fedipod 0.8.0

package/lib/atproto.mjs

@@ -0,0 +1,310 @@
+// atproto.mjs — the agent's connection to an ATProto (Bluesky) account. The
+// agent is an API CLIENT of an existing account on bsky.social or any PDS —
+// the same relationship a Mastodon app has to this agent. Nothing here hosts
+// ATProto; the pod stays the only public surface.
+//
+// Credential at AP_HOME/atproto.json (0600, atomic, stamped with the actor it
+// was connected for — the keys.json rules). The app password is kept so an
+// expired refresh token re-logins instead of demanding a reconnect.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { writeJsonAtomic } from './home.mjs';
+import { safeFetch, retryAfterMs } from './safefetch.mjs';
+
+const FILE = 'atproto.json';
+const POST_NSID = 'app.bsky.feed.post';
+const MAX_GRAPHEMES = 300;
+const MAX_IMAGES = 4;
+const MAX_BLOB_BYTES = 950_000;
+
+const enc = new TextEncoder();
+const seg = new Intl.Segmenter();
+const graphemes = (s) => { let n = 0; for (const _ of seg.segment(s)) n++; return n; };
+const byteLen = (s) => enc.encode(s).length;
+
+// Facet byte offsets are UTF-8 BYTE indexes into the text, not code units.
+function detectFacets(text) {
+  const facets = [];
+  for (const m of text.matchAll(/https?:\/\/[^\s<>"'\])]+/g)) {
+    facets.push({
+      index: { byteStart: byteLen(text.slice(0, m.index)), byteEnd: byteLen(text.slice(0, m.index + m[0].length)) },
+      features: [{ $type: 'app.bsky.richtext.facet#link', uri: m[0] }],
+    });
+  }
+  for (const m of text.matchAll(/(^|\s)#([\p{L}\p{N}_]+)/gu)) {
+    const start = m.index + m[1].length;
+    const tagText = '#' + m[2];
+    facets.push({
+      index: { byteStart: byteLen(text.slice(0, start)), byteEnd: byteLen(text.slice(0, start + tagText.length)) },
+      features: [{ $type: 'app.bsky.richtext.facet#tag', tag: m[2] }],
+    });
+  }
+  return facets;
+}
+
+// The post text Bluesky gets: the note's own text when it fits, otherwise a
+// grapheme-safe cut with a link to the pod note, which holds the whole thing.
+export function bskyText(text, noteUrl) {
+  const clean = String(text || '').trim();
+  if (graphemes(clean) <= MAX_GRAPHEMES) {
+    return { text: clean, facets: detectFacets(clean), truncated: false };
+  }
+  const tail = '… ' + noteUrl;
+  const budget = MAX_GRAPHEMES - graphemes(tail);
+  let cut = '';
+  let used = 0;
+  for (const s of seg.segment(clean)) {
+    if (used >= budget) break;
+    cut += s.segment;
+    used++;
+  }
+  const out = cut.trimEnd() + tail;
+  const facets = detectFacets(out);
+  return { text: out, facets, truncated: true };
+}
+
+const filePath = (dir) => path.join(dir, FILE);
+
+export class Atproto {
+  constructor({ localDir, actorId = null, log = console.log, fetcher = null }) {
+    this.localDir = localDir;
+    this.actorId = actorId;
+    this.log = log;
+    // Injectable for tests; the default is the politeness stack.
+    this.fetcher = fetcher || ((url, init) => safeFetch(url, init));
+    this.pausedUntil = 0;
+    this.lastError = null;
+  }
+
+  // The stamped-record guard: a credential minted for another actor is treated
+  // as absent, never silently adopted across identities.
