Merge origin/main into feat/identity-token-health

One conflict, in APIClient.swift, resolved by taking this branch's version
rather than keeping both: #90 (now on main) added a doc comment to the old
two-argument `verifyIdentity(provider:providerId:)`, and this branch replaces
that function outright with `verifyIdentity(provider:)` returning an
`IdentityVerification` outcome. Main's copy is the version this supersedes, so
keeping both would have left a stale duplicate and a signature that no longer
compiles against the call site.

Verified after resolving: only the single-argument form remains, and no
`providerId` parameter survives anywhere in the file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017bss5MgZa7Jvj2m9zdaUd1

Author: Adron

.claude/commands/ios-review.md

@@ -43,13 +43,35 @@ Perform a focused code review of the Swift/SwiftUI changes on the current branch
    ### Code quality
    - [ ] No unnecessary comments (only "why", never "what")
    - [ ] No dead code, unused variables, or leftover `TODO` without a tracking issue
+   - [ ] **Every new `APIClient` function has a call site outside `Services/APIClient*`.** An endpoint
+         consumed only by a function no screen calls looks like coverage in an endpoint diff while
+         being a missing feature — that is how "documents shared with me", "mute", "add org member"
+         and "trash a DM" stayed invisible for a year. If it is deliberately unwired, say why in a
+         comment on the function.
+   - [ ] **Request-body keys match what the route destructures.** `PATCH /api/user/update` and friends
+         ignore unknown keys and still answer `200`, so a mismatch is silent data loss, not an error.
+         Read the route, don't infer the name.
 
-4. **Summarize findings** as:
+4. **Run the zero-call-site sweep** (cheap, catches the above mechanically):
+   ```bash
+   for f in InterlinedList/Services/APIClient*.swift; do
+     grep -oE '^\s+(@discardableResult\s+)?func [a-zA-Z0-9_]+' "$f" | sed -E 's/.*func //'
+   done | sort -u | while read -r fn; do
+     n=$(grep -rn "\.${fn}(" InterlinedList/ | grep -vc "InterlinedList/Services/APIClient")
+     [ "$n" -eq 0 ] && echo "zero app call sites: $fn"
+   done
+   ```
+   Transport helpers (`get`, `post*`, `put*`, `patch*`, `delete*`, `checkResponse`,
+   `postMultipartRawData`, `pathSegment`, `serverErrorMessage`) are called via `Self.` inside the
+   client and will always show up here — ignore them. Anything else needs wiring, deleting, or a
+   comment explaining why it is kept.
+
+5. **Summarize findings** as:
    - Blockers (must fix before merge)
    - Suggestions (non-blocking improvements)
    - Positives (good patterns worth noting)
 
-5. **Run a build** to confirm there are no compilation errors. Prefer XcodeBuildMCP `build_sim` (after `session_show_defaults`); raw fallback pins a concrete UDID (`name=iPhone 16` alone is ambiguous across runtimes):
+6. **Run a build** to confirm there are no compilation errors. Prefer XcodeBuildMCP `build_sim` (after `session_show_defaults`); raw fallback pins a concrete UDID (`name=iPhone 16` alone is ambiguous across runtimes):
    ```bash
    xcodebuild -scheme InterlinedList \
      -destination 'platform=iOS Simulator,id=<SIM_UDID>' \

InterlinedList.xcodeproj/project.pbxproj

@@ -13,6 +13,7 @@ struct InterlinedListApp: App {
     @StateObject private var authState = AuthState()
     @StateObject private var store = AppDataStore()
     @StateObject private var router = AppRouter()
+    @StateObject private var settingsSync = AppSettingsSyncService()
     @Environment(\.scenePhase) private var scenePhase
 
     init() {
@@ -25,12 +26,17 @@ struct InterlinedListApp: App {
                 .environmentObject(authState)
                 .environmentObject(store)
                 .environmentObject(router)
+                .environmentObject(settingsSync)
                 .onChange(of: authState.hasToken) { _, has in
                     if has {
                         PushService.shared.requestPermissionAndRegister()
+                        Task { await syncAppSettings() }
                     } else {
                         PushService.shared.unregister()
                         store.reset()
+                        // The device id is deliberately NOT cleared — it belongs to
+                        // the install, not the session, and re-registering on every
+                        // sign-in would litter the account's device list.
                     }
                 }
                 .onOpenURL { url in
@@ -132,6 +138,18 @@ struct InterlinedListApp: App {
         }
     }
 
