fedipod-server 0.29.0 → 0.31.0

package/lib/connections/bskyfeed.mjs

@@ -1,243 +0,0 @@
-// bskyfeed.mjs — mirrors the connected Bluesky account's home timeline and
-// notifications into the statuses index as kind 'bsky'. View cache only — none
-// of it is written to the pod; the pod holds fediverse content.
-//
-// Config in bskyfeed.json: { intervalMin }. The poll is authed XRPC against
-// the account's own PDS, so the politeness dial is the account's own rate
-// budget — backed off the same way tagfeed backs off a stranger's instance.
-
-const DEFAULTS = { intervalMin: 5 };
-const PER_SWEEP = 30;
-const MAX_BSKY_ENTRIES = 200;
-const BACKOFF_MIN_MS = 5 * 60_000;
-const BACKOFF_MAX_MS = 2 * 60 * 60_000;
-
-export const profileUrl = (did) => `https://bsky.app/profile/${did}`;
-export const postUrl = (uri) => {
-  const m = String(uri).match(/^at:\/\/([^/]+)\/[^/]+\/(.+)$/);
-  return m ? `https://bsky.app/profile/${m[1]}/post/${m[2]}` : null;
-};
-
-// Every place a post view keeps pictures: a plain image post, the media half
-// of a quote-with-media, and a link card's thumbnail. Bluesky's view types
-// differ by shape, not by a flag, so each is read where it lives.
-export function attachmentsOf(post) {
-  const e = post?.embed || {};
-  const images = [...(e.images || []), ...(e.media?.images || [])]
-    .filter(i => i?.fullsize)
-    .map(i => ({ url: i.fullsize, mediaType: 'image/jpeg', description: i.alt || '' }));
-  const card = e.external?.thumb || e.media?.external?.thumb;
-  if (card) {
-    const ext = e.external || e.media.external;
-    images.push({ url: card, mediaType: 'image/jpeg', description: ext.title || ext.uri || '' });
-  }
-  return images;
-}
-
-export class BskyFeed {
-  constructor({ store, atproto, log = console.log, onNotification = null }) {
-    Object.assign(this, { store, atproto, log, onNotification });
-    this.lastSweep = null;
-    this.lastAdded = 0;
-  }
-
-  config() { return { ...DEFAULTS, ...this.store.read('bskyfeed.json', {}) }; }
-
-  setConfig(patch) {
-    const clean = {};
-    if (patch.intervalMin) clean.intervalMin = Math.max(1, Number(patch.intervalMin) || DEFAULTS.intervalMin);
-    this.store.write('bskyfeed.json', { ...this.config(), ...clean });
-    this.stop();
-    this.start();
-    return this.config();
-  }
-
-  start() {
-    this.stopped = false;
-    this.sweep().catch(e => this.log(`bskyfeed: ${e.message}`));
-    const tick = () => {
-      this.timer = setTimeout(() => {
-        this.sweep()
-          .catch(e => this.log(`bskyfeed: ${e.message}`))
-          .finally(() => { if (!this.stopped) tick(); });
-      }, Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3)));
-      this.timer.unref?.();
-    };
-    tick();
-  }
-
-  stop() { this.stopped = true; clearTimeout(this.timer); }
-
-  _backOff(status, retryAfter) {
-    this.failures = (this.failures || 0) + 1;
-    const ladder = Math.min(BACKOFF_MIN_MS * 2 ** (this.failures - 1), BACKOFF_MAX_MS);
-    const wait = retryAfter || Math.round(ladder * (0.85 + Math.random() * 0.3));
-    this.quietUntil = Date.now() + wait;
-    this.log(`bskyfeed: ${status ? `bluesky answered ${status}` : 'bluesky did not answer'} — not asking again for ${Math.round(wait / 60_000)} min`);
-  }
-
-  // One author into the shared actor cache, under a page anyone can open.
-  _rememberAuthor(a) {
-    const url = profileUrl(a.did);
-    if (!this.store.getActors()[url]) {
-      this.store.cacheActor(url, {
-        name: a.displayName || a.handle, preferredUsername: a.handle,
-        icon: a.avatar || null, type: 'Person',
-      });
-    }
-    return url;
-  }
-
-  // One Bluesky post into the statuses index. Returns its noteId, new or not.
-  // A post seen before is completed, not duplicated: a reply first met as a
-  // bare notification record learns its parent and its pictures from the
-  // full view when that arrives.