+  read() {
+    let rec;
+    try { rec = JSON.parse(fs.readFileSync(filePath(this.localDir), 'utf8')); } catch { return null; }
+    if (rec?.mintedFor && this.actorId && rec.mintedFor !== this.actorId) {
+      this.log(`atproto.json belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
+      return null;
+    }
+    return rec;
+  }
+
+  write(rec) {
+    fs.mkdirSync(this.localDir, { recursive: true, mode: 0o700 });
+    writeJsonAtomic(filePath(this.localDir), rec);
+  }
+
+  connected() { return !!this.read()?.did; }
+
+  status() {
+    const rec = this.read();
+    return {
+      connected: !!rec?.did,
+      service: rec?.service || null,
+      handle: rec?.handle || null,
+      did: rec?.did || null,
+      lastError: this.lastError,
+      cooldownFor: Math.max(0, Math.round((this.pausedUntil - Date.now()) / 1000)),
+    };
+  }
+
+  async _fetch(url, init) {
+    const left = this.pausedUntil - Date.now();
+    if (left > 0) throw new Error(`bluesky asked us to back off — ${Math.ceil(left / 1000)}s left`);
+    const res = await this.fetcher(url, init);
+    if (res.status === 429 || res.status === 503) {
+      const ms = retryAfterMs(res) ?? 60_000;
+      this.pausedUntil = Date.now() + ms;
+      this.log(`bluesky answered ${res.status} — pausing for ${Math.round(ms / 1000)}s`);
+    }
+    return res;
+  }
+
+  async _json(res) {
+    const body = await res.json().catch(() => ({}));
+    if (res.status >= 400) {
+      const err = new Error(body.message || body.error || `bluesky answered ${res.status}`);
+      err.status = res.status;
+      err.code = body.error || null;
+      throw err;
+    }
+    return body;
+  }
+
+  // One session mint, straight from service + identifier + app password.
+  // The identifier reaches the server bare: a fediverse-habit leading @ makes
+  // Bluesky parse the handle as an email and refuse it confusingly.
+  async connect({ service, identifier, appPassword }) {
+    const base = String(service || 'https://bsky.social').replace(/\/+$/, '');
+    const id = String(identifier || '').trim().replace(/^@/, '');
+    const res = await this._fetch(`${base}/xrpc/com.atproto.server.createSession`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ identifier: id, password: appPassword }),
+    });
+    const s = await this._json(res);
+    this.write({
+      service: base, identifier: id, appPassword,
+      did: s.did, handle: s.handle,
+      accessJwt: s.accessJwt, refreshJwt: s.refreshJwt,
+      ...(this.actorId ? { mintedFor: this.actorId } : {}),
+    });
+    this.lastError = null;
+    this.log(`bluesky connected: @${s.handle} (${s.did})`);
+    return { did: s.did, handle: s.handle, service: base };
+  }
+
+  // Best-effort session teardown, then the local record is gone regardless.
+  async disconnect() {
+    const rec = this.read();
+    if (rec?.refreshJwt) {
+      await this._fetch(`${rec.service}/xrpc/com.atproto.server.deleteSession`, {
+        method: 'POST', headers: { authorization: `Bearer ${rec.refreshJwt}` },
+      }).catch(() => {});
+    }
+    try { fs.rmSync(filePath(this.localDir)); } catch {}
+    this.log('bluesky disconnected');
+  }
+
+  async _refresh(rec) {
+    const res = await this._fetch(`${rec.service}/xrpc/com.atproto.server.refreshSession`, {
+      method: 'POST', headers: { authorization: `Bearer ${rec.refreshJwt}` },
+    });
+    if (res.status >= 400) {
+      // The refresh token died; the stored app password re-mints the session.
+      await this._json(res).catch(() => {});
+      return this.connect({ service: rec.service, identifier: rec.identifier, appPassword: rec.appPassword })
+        .then(() => this.read());
+    }
+    const s = await this._json(res);
+    const next = { ...rec, accessJwt: s.accessJwt, refreshJwt: s.refreshJwt };
+    this.write(next);
+    return next;
+  }
+
+  // Mirror one public note. Returns { uri, cid } — the caller records it on
+  // the status so a later delete can find the mirror.
