fedipod-server 0.9.0 → 0.11.0

package/lib/wire.mjs

@@ -6,75 +6,40 @@ export const AS_CTX = 'https://www.w3.org/ns/activitystreams';
 export const SEC_CTX = 'https://w3id.org/security/v1';
 export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 
-// URLs of the actor's documents on the remote pod. Everything the agent owns
-// nests under ONE top-level container (`root`) so the pod stays tidy and one
-// pod could host several actors under different roots. Webfinger + host-meta
-// stay at the pod root — fediverse discovery requires the host root.
-// The AP URLs for an identity. Normally everything hangs off the pod home.
-//
-// When `publicBase` is given (a fronted identity, e.g.
-// "https://fedipod.net/u/me/"), the ADVERTISED ids — the actor and everything
-// under `ap/` a remote server sees — build on the fronted home instead, while
-// the pod-side trees (`fediverse/`, `ap-state/`) and the write targets stay on
-// the pod. `toPod`/`toPublic` map between the two spaces; `RemotePod` applies
-// `toPod` at its one request choke point, so publisher/social/intake keep
-// passing advertised ids and the writes still land on the pod. With no
-// `publicBase` the returned object is byte-identical to before — the invariant
-// the smoke suite pins.
+// The pod LAYOUT — which container each document lives in — moved into the pod
+// library (lib/pod/urls.mjs), which knows nothing about FediPod and requires
+// the container root to be stated rather than defaulted. What stays here is
+// FediPod's own answer to "which root", and the handle rule, both of which read
+// this application's config shape.
+import { apUrls as podUrls } from './pod/urls.mjs';
+
+export { webfingerHost } from './pod/urls.mjs';
+
+// The container the Node agent has always used. Older than the rename to
+// FediPod and kept because it is what every existing Node-side pod actually
+// contains; the browser build states `fedipod/` on its own configs. A config
+// that names a root is always believed — this is only the answer for one that
+// does not.
+export const DEFAULT_ROOT = 'activitypods-js/';
+
 // The handle the fediverse sees: a fronted identity's name is the front's.
 export function publicHandle(config) {
   return config?.gateway?.frontActor?.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1]
     || config?.handle || null;
 }
 
-export function apUrls(remotePod, root = 'activitypods-js/', { publicBase = null } = {}) {
-  const base = remotePod.endsWith('/') ? remotePod : remotePod + '/';
-  const home = base + (!root || root.endsWith('/') ? root : root + '/');
-  // The face a remote sees: the fronted home, or the pod home when unfronted.
-  const face = publicBase ? (publicBase.endsWith('/') ? publicBase : publicBase + '/') : home;
-  const urls = {
-    base, home,
-    webfinger: base + '.well-known/webfinger',
-    actor: face + 'ap/actor',
-    inbox: face + 'ap/inbox/',
-    outbox: face + 'ap/outbox',
-    followers: face + 'ap/followers',
-    following: face + 'ap/following',
-    notes: face + 'ap/notes/',
-    privateNotes: face + 'ap/private/',
-    featured: face + 'ap/featured',
-    // FEP-1b12: the moderator roster a recipient validates announced
-    // moderation against. Published only when moderators are configured.
-    moderators: face + 'ap/moderators',
-    // FEP-4ccd and FEP-c648: follows in limbo and the block list, as
-    // collections. They live in the private container so the owner-only ACL
-    // is inherited, not re-stated per document.
-    pendingFollowers: face + 'ap/private/pending-followers',
-    pendingFollowing: face + 'ap/private/pending-following',
-    blocked: face + 'ap/private/blocked',
-    profileHtml: face + 'ap/profile.html',
-    // Media stays on the pod even when fronted: attachment urls are not
-    // identity-checked by remotes, and proxying blobs would be pure cost.
-    media: home + 'ap/media/',
-    fediverse: home + 'fediverse/',
-    state: home + 'ap-state/',
-  };
-  if (publicBase) {
-    urls.podHome = home;
-    urls.publicHome = face;
-    urls.toPod = (u) => (typeof u === 'string' && u.startsWith(face) ? home + u.slice(face.length) : u);
-    urls.toPublic = (u) => (typeof u === 'string' && u.startsWith(home) ? face + u.slice(home.length) : u);
-  }
-  return urls;
-}
-
-// The host a handle would resolve through, or null when no handle can point
-// here. @name@host is looked up at https://host/.well-known/webfinger, so only
-// a pod that owns the root of its host can answer for one; a pod living at
-// https://server/name/ may publish the document but nothing will ever ask.
-export function webfingerHost(podUrl) {
-  const u = new URL(podUrl);
-  return u.pathname === '/' ? u.host : null;
+/**
+ * The AP URLs for an identity, with FediPod's default root applied.
+ *
+ * The library underneath refuses to guess a root. Every caller here goes
+ * through this wrapper so there is exactly ONE answer to "which container",
+ * which is the thing that was wrong: the browser agent decided `fedipod/` for
+ * its own urls while the publisher, handed a config with no `root`, decided
+ * `activitypods-js/` — putting an identity's state in one container and its
+ * published documents in another.
+ */
+export function apUrls(remotePod, root, opts = {}) {
+  return podUrls(remotePod, root || DEFAULT_ROOT, opts);
 }
 