-  _mirrorPost(post, { via = null } = {}) {
-    const noteId = post.uri;
-    const inReplyTo = post.record?.reply?.parent?.uri || null;
-    const attachments = attachmentsOf(post);
-    const existing = this.store.getStatuses().find(s => s.noteId === noteId);
-    if (existing) {
-      const patch = {
-        ...(inReplyTo && !existing.inReplyTo ? { inReplyTo } : {}),
-        ...(attachments.length && !existing.attachments?.length ? { attachments } : {}),
-      };
-      if (Object.keys(patch).length && typeof this.store.updateStatus === 'function') {
-        this.store.updateStatus(noteId, patch);
-      }
-      return { noteId, added: false };
-    }
-    const actor = this._rememberAuthor(post.author);
-    if (this.store.isBlocked(actor)) return { noteId, added: false };
-    const text = post.record?.text || '';
-    this.store.addStatus({
-      noteId, actor,
-      content: `<p>${text.replace(/[&<>]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;' }[c]))}</p>`,
-      published: post.record?.createdAt || post.indexedAt,
-      kind: 'bsky',
-      ...(post.cid ? { cid: post.cid } : {}),
-      link: postUrl(noteId),
-      ...(via ? { via } : {}),
-      ...(inReplyTo ? { inReplyTo } : {}),
-      ...(attachments.length ? { attachments } : {}),
-    });
-    return { noteId, added: true };
-  }
-
-  // The conversation under one post, asked for when a post is opened: the
-  // ancestors it hangs from and the replies beneath it, each mirrored with
-  // the reply link the thread view is built from. View cache only, like the
-  // timeline. Returns how many posts were new; a thread Bluesky will not
-  // give (gone, blocked, rate-limited) adds none and is logged, not thrown.
-  async mirrorThread(uri, { depth = 6 } = {}) {
-    if (!this.atproto?.connected()) return 0;
-    if (this.quietUntil && Date.now() < this.quietUntil) return 0;
-    let out;
-    try {
-      out = await this.atproto.xrpc('app.bsky.feed.getPostThread', { params: { uri, depth, parentHeight: 40 } });
-    } catch (e) {
-      if (e.status === 429 || e.status >= 500) this._backOff(e.status, null);
-      else this.log(`bskyfeed: thread ${uri}: ${e.message}`);
-      return 0;
-    }
-    const self = this.atproto.read()?.did;
-    const ownMirrors = new Set(this.store.getStatuses().map(s => s.atproto?.uri).filter(Boolean));
-    let added = 0;
-    const take = (node) => {
-      const post = node?.post;
-      if (!post?.uri) return;                                   // notFoundPost, blockedPost
-      if (post.author?.did === self && ownMirrors.has(post.uri)) return;
-      if (this._mirrorPost(post).added) added++;
-    };
-    for (let up = out?.thread?.parent; up; up = up.parent) take(up);
-    const walk = (node, left) => {
-      take(node);
-      if (left <= 0) return;
-      for (const r of node?.replies || []) walk(r, left - 1);
-    };
-    walk(out?.thread, depth);
-    if (added) this.log(`bskyfeed: +${added} from the thread under ${uri}`);
-    return added;
-  }
-
-  async sweep() {
-    if (!this.atproto?.connected()) return;
-    if (this.quietUntil && Date.now() < this.quietUntil) return;
-    this.lastSweep = new Date().toISOString();
-    const self = this.atproto.read()?.did;
-    let added = 0;
-    // One commit boundary for the sweep, as acctfeed and tagfeed: every item
-    // awaits Bluesky before the next, so the debounce never coalesced them and
-    // the timeline index went to the pod once per notification.
-    this.store.hold?.();
-    try {
-      // Our own CROSS-POSTS must not echo back into the feed — but a post or
-      // reply written natively on Bluesky is ours to see here too. The mirrors
-      // are known by uri, so only they are skipped.