+    /// Registers this install with the settings-sync service so it appears in the
+    /// web's Settings → Applications, then mirrors the account-level preferences
+    /// into the shared document so a fresh install elsewhere can bootstrap from it.
+    @MainActor
+    private func syncAppSettings() async {
+        guard await settingsSync.registerDeviceIfNeeded() != nil else { return }
+        _ = await settingsSync.loadSharedSettings()
+        if let user = authState.user {
+            await settingsSync.save(AppSettingsSyncService.sharedSettings(from: user))
+        }
+    }
+
     @MainActor
     private func verifyEmail(token: String) async {
         do {

InterlinedList/InterlinedListApp.swift

@@ -0,0 +1,84 @@
+//
+//  AppSettingsSync.swift
+//  InterlinedList
+//
+
+import Foundation
+
+/// The app's key in the settings-sync service. Contract:
+/// https://interlinedlist.com/help/api/app-settings
+enum AppSettingsKey {
+    static let appKey = "il-ios"
+    static let platform = "ios"
+    /// Bump when the meaning of a stored field changes so an older client can tell.
+    static let schemaVersion = 1
+    /// Server cap (`MAX_SETTINGS_BYTES`). Enforced client-side too — a write above
+    /// it is a 413, which is a bug in what we chose to store, not a transient error.
+    static let maxSettingsBytes = 64 * 1024
+}
+
+/// The account-level (shared) settings iOS syncs. Deliberately small: preferences a
+/// second device should inherit, never cached content.
+///
+/// Anything phone-specific (per-device UI state, local-only toggles) belongs in the
+/// per-device document instead, which is why this type carries none of it.
+struct AppSharedSettings: Codable, Equatable {
+    var theme: String?
+    var defaultPubliclyVisible: Bool?
+    var showAdvancedPostSettings: Bool?
+    var viewingPreference: String?
+    var messagesPerPage: Int?
+    var showPreviews: Bool?
+    var notificationTrayLimit: Int?
+
+    static let empty = AppSharedSettings()
+}
+
+/// One settings document as the service stores it. `settings` is an opaque blob the
+/// server round-trips byte-for-byte, so it is modelled generically.
+struct SettingsDoc<Settings: Codable>: Codable {
+    let appKey: String
+    let scope: String?
+    let deviceId: String?
+    let version: Int
+    let updatedAt: String?
+    let schemaVersion: Int?
+    let settings: Settings
+}
+
+/// `GET …/bootstrap` — where a fresh install should start from.
+struct SettingsBootstrap<Settings: Codable>: Codable {
+    let source: String
+    let version: Int?
+    let schemaVersion: Int?
+    let settings: Settings?
+    let defaultDeviceId: String?
+    let defaultDeviceName: String?
+}
+
+struct AppDevice: Codable, Identifiable {
+    let deviceId: String
+    let deviceName: String?
+    let platform: String?
+    let isDefault: Bool?
+    let lastSeenAt: String?
+    let appVersion: String?
+    let osVersion: String?
+
+    var id: String { deviceId }
+}
+
+struct AppDevicesResponse: Codable {
+    let devices: [AppDevice]
+}
+
+struct AppDeviceResponse: Codable {
+    let device: AppDevice
+}
+
+/// Raised when the server rejects a write because someone else wrote first. The
+/// caller must re-read and re-apply — last-write-wins is wrong here, and the server
+/// hands back the winning document so no extra round trip is needed.
+struct SettingsVersionConflict<Settings: Codable>: Error {
+    let current: SettingsDoc<Settings>?
+}