+  async crossPost({ text, published, attachments = [] }, { noteUrl }) {
+    const rec = this.read();
+    if (!rec?.did) throw new Error('no bluesky account connected');
+    const body = bskyText(text, noteUrl);
+    const images = [];
+    for (const a of attachments.filter(x => /^image\//.test(x.mediaType || '')).slice(0, MAX_IMAGES)) {
+      const res = await this._fetch(a.url, {});
+      if (res.status >= 400) throw new Error(`attachment fetch failed (${res.status}): ${a.url}`);
+      const bytes = Buffer.from(await res.arrayBuffer());
+      if (bytes.length > MAX_BLOB_BYTES) { this.log(`bluesky: image too large, skipped (${a.url})`); continue; }
+      const up = await this.xrpc('com.atproto.repo.uploadBlob', {
+        body: bytes, contentType: a.mediaType,
+      });
+      images.push({ image: up.blob, alt: a.description || '' });
+    }
+    const record = {
+      $type: POST_NSID,
+      text: body.text,
+      ...(body.facets.length ? { facets: body.facets } : {}),
+      ...(images.length ? { embed: { $type: 'app.bsky.embed.images', images } } : {}),
+      createdAt: published || new Date().toISOString(),
+    };
+    const out = await this.xrpc('com.atproto.repo.createRecord', {
+      body: { repo: rec.did, collection: POST_NSID, record },
+    });
+    return { uri: out.uri, cid: out.cid, ...(body.truncated ? { truncated: true } : {}) };
+  }
+
+  // at://did/collection/rkey → deleteRecord. Absence on the far side is fine.
+  async deleteCrossPost(uri) {
+    const m = String(uri).match(/^at:\/\/([^/]+)\/([^/]+)\/(.+)$/);
+    if (!m) throw new Error(`not an at:// uri: ${uri}`);
+    await this.xrpc('com.atproto.repo.deleteRecord', {
+      body: { repo: m[1], collection: m[2], rkey: m[3] },
+    });
+  }
+
+  // The post as Bluesky holds it — for a cid an old mirror never stored, and
+  // for the thread root a reply must carry.
+  async _post(uri) {
+    const out = await this.xrpc('app.bsky.feed.getPosts', { params: { uris: uri } });
+    const p = (out.posts || [])[0];
+    if (!p) throw new Error('that post is gone on Bluesky');
+    return p;
+  }
+
+  // A native like or repost of someone's post — the record every Bluesky app
+  // writes. Returns the minted record's uri, the only handle an undo has.
+  async like(uri, cid = null) { return this._subjectRecord('app.bsky.feed.like', uri, cid); }
+  async repost(uri, cid = null) { return this._subjectRecord('app.bsky.feed.repost', uri, cid); }
+
+  async _subjectRecord(collection, uri, cid) {
+    const rec = this.read();
+    if (!rec?.did) throw new Error('no bluesky account connected');
+    const subject = cid ? { uri, cid } : await this._post(uri).then(p => ({ uri: p.uri, cid: p.cid }));
+    const out = await this.xrpc('com.atproto.repo.createRecord', {
+      body: {
+        repo: rec.did, collection,
+        record: { $type: collection, subject, createdAt: new Date().toISOString() },
+      },
+    });
+    return { uri: out.uri };
+  }
+
+  // A native reply under someone's post, threaded at the root their post
+  // hangs from. A reply exists only on Bluesky — the fediverse cannot see the
+  // parent — so there is no AP object and nothing to cross-post.
+  async reply(text, parentUri) {
+    const rec = this.read();
+    if (!rec?.did) throw new Error('no bluesky account connected');
+    const clean = String(text || '').trim();
+    const n = graphemes(clean);
+    if (n > MAX_GRAPHEMES) throw new Error(`a Bluesky reply fits ${MAX_GRAPHEMES} characters — this one is ${n}`);
+    const p = await this._post(parentUri);
+    const parent = { uri: p.uri, cid: p.cid };
+    const facets = detectFacets(clean);
+    const out = await this.xrpc('com.atproto.repo.createRecord', {
+      body: {
+        repo: rec.did, collection: POST_NSID,
+        record: {
+          $type: POST_NSID, text: clean,
+          ...(facets.length ? { facets } : {}),
+          reply: { root: p.record?.reply?.root || parent, parent },
+          createdAt: new Date().toISOString(),
+        },
+      },
+    });
+    return { uri: out.uri, cid: out.cid };
+  }
+
+  // The one door every call goes through. GET when there is no body.
+  // Retries exactly once after an expired-token refresh.