-      const ownMirrors = new Set(this.store.getStatuses().map(s => s.atproto?.uri).filter(Boolean));
-      const tl = await this.atproto.xrpc('app.bsky.feed.getTimeline', { params: { limit: PER_SWEEP } });
-      for (const item of tl.feed || []) {
-        if (!item?.post?.uri) continue;
-        if (item.post.author?.did === self && ownMirrors.has(item.post.uri)) continue;
-        const via = item.reason?.$type === 'app.bsky.feed.defs#reasonRepost' && item.reason.by
-          ? this._rememberAuthor(item.reason.by) : null;
-        if (this._mirrorPost(item.post, { via }).added) added++;
-      }
-
-      // Only notifications newer than the last sweep's high-water mark are
-      // acted on — the list is a window, not a queue, and re-reading it must
-      // not re-fire the group hooks.
-      const seen = this.store.read('bskyfeed.json', {}).lastNotifiedAt || '';
-      let high = seen;
-      const nots = await this.atproto.xrpc('app.bsky.notification.listNotifications', { params: { limit: PER_SWEEP } });
-      for (const n of nots.notifications || []) {
-        if (!n?.author?.did || n.author.did === self) continue;
-        if (n.indexedAt) {
-          if (seen && n.indexedAt <= seen) continue;
-          if (n.indexedAt > high) high = n.indexedAt;
-        }
-        const actor = this._rememberAuthor(n.author);
-        // A like or repost points at OUR mirror; the notification should point
-        // at the pod post it mirrors, which is the one the client can open.
-        if (n.reason === 'like' || n.reason === 'repost') {
-          const mine = this.store.getStatuses().find(s => s.atproto?.uri === n.reasonSubject);
-          if (!mine) continue;
-          this.store.addNotification({
-            type: n.reason === 'like' ? 'favourite' : 'reblog',
-            actor, noteId: mine.noteId, bsky: true,
-          });
-        } else if (n.reason === 'follow') {
-          this.store.addNotification({ type: 'follow', actor, bsky: true });
-          await this.onNotification?.(n, { actor });
-        } else if (n.reason === 'mention' || n.reason === 'reply') {
-          // The notification carries the bare record — no picture URLs and
-          // no view. The post view has both; the record is the fallback when
-          // Bluesky will not give the view.
-          let view = null;
-          try {
-            const got = await this.atproto.xrpc('app.bsky.feed.getPosts', { params: { uris: n.uri } });
-            view = (got?.posts || [])[0] || null;
-          } catch { /* the bare record still stands */ }
-          this._mirrorPost(view || { uri: n.uri, cid: n.cid, author: n.author, record: n.record, indexedAt: n.indexedAt });
-          this.store.addNotification({ type: 'mention', actor, noteId: n.uri, bsky: true });
-          await this.onNotification?.(n, { actor });
-        }
-      }
-      if (high && high !== seen) this.store.write('bskyfeed.json', { ...this.config(), lastNotifiedAt: high });
-      this.failures = 0;
-    } catch (e) {
-      this._backOff(e.status || 0, null);
-      return;
-    } finally {
-      this.store.release?.();
-    }
-    const all = this.store.getStatuses();
-    const mirrored = all.filter(s => s.kind === 'bsky');
-    if (mirrored.length > MAX_BSKY_ENTRIES) {
-      const drop = new Set(mirrored.slice(MAX_BSKY_ENTRIES).map(s => s.noteId));
-      this.store.write('statuses.json', all.filter(s => !drop.has(s.noteId)));
-    }
-    this.lastAdded = added;
-    if (added) this.log(`bskyfeed: +${added} from the bluesky timeline`);
-  }
-}

package/lib/connections/bskygroup.mjs

@@ -1,162 +0,0 @@
-// bskygroup.mjs — Bluesky members of a group, bridged-first. A bridged Bluesky
-// account (one that follows @ap.brid.gy) is a plain AP actor and takes the
-// existing FEP-1b12 paths untouched. This module covers the rest: knowing who
-// is bridged, nudging who isn't, and the degraded Bluesky-only membership —
-// follow-as-join, mention-as-submission, repost as the group's carry.
-
-import { profileUrl } from './bskyfeed.mjs';
-import { bskyText } from './atproto.mjs';
-
-const BRIDGE_ACTOR = (did) => `https://bsky.brid.gy/ap/${did}`;
-const AP_ACCEPT = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
-
-export class BskyGroup {
-  constructor({ store, atproto, intake, publisher, log = console.log, fetcher = null }) {
-    Object.assign(this, { store, atproto, intake, publisher, log });
-    this.fetcher = fetcher;   // tests inject; default rides safefetch lazily
-  }
-
-  // A DID is bridged when Bridgy Fed serves an AP actor for it. Cached on
-  // whatever record the caller keeps, so one join costs one probe.