 // RFC 6415 host-meta: several fediverse implementations discover WebFinger
@@ -585,15 +550,31 @@ export function titledContent(note) {
 }
 
 // Normalize a wire Note's attachment list to { url, mediaType, description }.
+// Capped: this list comes from somebody else's document and lands in a
+// statuses.json row, which is rewritten whole on every change. Twenty is more
+// than any client shows and more than any real post carries.
+const MAX_ATTACHMENTS = 20;
+const MAX_ATTACHMENT_URL = 2048;
+// http(s) only: an attachment URL becomes a client's <img src> or <video src>,
+// and the store has guarded avatars this way all along (safeUrl).
+const attachmentUrl = (u) => {
+  if (!u) return null;
+  const s = String(u).slice(0, MAX_ATTACHMENT_URL);
+  try {
+    const p = new URL(s);
+    return (p.protocol === 'https:' || p.protocol === 'http:') ? s : null;
+  } catch { return null; }
+};
+
 export function attachmentsOf(note) {
   const list = Array.isArray(note?.attachment) ? note.attachment : note?.attachment ? [note.attachment] : [];
   // A bare Link carries `href` and no `url` — Lemmy's link posts arrive that
   // way, and reading only `url` dropped the link the post was about.
-  return list.map(a => ({
+  return list.slice(0, MAX_ATTACHMENTS).map(a => ({
     url: typeof a?.url === 'string' ? a.url : a?.url?.href || (typeof a?.href === 'string' ? a.href : undefined),
-    mediaType: a?.mediaType || '',
-    ...(a?.name ? { description: a.name } : {}),
-  })).filter(a => a.url);
+    mediaType: String(a?.mediaType || '').slice(0, 128),
+    ...(a?.name ? { description: String(a.name).slice(0, 1500) } : {}),
+  })).map(a => ({ ...a, url: attachmentUrl(a.url) })).filter(a => a.url);
 }
 
 const HTML_ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;' };
@@ -660,6 +641,45 @@ export function noteDoc({ urls, slug, content, published, inReplyTo, attachments
   return note;
 }
 
+// A poll is a note that asks something: the same addressing, the same
+// mentions, the same replies collection, with the choices in `oneOf` (pick
+// one) or `anyOf` (pick several). Each choice carries the count as the
+// totalItems of its own replies collection, which is where every server that
+// shows a poll reads it from.
+//
+// `endTime` is when voting stops and `closed` is the stamp saying it has —
+// both plain AS2. `votersCount` is Mastodon's: PEOPLE rather than answers,
+// which differ only once a poll takes several answers each. It is not in the
+// base context, so it is declared inline exactly as Mastodon declares it, and
+// only when we actually carry it.
+export function questionDoc({ options = [], multiple = false, endTime = null,
+  closed = null, votersCount = null, ...rest }) {
+  const note = noteDoc(rest);
+  const choices = options.map(o => ({
+    type: 'Note',
+    name: String(o.title),
+    replies: { type: 'Collection', totalItems: Number(o.votes) || 0 },
+  }));
+  const question = {
+    ...note,
+    type: 'Question',
+    [multiple ? 'anyOf' : 'oneOf']: choices,
+  };
+  if (endTime) question.endTime = endTime;
+  if (closed) question.closed = closed;
+  if (votersCount !== null && votersCount !== undefined) {
+    question['@context'] = [AS_CTX, {
+      toot: 'http://joinmastodon.org/ns#',
+      votersCount: {
+        '@id': 'toot:votersCount',
+        '@type': 'http://www.w3.org/2001/XMLSchema#nonNegativeInteger',
+      },
+    }];
+    question.votersCount = votersCount;
+  }
+  return question;
+}
+
 // The id is a document of its own, not `note.id + '#create'`. A group wraps this
 // whole activity in its Announce (FEP-1b12), and the receiver resolves it by
 // dereferencing this id — a fragment would just serve the Note back under a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/run-agent.mjs

