atproto {
-  /**
-   * `vault` is where the app password is kept: this machine when the identity
-   * runs on a laptop, its own pod when it runs inside the pod server. Absent,
-   * it is the file beside the credential, which is what a laptop wants.
-   */
-  constructor({ localDir, vault = null, actorId = null, log = console.log, fetcher = null }) {
-    this.vault = vault || fileVault(localDir);
-    this.name = vault ? 'bluesky' : FILE.replace(/\.json$/u, '');
-    this.actorId = actorId;
-    this.log = log;
-    // Injectable for tests; the default is the politeness stack.
-    this.fetcher = fetcher || ((url, init) => safeFetch(url, init));
-    this.pausedUntil = 0;
-    this.lastError = null;
-  }
-
-  // The stamped-record guard: a credential minted for another actor is treated
-  // as absent, never silently adopted across identities.
-  read() {
-    const rec = this.vault.read(this.name);
-    if (!rec) return null;
-    if (rec?.mintedFor && this.actorId && rec.mintedFor !== this.actorId) {
-      this.log(`the Bluesky connection belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
-      return null;
-    }
-    return rec;
-  }
-
-  write(rec) { this.vault.write(this.name, rec); }
-
-  connected() { return !!this.read()?.did; }
-
-  status() {
-    const rec = this.read();
-    return {
-      connected: !!rec?.did,
-      service: rec?.service || null,
-      handle: rec?.handle || null,
-      did: rec?.did || null,
-      lastError: this.lastError,
-      cooldownFor: Math.max(0, Math.round((this.pausedUntil - Date.now()) / 1000)),
-    };
-  }
-
-  async _fetch(url, init) {
-    const left = this.pausedUntil - Date.now();
-    if (left > 0) throw new Error(`bluesky asked us to back off — ${Math.ceil(left / 1000)}s left`);
-    const res = await this.fetcher(url, init);
-    if (res.status === 429 || res.status === 503) {
-      const ms = retryAfterMs(res) ?? 60_000;
-      this.pausedUntil = Date.now() + ms;
-      this.log(`bluesky answered ${res.status} — pausing for ${Math.round(ms / 1000)}s`);
-    }
-    return res;
-  }
-
-  async _json(res) {
-    const body = await res.json().catch(() => ({}));
-    if (res.status >= 400) {
-      const err = new Error(body.message || body.error || `bluesky answered ${res.status}`);
-      err.status = res.status;
-      err.code = body.error || null;
-      throw err;
-    }
-    return body;
-  }
-
-  // One session mint, straight from service + identifier + app password.
-  // The identifier reaches the server bare: a fediverse-habit leading @ makes
-  // Bluesky parse the handle as an email and refuse it confusingly.
-  async connect({ service, identifier, appPassword }) {
-    const base = String(service || 'https://bsky.social').replace(/\/+$/, '');
-    const id = String(identifier || '').trim().replace(/^@/, '');
-    const res = await this._fetch(`${base}/xrpc/com.atproto.server.createSession`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ identifier: id, password: appPassword }),
-    });
-    const s = await this._json(res);
-    this.write({
-      service: base, identifier: id, appPassword,
-      did: s.did, handle: s.handle,
-      accessJwt: s.accessJwt, refreshJwt: s.refreshJwt,
-      ...(this.actorId ? { mintedFor: this.actorId } : {}),
-    });
-    this.lastError = null;
-    this.log(`bluesky connected: @${s.handle} (${s.did})`);
-    return { did: s.did, handle: s.handle, service: base };
-  }
-
-  // Best-effort session teardown, then the local record is gone regardless.
-  async disconnect() {
-    const rec = this.read();
-    if (rec?.refreshJwt) {
-      await this._fetch(`${rec.service}/xrpc/com.atproto.server.deleteSession`, {
-        method: 'POST', headers: { authorization: `Bearer ${rec.refreshJwt}` },
-      }).catch(() => {});
-    }
-    await this.vault.remove(this.name);
-    this.log('bluesky disconnected');
-  }
-
-  async _refresh(rec) {
-    const res = await this._fetch(`${rec.service}/xrpc/com.atproto.server.refreshSession`, {
-      method: 'POST', headers: { authorization: `Bearer ${rec.refreshJwt}` },
-    });
-    if (res.status >= 400) {
-      // The refresh token died; the stored app password re-mints the session.
-      await this._json(res).catch(() => {});
-      return this.connect({ service: rec.service, identifier: rec.identifier, appPassword: rec.appPassword })
-        .then(() => this.read());
-    }
-    const s = await this._json(res);
-    const next = { ...rec, accessJwt: s.accessJwt, refreshJwt: s.refreshJwt };
-    this.write(next);
-    return next;
-  }
-
-  // Mirror one public note. Returns { uri, cid } — the caller records it on
-  // the status so a later delete can find the mirror.