-  async isBridged(did) {
-    try {
-      const { safeFetch } = await import('../shared/safefetch.mjs');
-      const doFetch = this.fetcher || ((u, i) => safeFetch(u, i));
-      const res = await doFetch(BRIDGE_ACTOR(did), { headers: { accept: AP_ACCEPT } });
-      return res.status < 400;
-    } catch { return false; }
-  }
-
-  // ONE reply ever: tell an unbridged joiner how to reach the fediverse side.
-  async nudge({ did, handle }) {
-    const text = `@${handle} welcome! Follow @ap.brid.gy and your posts will reach `
-      + 'the Fediverse side of this group too.';
-    const start = 0;
-    const rec = this.atproto.read();
-    await this.atproto.xrpc('com.atproto.repo.createRecord', {
-      body: {
-        repo: rec.did, collection: 'app.bsky.feed.post',
-        record: {
-          $type: 'app.bsky.feed.post', text,
-          facets: [{
-            index: { byteStart: start, byteEnd: start + 1 + handle.length },
-            features: [{ $type: 'app.bsky.richtext.facet#mention', did }],
-          }],
-          createdAt: new Date().toISOString(),
-        },
-      },
-    });
-  }
-
-  // A native follow of the group's Bluesky account. Bridged accounts are left
-  // to join through the bridge; unbridged ones become Bluesky-only members,
-  // through the same approval queue as everyone else.
-  async onFollow(author) {
-    const actor = profileUrl(author.did);
-    const contacts = this.store.getContacts();
-    if (contacts.followers.some(f => f.actor === actor)) return;
-    if (this.store.getRequests().some(r => r.actor === actor)) return;
-    if (this.store.isBlocked(actor)) return;
-    if (await this.isBridged(author.did)) {
-      this.log(`bluesky follow from bridged @${author.handle} — their join arrives over AP`);
-      return;
-    }
-    const member = { actor, bsky: { did: author.did, handle: author.handle } };
-    if (this.store.getConfig()?.approveJoins) {
-      const reqs = this.store.getRequests();
-      reqs.unshift({ ...member, at: new Date().toISOString() });
-      this.store.setRequests(reqs);
-      this.log(`bluesky join request held: @${author.handle}`);
-      return;
-    }
-    contacts.followers.push(member);
-    this.store.setContacts(contacts);
-    this.store.addNotification({ type: 'follow', actor, bsky: true });
-    await this.nudgeOnce(member);
-    this.log(`bluesky member joined: @${author.handle}`);
-  }
-
-  async nudgeOnce(member) {
-    if (member.nudgedAt) return;
-    try {
-      await this.nudge(member.bsky);
-      member.nudgedAt = new Date().toISOString();
-      const contacts = this.store.getContacts();
-      const rec = contacts.followers.find(f => f.actor === member.actor);
-      if (rec) { rec.nudgedAt = member.nudgedAt; this.store.setContacts(contacts); }
-    } catch (e) { this.log(`bluesky nudge failed for @${member.bsky?.handle}: ${e.message}`); }
-  }
-
-  // A mention of the group's handle is a submission — same rules as an AP
-  // member addressing the group. amplify() applies the member, mute, and
-  // review checks; its bsky branch calls carry() below.
-  async onMention(n) {
-    const actor = profileUrl(n.author.did);
-    const isMember = this.store.getContacts().followers.some(f => f.actor === actor);
-    if (!isMember) { this.log(`bluesky mention from non-member @${n.author.handle} — ignored`); return; }
-    await this.intake.amplify(n.uri, {});
-  }
-
-  // The group's carry of a member's Bluesky post: a native repost. AP
-  // followers get it only when the author is bridged — the group never
-  // fabricates an AP object for someone else's words.
-  async carry(s) {
-    const rec = this.atproto.read();
-    const out = await this.atproto.xrpc('com.atproto.repo.createRecord', {
-      body: {
-        repo: rec.did, collection: 'app.bsky.feed.repost',
-        record: {
-          $type: 'app.bsky.feed.repost',
-          subject: { uri: s.noteId, cid: s.cid },
-          createdAt: new Date().toISOString(),
-        },
-      },
-    });
-    this.store.updateStatus(s.noteId, { announcedAt: new Date().toISOString(), repostUri: out.uri });
-    this.store.setPending(this.store.getPending().filter(p => p.noteId !== s.noteId));
-    this.log(`bluesky repost: ${s.noteId}`);
-    return { ok: true, noteId: s.noteId, repost: out.uri };
-  }
-
-  // Unsay a repost.