@@ -34,7 +34,6 @@ import { ensureTrustedTls } from './lib/certs.mjs';
 import { storageFor } from './lib/storage.mjs';
 import { resolveKeys } from './lib/keys.mjs';
 import { RemotePod } from './lib/remote.mjs';
-import { PodRdf } from './lib/podrdf.mjs';
 import { Deliverer } from './lib/deliver.mjs';
 import { Publisher } from './lib/publisher.mjs';
 import { Intake } from './lib/intake.mjs';
@@ -69,15 +68,14 @@ export class Agent {
 
   // Where the private half lives. `privateRoot` in the credential file names a
   // container — by default a plain directory beside the credential, and a pod
-  // on this machine if you move it there — under which the same two trees are
-  // laid out as on the pod. Absent means on the pod, exactly as before, so an
+  // on this machine if you move it there. Absent means on the pod, so an
   // existing install is untouched.
   privateUrls(cred, urls = this.urls) {
     if (!cred.privateRoot) {
-      return { state: urls.state, fediverse: urls.fediverse, archive: urls.home + 'inbox-archive/', elsewhere: false };
+      return { state: urls.state, archive: urls.home + 'inbox-archive/', elsewhere: false };
     }
     const base = cred.privateRoot.endsWith('/') ? cred.privateRoot : cred.privateRoot + '/';
-    return { state: base + 'ap-state/', fediverse: base + 'fediverse/', archive: base + 'inbox-archive/', elsewhere: true };
+    return { state: base + 'ap-state/', archive: base + 'inbox-archive/', elsewhere: true };
   }
 