+  async xrpc(nsid, { params = null, body = null, contentType = 'application/json', method = null } = {}) {
+    let rec = this.read();
+    if (!rec?.did) throw new Error('no bluesky account connected');
+    const qs = params
+      ? '?' + new URLSearchParams(Object.entries(params).filter(([, v]) => v != null)).toString()
+      : '';
+    const doCall = (r) => this._fetch(`${r.service}/xrpc/${nsid}${qs}`, {
+      method: method || (body != null ? 'POST' : 'GET'),
+      headers: {
+        authorization: `Bearer ${r.accessJwt}`,
+        ...(body != null ? { 'content-type': contentType } : {}),
+      },
+      ...(body != null ? { body: contentType === 'application/json' ? JSON.stringify(body) : body } : {}),
+    });
+    let res = await doCall(rec);
+    if (res.status === 400 || res.status === 401) {
+      const peek = await res.clone().json().catch(() => ({}));
+      if (peek.error === 'ExpiredToken' || peek.error === 'InvalidToken') {
+        rec = await this._refresh(rec);
+        res = await doCall(rec);
+      }
+    }
+    try {
+      const out = await this._json(res);
+      this.lastError = null;
+      return out;
+    } catch (e) {
+      this.lastError = e.message;
+      throw e;
+    }
+  }
+}

package/lib/bskyfeed.mjs

@@ -0,0 +1,166 @@
+// bskyfeed.mjs — mirrors the connected Bluesky account's home timeline and
+// notifications into the statuses index as kind 'bsky'. View cache only — none
+// of it is written to the pod; the pod holds fediverse content.
+//
+// Config in bskyfeed.json: { intervalMin }. The poll is authed XRPC against
+// the account's own PDS, so the politeness dial is the account's own rate
+// budget — backed off the same way tagfeed backs off a stranger's instance.
+
+const DEFAULTS = { intervalMin: 5 };
+const PER_SWEEP = 30;
+const MAX_BSKY_ENTRIES = 200;
+const BACKOFF_MIN_MS = 5 * 60_000;
+const BACKOFF_MAX_MS = 2 * 60 * 60_000;
+
+export const profileUrl = (did) => `https://bsky.app/profile/${did}`;
+export const postUrl = (uri) => {
+  const m = String(uri).match(/^at:\/\/([^/]+)\/[^/]+\/(.+)$/);
+  return m ? `https://bsky.app/profile/${m[1]}/post/${m[2]}` : null;
+};
+
+export class BskyFeed {
+  constructor({ store, atproto, log = console.log, onNotification = null }) {
+    Object.assign(this, { store, atproto, log, onNotification });
+    this.lastSweep = null;
+    this.lastAdded = 0;
+  }
+
+  config() { return { ...DEFAULTS, ...this.store.read('bskyfeed.json', {}) }; }
+
+  setConfig(patch) {
+    const clean = {};
+    if (patch.intervalMin) clean.intervalMin = Math.max(1, Number(patch.intervalMin) || DEFAULTS.intervalMin);
+    this.store.write('bskyfeed.json', { ...this.config(), ...clean });
+    this.stop();
+    this.start();
+    return this.config();
+  }
+
+  start() {
+    this.stopped = false;
+    this.sweep().catch(e => this.log(`bskyfeed: ${e.message}`));
+    const tick = () => {
+      this.timer = setTimeout(() => {
+        this.sweep()
+          .catch(e => this.log(`bskyfeed: ${e.message}`))
+          .finally(() => { if (!this.stopped) tick(); });
+      }, Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3)));
+      this.timer.unref?.();
+    };
+    tick();
+  }
+
+  stop() { this.stopped = true; clearTimeout(this.timer); }
+
+  _backOff(status, retryAfter) {
+    this.failures = (this.failures || 0) + 1;
+    const ladder = Math.min(BACKOFF_MIN_MS * 2 ** (this.failures - 1), BACKOFF_MAX_MS);
+    const wait = retryAfter || Math.round(ladder * (0.85 + Math.random() * 0.3));
+    this.quietUntil = Date.now() + wait;
+    this.log(`bskyfeed: ${status ? `bluesky answered ${status}` : 'bluesky did not answer'} — not asking again for ${Math.round(wait / 60_000)} min`);
+  }
+
+  // One author into the shared actor cache, under a page anyone can open.