-  async retract(s) {
-    if (!s.repostUri) throw new Error('that post was never carried');
-    await this.atproto.deleteCrossPost(s.repostUri);
-    this.store.updateStatus(s.noteId, {
-      announcedAt: undefined, repostUri: undefined, retractedAt: new Date().toISOString(),
-    });
-    return { ok: true, noteId: s.noteId, inboxes: 0 };
-  }
-
-  // An AP member's post the group just Announced, shown natively to the
-  // group's Bluesky followers: the group account posts the conversion with
-  // attribution and the link back.
-  async mirrorCarry(s) {
-    if (!this.store.getConfig()?.atproto?.crossPost) return;
-    const handle = this.store.handleOf?.(s.actor) || s.actor;
-    const plain = String(s.content || '').replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim();
-    const body = bskyText(`via ${handle}: ${plain}`, s.noteId);
-    const rec = this.atproto.read();
-    await this.atproto.xrpc('com.atproto.repo.createRecord', {
-      body: {
-        repo: rec.did, collection: 'app.bsky.feed.post',
-        record: {
-          $type: 'app.bsky.feed.post', text: body.text,
-          ...(body.facets.length ? { facets: body.facets } : {}),
-          createdAt: new Date().toISOString(),
-        },
-      },
-    });
-  }
-
-  // Ejection's Bluesky half: the DID is blocked so the departure sticks.
-  async blockDid(did) {
-    const rec = this.atproto.read();
-    await this.atproto.xrpc('com.atproto.repo.createRecord', {
-      body: {
-        repo: rec.did, collection: 'app.bsky.graph.block',
-        record: { $type: 'app.bsky.graph.block', subject: did, createdAt: new Date().toISOString() },
-      },
-    });
-  }
-}

package/lib/connections/fediacct.mjs

@@ -1,253 +0,0 @@
-// fediacct.mjs — the agent's connections to fediverse accounts the owner holds
-// on OTHER servers. The agent is an API client of an existing Mastodon-API
-// account, the same relationship a Mastodon app has to this agent, and the same
-// one atproto.mjs has to a Bluesky account. Nothing here is a second identity:
-// no key, no pod, nothing published.
-//
-// One credential per account, stamped with the actor it was connected for
-// (the keys.json rules). A record stamped for someone else is skipped rather
-// than fatal, so one stray one cannot cost the owner the whole roster.
-//
-// Where they are kept is vault.mjs's decision: this machine when the identity
-// runs on a laptop, the identity's own pod when it runs inside the pod server.
-// Either way config.json gets the handle and the host and nothing more — the
-// roster is public to anyone who can read the identity's config, the token
-// never is.
-
-import path from 'node:path';
-import crypto from 'node:crypto';
-import { fileVault } from './vault.mjs';
-import { safeFetch, retryAfterMs } from '../shared/safefetch.mjs';
-
-const DIR = 'fediaccts';
-const APPS = '_apps';
-const SCOPES = 'read write';
-const STATE_TTL_MS = 10 * 60_000;
-const CLIENT_NAME = 'FediPod';
-
-// The id becomes a file name, and both halves come from a remote server's own
-// answer. `--handle ../escape` is the shape of bug this project has already
-// paid for once, so the result is checked rather than trusted.
-export function safeId(user, host) {
-  const id = `${String(user || '').trim()}@${String(host || '').trim()}`
-    .toLowerCase().replace(/[^a-z0-9.@_-]/g, '-');
-  if (!/^[a-z0-9][a-z0-9.@_-]{0,80}$/.test(id) || id.includes('..')) return null;
-  return id;
-}
-
-// A host as we will address it: bare authority, no scheme, no path, no case.
-export function cleanHost(host) {
-  const raw = String(host || '').trim().replace(/^https?:\/\//i, '').replace(/\/.*$/, '');
-  return /^[a-z0-9.-]+(:\d+)?$/i.test(raw) ? raw.toLowerCase() : null;
-}
-
-export class FediAccounts {
-  /**
-   * `vault` and `apps` are where the credentials and the per-host app
-   * registrations live. Absent, they are the directories beside the
-   * credential file, which is what a laptop wants.