   // A container to keep the private half in. On the pod it is reached with the
@@ -146,14 +144,9 @@ export class Agent {
     await this.remote.setAcl(this.urls.home, []);
     await this.remote.setAcl(this.urls.state, []);
     if (priv.elsewhere) {
-      for (const s of [stateStore, this.privateStorage(cred, 'fediverse')]) {
-        const r = await s.write('.keep', '{"keep":true}\n', 'application/json');
-        if (!r.ok) throw new Error(`private store ${s.base}.keep → ${r.why}`);
-      }
+      const r = await stateStore.write('.keep', '{"keep":true}\n', 'application/json');
+      if (!r.ok) throw new Error(`private store ${stateStore.base}.keep → ${r.why}`);
       this.log(`private state lives at ${cred.privateRoot} (${stateStore.kind})`);
-    } else {
-      await this.remote.putJson(this.urls.fediverse + '.keep', { keep: true }, 'application/json');
-      await this.remote.setAcl(this.urls.fediverse, []);
     }
     this.store.attach(stateStore);
     // Re-running setup must not destroy state set afterwards (the UI
@@ -314,7 +307,6 @@ export class Agent {
       const { rotateKeyOnce, ...rest } = cred;
       writeJsonAtomic(path.join(this.home, 'credential.json'), rest);
     }
-    this.local = new PodRdf({ storage: this.privateStorage(cred, 'fediverse') });
     // connect() can run more than once — connectWithRetry retries after a throw,
     // and the CLI connects for real after its confirmation. Deliverer arms a
     // 60s queue timer in its constructor and Intake owns a poll timer and a
@@ -324,6 +316,7 @@ export class Agent {
     this.deliverer?.stop();
     this.tagfeed?.stop();
     clearInterval(this.schedTimer);
+    this.publisher?.stopPolls();
     this.deliverer = new Deliverer({
       store: this.store, rsaPrivate: keys.rsaPrivate, keyId: this.urls.actor + '#main-key',
       actorId: this.urls.actor, edPrivate: keys.edPrivate,
@@ -331,13 +324,10 @@ export class Agent {
       log: this.log, passive: this.viewer,
     });
     this.publisher = new Publisher({
-      config, remote: this.remote, local: this.local, store: this.store,
+      config, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem,
       assertionKey: keys.edPublicMultibase, log: this.log,
       resolveMention: (h) => resolveHandle(this, h),
-      // Whether the fediverse tree is on the pod at all, so the ACL check does
-      // not probe for something the default layout keeps on local disk.
-      privateOnPod: !cred.privateRoot,
       // Inside a pod server the client surface answers on the pod's own
       // origin, so it can be advertised. Standalone it is on loopback, and
       // naming it in a world-readable actor would send clients nowhere.
@@ -346,7 +336,7 @@ export class Agent {
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.
     this.intake = new Intake({
-      config, urls: this.urls, remote: this.remote, local: this.local, store: this.store,
+      config, urls: this.urls, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publisher: this.publisher, log: this.log, lease: this.lease,
       archive: this.privateStorage(cred, 'archive'),
       push: !this.embedded, pollSeconds: this.pollSeconds || null,
@@ -547,6 +537,10 @@ export class Agent {
         }).then(() => this.log(`scheduled post published (${e.id})`))
           .catch(err => this.log(`scheduled post ${e.id} failed: ${err.message} — dropped`));
       }
+      // A poll whose time is up is shut on the same sweep: it stops taking
+      // answers here, and everyone holding it is told once.
+      this.publisher.closeDuePolls()
+        .catch(err => this.log(`closing polls: ${err.message}`));
     }, 30_000);
     this.schedTimer.unref();
     // A CSV import interrupted by a restart or a handoff picks back up here.
@@ -576,7 +570,7 @@ export class Agent {
       this.ensureActorPublished()
         .catch(e => this.log(`actor check failed: ${e.message}`));
     }
-    this.backfillStatuses().catch(e => this.log(`statuses backfill failed: ${e.message}`));
+    this.seedFollowNotifications().catch(e => this.log(`notification seeding failed: ${e.message}`));
   }
 
   // Re-read state before acting on what we hold. A viewer's cache is kept
@@ -651,6 +645,7 @@ export class Agent {
     this.deliverer?.stop();
     this.importer?.stop();
     clearInterval(this.schedTimer);
+    this.publisher?.stopPolls();
     // The lease too: standing down means standing down. Left renewing, a viewer
     // keeps writing to the pod on the active agent's behalf and can win the
     // lease back on a conditional PUT it had no business making.
@@ -689,27 +684,13 @@ export class Agent {
     return true;
   }
 
-  // The statuses index is an operational mirror of the pod's RDF — rebuild it
-  // from /fediverse/ when absent (fresh state, or state loss).
-  async backfillStatuses() {
-    if (!this.store.has('notifications.json')) {
-      for (const f of this.store.getContacts().followers) {
-        this.store.addNotification({ type: 'follow', actor: f.actor });
-      }
-    }
-    if (this.store.has('statuses.json')) return;
-    const entries = [];
-    for (const [container, kind] of [['timeline', 'timeline'], ['posts', 'post']]) {
-      for (const url of await this.local.listNotes(container)) {
-        try {
-          const n = await this.local.readNote(url);
-          if (n.noteId) entries.push({ ...n, kind, slug: url.split('/').pop() });
-        } catch (e) { this.log(`backfill: skipped ${url}: ${e.message}`); }
-      }
+  // A first run inherits followers without ever having seen them arrive, so
+  // the notifications list starts empty where it should start full.
+  async seedFollowNotifications() {
+    if (this.store.has('notifications.json')) return;
+    for (const f of this.store.getContacts().followers) {
+      this.store.addNotification({ type: 'follow', actor: f.actor });
     }
-    entries.sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
-    this.store.write('statuses.json', entries.slice(0, 1000));
-    this.log(`backfilled ${entries.length} statuses from pod RDF`);
   }
 }
 