+  _rememberAuthor(a) {
+    const url = profileUrl(a.did);
+    if (!this.store.getActors()[url]) {
+      this.store.cacheActor(url, {
+        name: a.displayName || a.handle, preferredUsername: a.handle,
+        icon: a.avatar || null, type: 'Person',
+      });
+    }
+    return url;
+  }
+
+  // One Bluesky post into the statuses index. Returns its noteId, new or not.
+  _mirrorPost(post, { via = null } = {}) {
+    const noteId = post.uri;
+    const existing = this.store.getStatuses().some(s => s.noteId === noteId);
+    if (existing) return { noteId, added: false };
+    const actor = this._rememberAuthor(post.author);
+    if (this.store.isBlocked(actor)) return { noteId, added: false };
+    const text = post.record?.text || '';
+    const images = post.embed?.images || [];
+    this.store.addStatus({
+      noteId, actor,
+      content: `<p>${text.replace(/[&<>]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;' }[c]))}</p>`,
+      published: post.record?.createdAt || post.indexedAt,
+      kind: 'bsky',
+      ...(post.cid ? { cid: post.cid } : {}),
+      link: postUrl(noteId),
+      ...(via ? { via } : {}),
+      ...(images.length ? {
+        attachments: images.map(i => ({ url: i.fullsize, mediaType: 'image/jpeg', description: i.alt || '' })),
+      } : {}),
+    });
+    return { noteId, added: true };
+  }
+
+  async sweep() {
+    if (!this.atproto?.connected()) return;
+    if (this.quietUntil && Date.now() < this.quietUntil) return;
+    this.lastSweep = new Date().toISOString();
+    const self = this.atproto.read()?.did;
+    let added = 0;
+    try {
+      // Our own CROSS-POSTS must not echo back into the feed — but a post or
+      // reply written natively on Bluesky is ours to see here too. The mirrors
+      // are known by uri, so only they are skipped.
+      const ownMirrors = new Set(this.store.getStatuses().map(s => s.atproto?.uri).filter(Boolean));
+      const tl = await this.atproto.xrpc('app.bsky.feed.getTimeline', { params: { limit: PER_SWEEP } });
+      for (const item of tl.feed || []) {
+        if (!item?.post?.uri) continue;
+        if (item.post.author?.did === self && ownMirrors.has(item.post.uri)) continue;
+        const via = item.reason?.$type === 'app.bsky.feed.defs#reasonRepost' && item.reason.by
+          ? this._rememberAuthor(item.reason.by) : null;
+        if (this._mirrorPost(item.post, { via }).added) added++;
+      }
+
+      // Only notifications newer than the last sweep's high-water mark are
+      // acted on — the list is a window, not a queue, and re-reading it must
+      // not re-fire the group hooks.
+      const seen = this.store.read('bskyfeed.json', {}).lastNotifiedAt || '';
+      let high = seen;
+      const nots = await this.atproto.xrpc('app.bsky.notification.listNotifications', { params: { limit: PER_SWEEP } });
+      for (const n of nots.notifications || []) {
+        if (!n?.author?.did || n.author.did === self) continue;
+        if (n.indexedAt) {
+          if (seen && n.indexedAt <= seen) continue;
+          if (n.indexedAt > high) high = n.indexedAt;
+        }
+        const actor = this._rememberAuthor(n.author);
+        // A like or repost points at OUR mirror; the notification should point
+        // at the pod post it mirrors, which is the one the client can open.