InterlinedList/Models/AppSettingsSync.swift

@@ -0,0 +1,48 @@
+//
+//  DMConversation.swift
+//  InterlinedList
+//
+
+import Foundation
+
+/// One row of the conversation-grouped inbox (`GET /api/dm/conversations`) — one
+/// entry per correspondent rather than per message, with that conversation's own
+/// unread count.
+///
+/// Identified by `pairKey`, which is the server's stable per-conversation key, so
+/// a row keeps its identity as new messages arrive.
+struct DMConversation: Codable, Identifiable, Hashable {
+    let pairKey: String
+    let otherUser: DMUser
+    let lastMessageId: String
+    let lastBody: String?
+    /// Server-rendered preview: markdown stripped, or `[image]` for an image-only
+    /// message. Prefer this over `lastBody` so the row matches the web.
+    let preview: String?
+    let lastImageUrls: [String]?
+    let lastCreatedAt: String
+    /// True when the last message in the conversation was sent by this account.
+    let isMine: Bool
+    let unreadCount: Int
+
+    var id: String { pairKey }
+
+    /// Matches the web's cap (`ConversationList.tsx`).
+    var unreadBadge: String? {
+        guard unreadCount > 0 else { return nil }
+        return unreadCount > 99 ? "99+" : String(unreadCount)
+    }
+
+    var previewText: String {
+        if let preview, !preview.isEmpty { return preview }
+        if let lastBody, !lastBody.isEmpty { return lastBody }
+        return (lastImageUrls?.isEmpty == false) ? "[image]" : ""
+    }
+}
+
+/// Keyset page. `nextCursor` is an opaque base64 token — never parse or build it
+/// client-side; pass back exactly what the server sent.
+struct DMConversationPage: Codable {
+    let items: [DMConversation]
+    let nextCursor: String?
+}

InterlinedList/Models/DMConversation.swift

@@ -0,0 +1,26 @@
+//
+//  DocumentPresence.swift
+//  InterlinedList
+//
+
+import Foundation
+
+/// Another editor currently active in a document. `anchor`/`head` are caret
+/// offsets; iOS does not mirror remote carets (out of scope for v1) but decodes
+/// them so the shape matches the route and a later version needs no migration.
+struct DocumentPresenceUser: Codable, Identifiable, Hashable {
+    let userId: String
+    let name: String
+    let color: String?
+    let anchor: Int?
+    let head: Int?
+
+    var id: String { userId }
+}
+
+/// Response to the combined heartbeat + poll. `users` excludes the caller.
+struct DocumentPresenceResponse: Codable {
+    let users: [DocumentPresenceUser]
+    /// The document's current server-side version — a cheap staleness signal.
+    let version: Int?
+}

InterlinedList/Models/DocumentPresence.swift

@@ -238,3 +238,23 @@ struct CreateMessageResponse: Codable {
     let data: Message?
     let crossPostResults: [CrossPostResult]?
 }
+
+/// One platform's cross-post reply count, from `POST /api/messages/{id}/reply-counts`.
+/// The server caches for 10 minutes and backs unsupported platforms off for 24 hours,
+/// so the client never retries on its own.
+struct ReplyCountEntry: Codable, Identifiable {
+    let platform: String
+    let count: Int?
+    /// `success`, `unsupported` or `error`. Only `success` entries are worth drawing.
+    let status: String
+    let checkedAt: String?
+
+    var id: String { platform }
+
+    var isDisplayable: Bool { status == "success" && count != nil }
+}
+
+struct ReplyCountsResponse: Codable {
+    let replyCounts: [ReplyCountEntry]
+    let repliesCheckedAt: String?
+}