package/web/admin/admin.js

@@ -13,8 +13,15 @@ const $ = (id) => document.getElementById(id);
 // machine, `/app` when the identity is hosted by its own pod server. Read from
 // the page's own address, so one build serves both.
 const BASE = location.pathname.replace(/\/admin\/.*$/u, '');
+// Every call carries `x-fedipod-page`. On the Node agent it is ignored — the
+// Origin check there already refuses a page on somebody else's site. In the
+// browser build the agent IS this origin's service worker, which cannot see
+// Sec-Fetch-* and answers these routes with no password, so this header is the
+// whole door: a cross-site form cannot set one, and a cross-origin fetch that
+// sets one is stopped at a preflight the worker never grants. See sw-src.mjs.
+const PAGE_HEADER = { 'x-fedipod-page': '1' };
 const api = async (path, init) => {
-  const res = await fetch(BASE + path, init);
+  const res = await fetch(BASE + path, { ...init, headers: { ...(init?.headers || {}), ...PAGE_HEADER } });
   return { status: res.status, json: await res.json().catch(() => null) };
 };
 const postJson = (path, body) => api(path, {
@@ -27,14 +34,12 @@ let config = null;
 const MODERATION = $('moderation');
 const STATUS = $('status-ctl');
 const STATUS_PICK = $('status-pick');   // held: getElementById can't see it mid-render
-const BSKY_CTL = $('bsky-ctl');
 const IDENT_CTL = $('ident-ctl');
 const FOLLOWS_CTL = $('follows-ctl');
 const FOLLOWS_PICK = $('follows-pick');
 const UPDATE_CTL = $('update-ctl');
 const UPDATE_WORD = $('update-word');
 const UPDATE_GO = $('update-go');
-const BSKY_CROSSPOST = $('bsky-crosspost');   // held: it rides BSKY_CTL into a generated row
 