-  async crossPost({ text, published, attachments = [] }, { noteUrl }) {
-    const rec = this.read();
-    if (!rec?.did) throw new Error('no bluesky account connected');
-    const body = bskyText(text, noteUrl);
-    const images = [];
-    for (const a of attachments.filter(x => /^image\//.test(x.mediaType || '')).slice(0, MAX_IMAGES)) {
-      const res = await this._fetch(a.url, {});
-      if (res.status >= 400) throw new Error(`attachment fetch failed (${res.status}): ${a.url}`);
-      const bytes = Buffer.from(await res.arrayBuffer());
-      if (bytes.length > MAX_BLOB_BYTES) { this.log(`bluesky: image too large, skipped (${a.url})`); continue; }
-      const up = await this.xrpc('com.atproto.repo.uploadBlob', {
-        body: bytes, contentType: a.mediaType,
-      });
-      images.push({ image: up.blob, alt: a.description || '' });
-    }
-    const record = {
-      $type: POST_NSID,
-      text: body.text,
-      ...(body.facets.length ? { facets: body.facets } : {}),
-      ...(images.length ? { embed: { $type: 'app.bsky.embed.images', images } } : {}),
-      createdAt: published || new Date().toISOString(),
-    };
-    const out = await this.xrpc('com.atproto.repo.createRecord', {
-      body: { repo: rec.did, collection: POST_NSID, record },
-    });
-    return { uri: out.uri, cid: out.cid, ...(body.truncated ? { truncated: true } : {}) };
-  }
-
-  // at://did/collection/rkey → deleteRecord. Absence on the far side is fine.
-  async deleteCrossPost(uri) {
-    const m = String(uri).match(/^at:\/\/([^/]+)\/([^/]+)\/(.+)$/);
-    if (!m) throw new Error(`not an at:// uri: ${uri}`);
-    await this.xrpc('com.atproto.repo.deleteRecord', {
-      body: { repo: m[1], collection: m[2], rkey: m[3] },
-    });
-  }
-
-  // The post as Bluesky holds it — for a cid an old mirror never stored, and
-  // for the thread root a reply must carry.
-  async _post(uri) {
-    const out = await this.xrpc('app.bsky.feed.getPosts', { params: { uris: uri } });
-    const p = (out.posts || [])[0];
-    if (!p) throw new Error('that post is gone on Bluesky');
-    return p;
-  }
-
-  // A native like or repost of someone's post — the record every Bluesky app
-  // writes. Returns the minted record's uri, the only handle an undo has.
-  async like(uri, cid = null) { return this._subjectRecord('app.bsky.feed.like', uri, cid); }
-  async repost(uri, cid = null) { return this._subjectRecord('app.bsky.feed.repost', uri, cid); }
-
-  async _subjectRecord(collection, uri, cid) {
-    const rec = this.read();
-    if (!rec?.did) throw new Error('no bluesky account connected');
-    const subject = cid ? { uri, cid } : await this._post(uri).then(p => ({ uri: p.uri, cid: p.cid }));
-    const out = await this.xrpc('com.atproto.repo.createRecord', {
-      body: {
-        repo: rec.did, collection,
-        record: { $type: collection, subject, createdAt: new Date().toISOString() },
-      },
-    });
-    return { uri: out.uri };
-  }
-
-  // A native reply under someone's post, threaded at the root their post
-  // hangs from. A reply exists only on Bluesky — the fediverse cannot see the
-  // parent — so there is no AP object and nothing to cross-post.
-  async reply(text, parentUri) {
-    const rec = this.read();
-    if (!rec?.did) throw new Error('no bluesky account connected');
-    const clean = String(text || '').trim();
-    const n = graphemes(clean);
-    if (n > MAX_GRAPHEMES) throw new Error(`a Bluesky reply fits ${MAX_GRAPHEMES} characters — this one is ${n}`);
-    const p = await this._post(parentUri);
-    const parent = { uri: p.uri, cid: p.cid };
-    const facets = detectFacets(clean);
-    const out = await this.xrpc('com.atproto.repo.createRecord', {
-      body: {
-        repo: rec.did, collection: POST_NSID,
-        record: {
-          $type: POST_NSID, text: clean,
-          ...(facets.length ? { facets } : {}),
-          reply: { root: p.record?.reply?.root || parent, parent },
-          createdAt: new Date().toISOString(),
-        },
-      },
-    });
-    return { uri: out.uri, cid: out.cid };
-  }
-
-  // The one door every call goes through. GET when there is no body.
-  // Retries exactly once after an expired-token refresh.
-  async xrpc(nsid, { params = null, body = null, contentType = 'application/json', method = null } = {}) {
-    let rec = this.read();
-    if (!rec?.did) throw new Error('no bluesky account connected');
-    const qs = params
-      ? '?' + new URLSearchParams(Object.entries(params).filter(([, v]) => v != null)).toString()
-      : '';
-    const doCall = (r) => this._fetch(`${r.service}/xrpc/${nsid}${qs}`, {
-      method: method || (body != null ? 'POST' : 'GET'),
-      headers: {
-        authorization: `Bearer ${r.accessJwt}`,
-        ...(body != null ? { 'content-type': contentType } : {}),
-      },
-      ...(body != null ? { body: contentType === 'application/json' ? JSON.stringify(body) : body } : {}),
-    });
-    let res = await doCall(rec);
-    if (res.status === 400 || res.status === 401) {
-      const peek = await res.clone().json().catch(() => ({}));
-      if (peek.error === 'ExpiredToken' || peek.error === 'InvalidToken') {
-        rec = await this._refresh(rec);
-        res = await doCall(rec);
-      }
-    }
-    try {
-      const out = await this._json(res);
-      this.lastError = null;
-      return out;
-    } catch (e) {
-      this.lastError = e.message;
-      throw e;
-    }
-  }
-}