InterlinedList/Models/Message.swift

@@ -29,6 +29,19 @@ struct User: Codable, Identifiable {
     /// The user's default GitHub repo ("owner/repo") for GitHub-backed lists,
     /// or nil if none is set. Serialized camelCase by the API.
     let githubDefaultRepo: String?
+    /// Private account: new followers need approval and posts stay visible only
+    /// to approved followers. Drives the follow-request flow server-side.
+    let isPrivateAccount: Bool?
+    /// Server-side feed scope. One of `all_messages`, `following_only`,
+    /// `followers_only`, `my_messages` — the messages and search routes build
+    /// their visibility clause from this, so it changes what the feed returns.
+    let viewingPreference: String?
+    /// Feed page size (server accepts 10–30).
+    let messagesPerPage: Int?
+    /// Render link previews in the feed.
+    let showPreviews: Bool?
+    /// How many notifications `?scope=tray` returns (server accepts 10–40).
+    let notificationTrayLimit: Int?
 
     var displayNameOrUsername: String {
         displayName?.isEmpty == false ? (displayName ?? username) : username
@@ -44,7 +57,9 @@ struct User: Codable, Identifiable {
          avatar: String?, bio: String?, theme: String?, emailVerified: Bool?,
          createdAt: String?, maxMessageLength: Int?, showAdvancedPostSettings: Bool?,
          defaultPubliclyVisible: Bool?, customerStatus: String?,
-         githubDefaultRepo: String? = nil) {
+         githubDefaultRepo: String? = nil, isPrivateAccount: Bool? = nil,
+         viewingPreference: String? = nil, messagesPerPage: Int? = nil,
+         showPreviews: Bool? = nil, notificationTrayLimit: Int? = nil) {
         self.id = id
         self.email = email
         self.username = username
@@ -59,6 +74,11 @@ struct User: Codable, Identifiable {
         self.defaultPubliclyVisible = defaultPubliclyVisible
         self.customerStatus = customerStatus
         self.githubDefaultRepo = githubDefaultRepo
+        self.isPrivateAccount = isPrivateAccount
+        self.viewingPreference = viewingPreference
+        self.messagesPerPage = messagesPerPage
+        self.showPreviews = showPreviews
+        self.notificationTrayLimit = notificationTrayLimit
     }
 }
 

InterlinedList/Models/User.swift

@@ -0,0 +1,52 @@
+//
+//  ViewPreferences.swift
+//  InterlinedList
+//
+
+import Foundation
+
+/// Server-side feed scope. `PATCH /api/user/update` rejects anything outside these
+/// four literals with a 400, and the messages/search routes build their visibility
+/// clause from the stored value — so this changes what the feed *returns*, not just
+/// how it is drawn.
+enum FeedScope: String, CaseIterable, Identifiable {
+    case allMessages = "all_messages"
+    case followingOnly = "following_only"
+    case followersOnly = "followers_only"
+    case myMessages = "my_messages"
+
+    var id: String { rawValue }
+
+    var label: String {
+        switch self {
+        case .allMessages: return "Everyone"
+        case .followingOnly: return "People I follow"
+        case .followersOnly: return "My followers"
+        case .myMessages: return "Only me"
+        }
+    }
+
+    /// Unknown or missing values fall back to the server's own default rather than
+    /// failing, so a value added server-side never breaks the picker.
+    static func from(_ raw: String?) -> FeedScope {
+        guard let raw, let scope = FeedScope(rawValue: raw) else { return .allMessages }
+        return scope
+    }
+}
+
+/// The ranges `app/api/user/update/route.ts` validates. Mirrored here so the
+/// steppers cannot produce a value the route would 400 on.
+enum ViewPreferenceBounds {
+    static let messagesPerPage = 10...30
+    static let notificationTrayLimit = 10...40
+
+    /// Feed page size when the account has never set one. The feed shipped with a
+    /// hardcoded 50, which is above the settable maximum — preserved as the
+    /// unset-default so existing installs do not silently start paging smaller.
+    static let defaultMessagesPerPage = 50
+    static let defaultNotificationTrayLimit = 20
+
+    static func clamp(_ value: Int, to range: ClosedRange<Int>) -> Int {
+        min(max(value, range.lowerBound), range.upperBound)
+    }
+}