 // #say and #fatal live in the accessibility tree from load and hide by being
 // empty (see the stylesheet). Unhiding a live region and filling it in the same
@@ -95,10 +100,7 @@ function resetConfirm() {
   $('confirm-handle').value = '';
   $('confirm-handle-move').value = '';
   $('move-target').value = '';
-  $('state-path').value = '';
-  $('state-url').value = '';
-  document.querySelector('input[name=stateWhere][value=path]').checked = true;
-  stateRows();
+  $('rotate-password').value = '';
 }
 function closePanels(keep = null) {
   if (!keep) solWindow.close();
@@ -126,34 +128,129 @@ function identityRows() {
     dd.append(...nodes);
     out.push([dt, dd]);
   };
-  if (config.atproto?.connected) {
-    const a = document.createElement('a');
-    a.href = `https://bsky.app/profile/${config.atproto.handle}`;
-    a.textContent = `@${config.atproto.handle}`;
-    a.target = '_blank';
-    a.rel = 'noopener';
-    a.title = `   Open this account's Bluesky page in a new tab`;
-    BSKY_CTL.hidden = false;
-    BSKY_CROSSPOST.value = config.atproto.crossPost ? 'on' : 'off';
-    row('Bluesky', a, ' ', BSKY_CTL);
-  } else {
-    BSKY_CTL.hidden = true;
+  // One descriptor shape for every connected account — Bluesky and each
+  // fediverse account — so the row and its Options menu build the same way.
+  const accounts = [];
+  if (config.atproto?.connected) accounts.push({
+    label: 'Bluesky', handle: `@${config.atproto.handle}`,
+    href: `https://bsky.app/profile/${config.atproto.handle}`,
+    storage: config.atproto.storage || null,
+    feedPaused: 'feedPaused' in config.atproto ? config.atproto.feedPaused : null,
+    crossPost: 'crossPost' in config.atproto ? config.atproto.crossPost : null,
+    feed: (paused) => ['/atproto', { feedPaused: paused }],
+    cross: (on) => ['/atproto', { crossPost: on }],
+    store: (w) => ['/atproto', { storage: w }],
+    off: () => ['/atproto/disconnect', {}],
+  });
+  for (const acct of config.fediAccounts || []) accounts.push({
+    label: acct.host,
+    handle: acct.needsReconnect ? `${acct.handle} — sign in again` : acct.handle,
+    warn: acct.needsReconnect,
+    storage: acct.storage || null,
+    feedPaused: !acct.enabled,
+    crossPost: null,
+    feed: (paused) => ['/fediacct', { id: acct.id, enabled: !paused }],
+    store: (w) => ['/fediacct', { id: acct.id, storage: w }],
+    off: () => ['/fediacct/disconnect', { id: acct.id }],
+  });
+  for (const acct of accounts) {
+    const name = document.createElement(acct.href ? 'a' : 'span');
+    name.textContent = acct.handle;
+    if (acct.href) { name.href = acct.href; name.target = '_blank'; name.rel = 'noopener'; name.title = '   Open this account elsewhere in a new tab'; }
+    if (acct.warn) name.className = 'warn';
+    // Where storage is a real choice (every browser-build account today), two
+    // dropdowns sit in the row itself. Where it isn't (the Node agent's
+    // Bluesky, which shows a cross-post toggle instead), the Options
+    // disclosure it always has is unchanged.
+    row(acct.label, name, ' ', ...(acct.storage ? connectionControls(acct) : [optionsMenu(acct)]));
+  }
+  return out;
+}
+
+// Connected, Paused or Disconnected, and where the key lives — one dropdown
+// each, in the row. Replaces the separate feed and connect dropdowns that used
+// to sit behind an Options disclosure; only reached where acct.storage is set.
+function connectionControls(acct) {
+  const send = async ([path, payload], msg) => { if (await write(path, payload, msg)) await load(); };
+  const pick = (opts, current, onChange, title) => {
+    const el = document.createElement('select');
+    if (title) el.title = title;
+    for (const [v, t] of opts) { const o = document.createElement('option'); o.value = v; o.textContent = t; o.selected = v === current; el.appendChild(o); }
+    el.addEventListener('change', () => onChange(el.value));
+    return el;
+  };
+  const conn = pick(
+    [['connected', 'Connected'], ['paused', 'Paused'], ['disconnected', 'Disconnected']],
+    acct.feedPaused ? 'paused' : 'connected',
+    (v) => (v === 'disconnected'
+      ? send(acct.off(), 'disconnected')
+      : send(acct.feed(v === 'paused'), v === 'paused' ? 'paused adding to your feed' : 'added to your home feed')),
+    '   Connected feeds this account into your home feed here; Paused keeps the account but stops adding its posts; Disconnected removes it.');
+  const storage = pick(
+    [['pod', 'Store key on Pod'], ['browser', 'Store key in Browser']],
+    acct.storage,
+    (v) => {
+      if (v === 'pod' && !confirm('Store this account on your pod?\n\nIt will follow you to any browser you sign in from — but a full-access token to that account then lives on your pod.')) { load(); return; }
+      send(acct.store(v), v === 'pod' ? 'stored on your pod' : 'stored in this browser');
+    },
+    '   On your pod the key follows you to any browser you sign in from, and a full-access token then lives there; in this browser the token never leaves this device.');
+  const wrap = document.createElement('span');
+  wrap.className = 'conn-controls';
+  wrap.append(conn, ' ', storage);
+  return [wrap];
+}
+
+// Every connected account without a storage choice carries an Options menu
+// instead: pause its feed, its cross-post toggle (the Node agent's Bluesky),
+// disconnect.
+function optionsMenu(acct) {
+  const d = document.createElement('details');
+  d.className = 'opts';
+  const sum = document.createElement('summary');
+  sum.textContent = 'Options';
+  d.appendChild(sum);
+  const body = document.createElement('div');
+  d.appendChild(body);
+
+  // Each control is one dropdown whose options ARE the states, so it needs no
+  // separate label — the chosen option reads as the current state.
+  const pick = (opts, current, onChange) => {
+    const el = document.createElement('select');
+    for (const [v, t] of opts) { const o = document.createElement('option'); o.value = v; o.textContent = t; o.selected = v === current; el.appendChild(o); }
+    el.addEventListener('change', () => onChange(el.value));
+    body.appendChild(el);
+  };
+  const send = async ([path, payload], msg) => { if (await write(path, payload, msg)) await load(); };
+
+  // Feed: shown in / hidden from the feed you read here.
+  if (acct.feedPaused !== null) {
+    pick([['show', 'Add to home feed'], ['hide', 'Pause adding to home feed']], acct.feedPaused ? 'hide' : 'show',
+      (v) => send(acct.feed(v === 'hide'), v === 'hide' ? 'paused adding to your feed' : 'added to your home feed'));
   }
-  for (const acct of config.fediAccounts || []) {
-    const name = document.createElement('span');
-    name.textContent = acct.needsReconnect ? `${acct.handle} — sign in again` : acct.handle;
-    if (acct.needsReconnect) name.className = 'warn';
-    const off = document.createElement('button');
-    off.type = 'button';
-    off.className = 'inline danger';
-    off.textContent = 'Disconnect';
-    off.title = `   Stop reading ${acct.handle} and remove its stored token`;
-    off.addEventListener('click', async () => {
-      if (await write('/fediacct/disconnect', { id: acct.id }, `${acct.handle} disconnected`)) await load();
+  // Storage where the browser offers the choice; the Node agent's Bluesky shows
+  // its cross-post toggle in the same slot instead.
+  if (acct.storage) {
+    pick([['browser', 'Store key in Browser'], ['pod', 'Store key on Pod']], acct.storage, (v) => {
+      if (v === 'pod' && !confirm('Store this account on your pod?\n\nIt will follow you to any browser you sign in from — but a full-access token to that account then lives on your pod.')) { load(); return; }
+      send(acct.store(v), v === 'pod' ? 'stored on your pod' : 'stored in this browser');
     });
-    row(acct.host, name, ' ', off);
+  } else if (acct.crossPost !== null) {
+    pick([['on', 'Cross-post On'], ['off', 'Cross-post Off']], acct.crossPost ? 'on' : 'off',
+      (v) => send(acct.cross(v === 'on'), ''));
   }
-  return out;
+  // Connection: staying connected, or disconnecting.
+  pick([['connected', 'Connected'], ['disconnect', 'Disconnect']], 'connected',
+    (v) => { if (v === 'disconnect') send(acct.off(), 'disconnected'); else load(); });
+
+  // The storage consequence, at the bottom of the box under every dropdown.
+  if (acct.storage) {
+    const hint = document.createElement('p'); hint.className = 'opt-hint';
+    hint.textContent = acct.storage === 'pod'
+      ? 'Follows you to every browser you sign in from; a full-access token lives on your pod.'
+      : 'Stays in this browser; the token never leaves this device.';
+    body.appendChild(hint);
+  }
+  return d;
 }
 