-   */
-  constructor({ localDir, vault = null, apps = null, actorId = null, log = console.log, fetcher = null }) {
-    this.vault = vault || fileVault(path.join(localDir, DIR));
-    this.apps = apps || fileVault(path.join(localDir, DIR, APPS));
-    this.actorId = actorId;
-    this.log = log;
-    // Injectable for tests; the default is the politeness stack, which also
-    // refuses private addresses — a connected account is on the public web.
-    this.fetcher = fetcher || ((url, init) => safeFetch(url, init));
-    this.pausedUntil = new Map();          // host → epoch ms
-    this.pending = new Map();              // state nonce → { host, redirectUri, at }
-  }
-
-  // ---- records ----
-
-  ids() { return this.vault.names().filter(n => !n.startsWith('_')); }
-
-  read(id) {
-    const rec = this.vault.read(id);
-    if (!rec) return null;
-    if (rec?.mintedFor && this.actorId && rec.mintedFor !== this.actorId) {
-      this.log(`the connection record for ${id} belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
-      return null;
-    }
-    return rec;
-  }
-
-  write(rec) { this.vault.write(rec.id, rec); }
-
-  list() { return this.ids().map(id => this.read(id)).filter(Boolean); }
-
-  connected() { return this.list().some(r => r.token && r.enabled !== false); }
-
-  // What may be written to pod state: who, where, and whether it is polled.
-  roster() {
-    return this.list().map(r => ({
-      id: r.id, handle: r.handle, host: r.host,
-      addedAt: r.addedAt || null, enabled: r.enabled !== false,
-    }));
-  }
-
-  status() {
-    return this.list().map(r => ({
-      id: r.id, handle: r.handle, host: r.host,
-      enabled: r.enabled !== false,
-      needsReconnect: !!r.needsReconnect,
-      cooldownFor: Math.max(0, Math.round(((this.pausedUntil.get(r.host) || 0) - Date.now()) / 1000)),
-    }));
-  }
-
-  setEnabled(id, on) {
-    const rec = this.read(id);
-    if (!rec) return null;
-    this.write({ ...rec, enabled: !!on });
-    return this.roster().find(r => r.id === id) || null;
-  }
-
-  async remove(id) {
-    if (!this.read(id)) return false;
-    if (!await this.vault.remove(id)) return false;
-    this.log(`Fediverse account disconnected: ${id}`);
-    return true;
-  }
-
-  // ---- HTTP ----
-
-  async _fetch(host, url, init) {
-    const left = (this.pausedUntil.get(host) || 0) - Date.now();
-    if (left > 0) throw new Error(`${host} asked us to back off — ${Math.ceil(left / 1000)}s left`);
-    const res = await this.fetcher(url, init);
-    if (res.status === 429 || res.status === 503) {
-      const ms = retryAfterMs(res) ?? 60_000;
-      this.pausedUntil.set(host, Date.now() + ms);
-      this.log(`${host} answered ${res.status} — pausing for ${Math.round(ms / 1000)}s`);
-    }
-    return res;
-  }
-
-  async _json(res, host) {
-    const body = await res.json().catch(() => ({}));
-    if (res.status >= 400) {
-      const err = new Error(body.error_description || body.error || `${host} answered ${res.status}`);
-      err.status = res.status;
-      throw err;
-    }
-    return body;
-  }
-
-  // ---- the OAuth dance, as the client ----
-
-  // One app registration per host, remembered. The redirect_uri is part of what
-  // was registered, so an agent that moved to another port re-registers rather
-  // than sending the server a redirect it will refuse.
-  async appFor(host, redirectUri) {
-    const known = this.apps.read(host);
-    if (known?.redirectUri === redirectUri && known.clientId && known.clientSecret) return known;
-    const res = await this._fetch(host, `https://${host}/api/v1/apps`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({
-        client_name: CLIENT_NAME, redirect_uris: redirectUri,
-        scopes: SCOPES, website: 'https://github.com/jeff-zucker/FediPod',
-      }),
-    });
-    const body = await this._json(res, host);
-    if (!body.client_id || !body.client_secret) throw new Error(`${host} registered no client`);
-    const app = { host, redirectUri, clientId: body.client_id, clientSecret: body.client_secret };
-    this.apps.write(host, app);
-    return app;
-  }
-
-  // Step one: where to send the browser. The state nonce is single-use and
-  // short-lived — without one, any page the owner visits could hand our
-  // callback somebody else's authorization code and bind THEIR account here.