+        if (n.reason === 'like' || n.reason === 'repost') {
+          const mine = this.store.getStatuses().find(s => s.atproto?.uri === n.reasonSubject);
+          if (!mine) continue;
+          this.store.addNotification({
+            type: n.reason === 'like' ? 'favourite' : 'reblog',
+            actor, noteId: mine.noteId, bsky: true,
+          });
+        } else if (n.reason === 'follow') {
+          this.store.addNotification({ type: 'follow', actor, bsky: true });
+          await this.onNotification?.(n, { actor });
+        } else if (n.reason === 'mention' || n.reason === 'reply') {
+          const record = { uri: n.uri, cid: n.cid, author: n.author, record: n.record, indexedAt: n.indexedAt };
+          this._mirrorPost(record);
+          this.store.addNotification({ type: 'mention', actor, noteId: n.uri, bsky: true });
+          await this.onNotification?.(n, { actor });
+        }
+      }
+      if (high && high !== seen) this.store.write('bskyfeed.json', { ...this.config(), lastNotifiedAt: high });
+      this.failures = 0;
+    } catch (e) {
+      this._backOff(e.status || 0, null);
+      return;
+    }
+    const all = this.store.getStatuses();
+    const mirrored = all.filter(s => s.kind === 'bsky');
+    if (mirrored.length > MAX_BSKY_ENTRIES) {
+      const drop = new Set(mirrored.slice(MAX_BSKY_ENTRIES).map(s => s.noteId));
+      this.store.write('statuses.json', all.filter(s => !drop.has(s.noteId)));
+    }
+    this.lastAdded = added;
+    if (added) this.log(`bskyfeed: +${added} from the bluesky timeline`);
+  }
+}

package/lib/bskygroup.mjs

@@ -0,0 +1,162 @@
+// bskygroup.mjs — Bluesky members of a group, bridged-first. A bridged Bluesky
+// account (one that follows @ap.brid.gy) is a plain AP actor and takes the
+// existing FEP-1b12 paths untouched. This module covers the rest: knowing who
+// is bridged, nudging who isn't, and the degraded Bluesky-only membership —
+// follow-as-join, mention-as-submission, repost as the group's carry.
+
+import { profileUrl } from './bskyfeed.mjs';
+import { bskyText } from './atproto.mjs';
+
+const BRIDGE_ACTOR = (did) => `https://bsky.brid.gy/ap/${did}`;
+const AP_ACCEPT = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
+
+export class BskyGroup {
+  constructor({ store, atproto, intake, publisher, log = console.log, fetcher = null }) {
+    Object.assign(this, { store, atproto, intake, publisher, log });
+    this.fetcher = fetcher;   // tests inject; default rides safefetch lazily
+  }
+
+  // A DID is bridged when Bridgy Fed serves an AP actor for it. Cached on
+  // whatever record the caller keeps, so one join costs one probe.
+  async isBridged(did) {
+    try {
+      const { safeFetch } = await import('./safefetch.mjs');
+      const doFetch = this.fetcher || ((u, i) => safeFetch(u, i));
+      const res = await doFetch(BRIDGE_ACTOR(did), { headers: { accept: AP_ACCEPT } });
+      return res.status < 400;
+    } catch { return false; }
+  }
+
+  // ONE reply ever: tell an unbridged joiner how to reach the fediverse side.
+  async nudge({ did, handle }) {
+    const text = `@${handle} welcome! Follow @ap.brid.gy and your posts will reach `
+      + 'the fediverse side of this group too.';
+    const start = 0;
+    const rec = this.atproto.read();
+    await this.atproto.xrpc('com.atproto.repo.createRecord', {
+      body: {
+        repo: rec.did, collection: 'app.bsky.feed.post',
+        record: {
+          $type: 'app.bsky.feed.post', text,
+          facets: [{
+            index: { byteStart: start, byteEnd: start + 1 + handle.length },
+            features: [{ $type: 'app.bsky.richtext.facet#mention', did }],
+          }],
+          createdAt: new Date().toISOString(),
+        },
+      },
+    });
+  }
+
+  // A native follow of the group's Bluesky account. Bridged accounts are left
+  // to join through the bridge; unbridged ones become Bluesky-only members,
+  // through the same approval queue as everyone else.