 function render() {
@@ -180,9 +277,10 @@ function render() {
     ['Other identities', 'ctl'],
     ['local store', config.home],
     // The address you actually open, not the bare number — the named origin when
-    // there is one, since that is what the client and the OAuth redirect use.
-    ['local host', (origins.named || origins.loopback || `http://localhost:${config.port}`)
-      .replace(/\/$/, '')],
+    // there is one, since that is what the client and the OAuth redirect use. An
+    // agent with no local host of its own (embedded in a pod server, or in a
+    // browser) sends none, and then there is no row rather than a bare number.
+    ['local host', (origins.named || origins.loopback || '').replace(/\/$/, '') || null],
   ];
   if (config.version || config.update || config.pendingUpgrade?.length) rows.push(['software', 'ctl']);
   rows.push(['gateway', 'ctl']);
@@ -502,13 +600,8 @@ $('fediacct-form').addEventListener('submit', async (ev) => {
   } finally { fediBusy = false; }
 });
 
-$('bsky-disconnect').addEventListener('click', async () => {
-  if (bskyBusy) return;
-  bskyBusy = true;
-  try {
-    if (await write('/atproto/disconnect', {}, 'bluesky account disconnected')) await load();
-  } finally { bskyBusy = false; }
-});
+// Disconnecting Bluesky, pausing its feed and choosing its storage all live in
+// the account's Options menu now (see optionsMenu). Connecting is still here.
 // Adding resolves the old account on the agent side, so what lands in
 // alsoKnownAs is its canonical id, not the string typed here.
 // The accounts elsewhere this one may receive a Move from — the chips in the
@@ -553,15 +646,6 @@ $('alias-add').addEventListener('click', async () => {
   } finally { aliasBusy = false; }
 });
 