-  async begin({ host, redirectUri }) {
-    const h = cleanHost(host);
-    if (!h) throw new Error('that is not a server address');
-    const app = await this.appFor(h, redirectUri);
-    const state = crypto.randomBytes(24).toString('hex');
-    const now = Date.now();
-    for (const [k, v] of this.pending) if (now - v.at > STATE_TTL_MS) this.pending.delete(k);
-    this.pending.set(state, { host: h, redirectUri, at: now });
-    const u = new URL(`https://${h}/oauth/authorize`);
-    u.searchParams.set('client_id', app.clientId);
-    u.searchParams.set('redirect_uri', redirectUri);
-    u.searchParams.set('response_type', 'code');
-    u.searchParams.set('scope', SCOPES);
-    u.searchParams.set('state', state);
-    return { url: u.href, state, host: h };
-  }
-
-  // Step two: the code comes back. Exchange it, ask the server who we now are,
-  // and only then write anything.
-  async complete({ state, code }) {
-    const pend = this.pending.get(state);
-    if (!pend || Date.now() - pend.at > STATE_TTL_MS) throw new Error('that sign-in has expired — start again');
-    this.pending.delete(state);
-    const { host, redirectUri } = pend;
-    const app = await this.appFor(host, redirectUri);
-    const res = await this._fetch(host, `https://${host}/oauth/token`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({
-        grant_type: 'authorization_code', code, redirect_uri: redirectUri,
-        client_id: app.clientId, client_secret: app.clientSecret, scope: SCOPES,
-      }),
-    });
-    const tok = await this._json(res, host);
-    if (!tok.access_token) throw new Error(`${host} returned no token`);
-    const me = await this.whoami(host, tok.access_token);
-    const id = safeId(me.username, host);
-    if (!id) throw new Error(`${host} answered with a name we cannot file safely`);
-    this.write({
-      id, host, token: tok.access_token, scope: tok.scope || SCOPES,
-      handle: `@${me.username}@${host}`, acct: me.acct || me.username,
-      accountId: String(me.id), actorUrl: me.url || null,
-      name: me.display_name || me.username, icon: me.avatar || null,
-      addedAt: new Date().toISOString(), enabled: true,
-      ...(this.actorId ? { mintedFor: this.actorId } : {}),
-    });
-    // The owner has just been through a browser to get this; it is written
-    // down before they are told it worked.
-    if (!await this.vault.commit()) throw new Error('the connection could not be written down');
-    this.log(`Fediverse account connected: @${me.username}@${host}`);
-    return this.roster().find(r => r.id === id);
-  }
-
-  async whoami(host, token) {
-    const res = await this._fetch(host, `https://${host}/api/v1/accounts/verify_credentials`, {
-      headers: { authorization: `Bearer ${token}` },
-    });
-    const me = await this._json(res, host);
-    if (!me.username) throw new Error(`${host} did not say who we are`);
-    return me;
-  }
-
-  // ---- authenticated calls on behalf of one connected account ----
-
-  // Returns the Response, so a caller can read rate-limit headers. A 401 means
-  // the token was revoked on the far side: the account is marked rather than
-  // deleted, because the owner should be told rather than quietly dropped.
-  async api(id, pathname, init = {}) {
-    const rec = this.read(id);
-    if (!rec?.token) throw new Error(`no connected account ${id}`);
-    const url = pathname.startsWith('https://') ? pathname : `https://${rec.host}${pathname}`;
-    const res = await this._fetch(rec.host, url, {
-      ...init,
-      headers: { ...(init.headers || {}), authorization: `Bearer ${rec.token}` },
-    });
-    if (res.status === 401) {
-      if (!rec.needsReconnect) this.write({ ...rec, needsReconnect: true });
-      const err = new Error(`${rec.handle} no longer accepts our token — reconnect it`);
-      err.status = 401;
-      throw err;
-    }
-    if (rec.needsReconnect && res.status < 400) this.write({ ...rec, needsReconnect: false });
-    return res;
-  }
-
-  async apiJson(id, pathname, init = {}) {
-    const rec = this.read(id);
-    const res = await this.api(id, pathname, init);
-    return this._json(res, rec?.host || id);
-  }
-}