+  async onFollow(author) {
+    const actor = profileUrl(author.did);
+    const contacts = this.store.getContacts();
+    if (contacts.followers.some(f => f.actor === actor)) return;
+    if (this.store.getRequests().some(r => r.actor === actor)) return;
+    if (this.store.isBlocked(actor)) return;
+    if (await this.isBridged(author.did)) {
+      this.log(`bluesky follow from bridged @${author.handle} — their join arrives over AP`);
+      return;
+    }
+    const member = { actor, bsky: { did: author.did, handle: author.handle } };
+    if (this.store.getConfig()?.approveJoins) {
+      const reqs = this.store.getRequests();
+      reqs.unshift({ ...member, at: new Date().toISOString() });
+      this.store.setRequests(reqs);
+      this.log(`bluesky join request held: @${author.handle}`);
+      return;
+    }
+    contacts.followers.push(member);
+    this.store.setContacts(contacts);
+    this.store.addNotification({ type: 'follow', actor, bsky: true });
+    await this.nudgeOnce(member);
+    this.log(`bluesky member joined: @${author.handle}`);
+  }
+
+  async nudgeOnce(member) {
+    if (member.nudgedAt) return;
+    try {
+      await this.nudge(member.bsky);
+      member.nudgedAt = new Date().toISOString();
+      const contacts = this.store.getContacts();
+      const rec = contacts.followers.find(f => f.actor === member.actor);
+      if (rec) { rec.nudgedAt = member.nudgedAt; this.store.setContacts(contacts); }
+    } catch (e) { this.log(`bluesky nudge failed for @${member.bsky?.handle}: ${e.message}`); }
+  }
+
+  // A mention of the group's handle is a submission — same rules as an AP
+  // member addressing the group. amplify() applies the member, mute, and
+  // review checks; its bsky branch calls carry() below.
+  async onMention(n) {
+    const actor = profileUrl(n.author.did);
+    const isMember = this.store.getContacts().followers.some(f => f.actor === actor);
+    if (!isMember) { this.log(`bluesky mention from non-member @${n.author.handle} — ignored`); return; }
+    await this.intake.amplify(n.uri, {});
+  }
+
+  // The group's carry of a member's Bluesky post: a native repost. AP
+  // followers get it only when the author is bridged — the group never
+  // fabricates an AP object for someone else's words.
+  async carry(s) {
+    const rec = this.atproto.read();
+    const out = await this.atproto.xrpc('com.atproto.repo.createRecord', {
+      body: {
+        repo: rec.did, collection: 'app.bsky.feed.repost',
+        record: {
+          $type: 'app.bsky.feed.repost',
+          subject: { uri: s.noteId, cid: s.cid },
+          createdAt: new Date().toISOString(),
+        },
+      },
+    });
+    this.store.updateStatus(s.noteId, { announcedAt: new Date().toISOString(), repostUri: out.uri });
+    this.store.setPending(this.store.getPending().filter(p => p.noteId !== s.noteId));
+    this.log(`bluesky repost: ${s.noteId}`);
+    return { ok: true, noteId: s.noteId, repost: out.uri };
+  }
+
+  // Unsay a repost.
+  async retract(s) {
+    if (!s.repostUri) throw new Error('that post was never carried');
+    await this.atproto.deleteCrossPost(s.repostUri);
+    this.store.updateStatus(s.noteId, {
+      announcedAt: undefined, repostUri: undefined, retractedAt: new Date().toISOString(),
+    });
+    return { ok: true, noteId: s.noteId, inboxes: 0 };
+  }
+
+  // An AP member's post the group just Announced, shown natively to the
+  // group's Bluesky followers: the group account posts the conversion with
+  // attribution and the link back.
+  async mirrorCarry(s) {
+    if (!this.store.getConfig()?.atproto?.crossPost) return;
+    const handle = this.store.handleOf?.(s.actor) || s.actor;
+    const plain = String(s.content || '').replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim();
+    const body = bskyText(`via ${handle}: ${plain}`, s.noteId);
+    const rec = this.atproto.read();
+    await this.atproto.xrpc('com.atproto.repo.createRecord', {
+      body: {
+        repo: rec.did, collection: 'app.bsky.feed.post',
+        record: {
+          $type: 'app.bsky.feed.post', text: body.text,
+          ...(body.facets.length ? { facets: body.facets } : {}),
+          createdAt: new Date().toISOString(),
+        },
+      },
+    });
+  }
+
+  // Ejection's Bluesky half: the DID is blocked so the departure sticks.
+  async blockDid(did) {
+    const rec = this.atproto.read();
+    await this.atproto.xrpc('com.atproto.repo.createRecord', {
+      body: {
+        repo: rec.did, collection: 'app.bsky.graph.block',
+        record: { $type: 'app.bsky.graph.block', subject: did, createdAt: new Date().toISOString() },
+      },
+    });
+  }
+}