-// Silent on success — the select already shows the new state.
-const setCrossPost = async (on) => {
-  if (bskyBusy || on === !!config.atproto?.crossPost) return;
-  bskyBusy = true;
-  try {
-    if (await write('/atproto', { crossPost: on }, '')) config.atproto.crossPost = on;
-    BSKY_CROSSPOST.value = config.atproto?.crossPost ? 'on' : 'off';
-  } finally { bskyBusy = false; }
-};
 
 // ---- group ----
 
@@ -655,8 +739,6 @@ function onPick(el, apply, repaint = renderGroupToggles) {
 onPick($('joins-mod'), (v) => setJoins(v === MOD.on));
 onPick($('review-mod'), (v) => setReview(v === MOD.on));
 onPick(STATUS_PICK, (v) => setStatus(v === 'parked'), renderStatus);
-onPick(BSKY_CROSSPOST, (v) => setCrossPost(v === 'on'),
-  () => { BSKY_CROSSPOST.value = config?.atproto?.crossPost ? 'on' : 'off'; });
 
 // A person's follower gate. Automatic is what a migration wave needs: every
 // follower's server re-follows at once, and the waiting queue caps at 500.
@@ -897,21 +979,7 @@ const LIFECYCLE = {
   retire: { path: '/retire', title: 'Retire this identity', go: 'Retire it', danger: true, done: (r) => `retired ${r.deletedAt}: Delete delivered to ${r.inboxes} inbox(es)` },
   move: { path: '/move', title: 'Transfer this account away', go: 'Transfer it', focus: 'move-target',
     done: (r) => `transferred to ${r.target}: Move delivered to ${r.inboxes} inbox(es), unfollowed ${r.unfollowed}/${r.following}` },
-  'move-state': { path: '/state-move', title: 'Move private data', go: 'Move it', focus: 'state-path',
-    done: (r) => (r.unchanged ? 'already there — nothing moved'
-      : `moved ${r.docs} document(s) and ${r.notes} post(s) — private data is now ${r.now}`) },
 };
-
-// The destination choice reveals the field it needs: a directory for this
-// device, an address for another one, nothing for the pod.
-function stateRows() {
-  const w = picked('stateWhere');
-  $('state-row-path').hidden = w !== 'path';
-  $('state-row-url').hidden = w !== 'url';
-}
-for (const el of document.querySelectorAll('input[name=stateWhere]')) {
-  el.addEventListener('change', stateRows);
-}
 let pending = null;
 
 const closeConfirm = () => closePanels();
@@ -954,16 +1022,15 @@ $('confirm-form').addEventListener('submit', async (ev) => {
   const what = pending;
   const body = what === 'retire' ? { confirm: $('confirm-handle').value.trim() }
     : what === 'move' ? { target: $('move-target').value.trim(), confirm: $('confirm-handle-move').value.trim() }
-      : what === 'move-state' ? {
-        to: picked('stateWhere') === 'pod' ? 'pod'
-          : picked('stateWhere') === 'url' ? $('state-url').value.trim() : $('state-path').value.trim(),
-      }
+      // Only where the field is shown (the browser build — see index.html).
+      // On the Node agent the row stays hidden and nothing is sent, which is
+      // what that agent expects.
+      : what === 'rotate-key' && !$('rotate-pw-row').hidden
+        ? { password: $('rotate-password').value }
         : {};
   if (what === 'move' && !body.target) { say('name the account to transfer to', 'err'); return; }
-  if (what === 'move-state' && !body.to) { say('name the destination', 'err'); return; }
   $('confirm-go').disabled = true;
-  say(what === 'move-state' ? 'moving your private data — copying, checking, then switching over'
-    : `${what} — this talks to the pod and to other servers, so it takes a moment`);
+  say(`${what} — this talks to the pod and to other servers, so it takes a moment`);
   const r = await write(LIFECYCLE[what].path, body, what);
   $('confirm-go').disabled = false;
   if (!r) return;                        // write() already said why