hotfix search

Cargo.lock

@@ -617,9 +617,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cc"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c89588d05638b5b4594a3348a2d6c20277e43a7f5c5202b05cc56888475a47b8"
+checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -1575,9 +1575,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
 dependencies = [
  "serde",
 ]
@@ -1718,7 +1718,7 @@ dependencies = [
 [[package]]
 name = "federation-net"
 version = "0.1.0"
-source = "git+https://gt.hexor.cy/ab/frid.git#512a818a6a52ec713678e9a4e1cf0f50bb1e34ab"
+source = "git+https://gt.hexor.cy/ab/frid.git#a9012351dcdbdf8dbaa1f5dd71e498b4bc678d99"
 dependencies = [
  "blake3",
  "data-encoding",
@@ -1845,12 +1845,14 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "furumusic"
-version = "0.6.7-fd"
+version = "0.9.0"
 dependencies = [
  "anyhow",
+ "async-stream",
  "async-trait",
  "base64 0.22.1",
  "blake3",
+ "bytes",
  "chrono",
  "cot",
  "croner",
@@ -3622,7 +3624,7 @@ dependencies = [
 [[package]]
 name = "music-dht"
 version = "0.1.0"
-source = "git+https://gt.hexor.cy/ab/frid.git#512a818a6a52ec713678e9a4e1cf0f50bb1e34ab"
+source = "git+https://gt.hexor.cy/ab/frid.git#a9012351dcdbdf8dbaa1f5dd71e498b4bc678d99"
 dependencies = [
  "async-trait",
  "blake3",
@@ -3633,6 +3635,7 @@ dependencies = [
  "rand 0.9.5",
  "rusqlite",
  "serde",
+ "serde_json",
  "thiserror 2.0.19",
  "tokio",
  "tracing",
@@ -3765,12 +3768,13 @@ dependencies = [
 
 [[package]]
 name = "netlink-proto"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b65d130ee111430e47eed7896ea43ca693c387f097dd97376bffafbf25812128"
+checksum = "e6f7398dddf5f152d2a91a2921a134c6097056e292c0d4b9906007855e7cece6"
 dependencies = [
  "bytes",
- "futures",
+ "futures-channel",
+ "futures-util",
  "log",
  "netlink-packet-core",
  "netlink-sys",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "furumusic"
-version = "0.7.0"
+version = "0.9.1"
 edition = "2024"
 description = "Reusable web-app boilerplate: auth, OIDC/SSO, admin panel, user management, i18n, PostgreSQL"
 
@@ -14,6 +14,8 @@ serde = { version = "1", features = ["derive"] }
 openidconnect = "4.0"
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }
 tokio = { version = "1", features = ["sync", "fs", "io-util"] }
+async-stream = "0.3"
+bytes = "1"
 tower = "0.5"
 base64 = "0.22"
 blake3 = "1"

src/admin/v2.rs

@@ -452,6 +452,8 @@ struct AdminSettingsValues {
     federation_enabled: bool,
     #[serde(default)]
     federation_network_id: String,
+    #[serde(default)]
+    federation_save_on_listen: bool,
 }
 
 #[derive(Debug, Clone, Serialize, JsonSchema)]
@@ -478,6 +480,7 @@ struct AdminSettingsSources {
     agent_concurrency: &'static str,
     federation_enabled: &'static str,
     federation_network_id: &'static str,
+    federation_save_on_listen: &'static str,
 }
 
 #[derive(Debug, Deserialize)]
@@ -506,6 +509,8 @@ pub(super) struct UpdateSettingsRequest {
     federation_enabled: bool,
     #[serde(default)]
     federation_network_id: String,
+    #[serde(default)]
+    federation_save_on_listen: bool,
 }
 
 #[derive(Debug, Serialize, JsonSchema)]
@@ -993,6 +998,10 @@ pub async fn update_settings(
             "federation_network_id",
             body.federation_network_id.trim().to_string(),
         ),
+        (
+            "federation_save_on_listen",
+            body.federation_save_on_listen.to_string(),
+        ),
     ];
     for (key, value) in fields {
         let mut entry = ConfigEntry::new(key.to_string(), value);
@@ -1143,6 +1152,7 @@ fn settings_dto(config: AppConfig, sources: ConfigSources) -> AdminSettingsDto {
             agent_concurrency: config.agent_concurrency.to_string(),
             federation_enabled: config.federation_enabled,
             federation_network_id: config.federation_network_id,
+            federation_save_on_listen: config.federation_save_on_listen,
         },
         sources: AdminSettingsSources {
             auth_password_enabled: sources.auth_password_enabled.code(),
@@ -1167,6 +1177,7 @@ fn settings_dto(config: AppConfig, sources: ConfigSources) -> AdminSettingsDto {
             agent_concurrency: sources.agent_concurrency.code(),
             federation_enabled: sources.federation_enabled.code(),
             federation_network_id: sources.federation_network_id.code(),
+            federation_save_on_listen: sources.federation_save_on_listen.code(),
         },
     }
 }

src/config.rs

@@ -137,6 +137,7 @@ pub struct ConfigSources {
     pub lastfm_shared_secret: ConfigSource,
     pub federation_enabled: ConfigSource,
     pub federation_network_id: ConfigSource,
+    pub federation_save_on_listen: ConfigSource,
 }
 
 impl Default for ConfigSources {
@@ -166,6 +167,7 @@ impl Default for ConfigSources {
             lastfm_shared_secret: ConfigSource::Default,
             federation_enabled: ConfigSource::Default,
             federation_network_id: ConfigSource::Default,
+            federation_save_on_listen: ConfigSource::Default,
         }
     }
 }
@@ -280,6 +282,9 @@ pub struct AppConfig {
     /// Federation network id — the shared secret every peer of the network
     /// uses to find the others.
     pub federation_network_id: String,
+    /// Whether a federated track requested for playback is imported into the
+    /// shared local library. This is a server-wide administrator policy.
+    pub federation_save_on_listen: bool,
 }
 
 impl Default for AppConfig {
@@ -309,6 +314,7 @@ impl Default for AppConfig {
             lastfm_shared_secret: String::new(),
             federation_enabled: false,
             federation_network_id: String::new(),
+            federation_save_on_listen: false,
         }
     }
 }
@@ -339,6 +345,7 @@ impl_env_overrides!(
     lastfm_shared_secret,
     federation_enabled,
     federation_network_id,
+    federation_save_on_listen,
 );
 
 impl AppConfig {
@@ -468,6 +475,7 @@ impl AppConfig {
         apply_db_field!(lastfm_shared_secret);
         apply_db_field!(federation_enabled);
         apply_db_field!(federation_network_id);
+        apply_db_field!(federation_save_on_listen);
     }
 }
 

src/federation/client.rs

@@ -0,0 +1,536 @@
+//! Receiving side of music federation.
+//!
+//! User-facing identity is content-addressed. An `(owner, item_id)` pair is
+//! only a source locator and several locators may resolve the same track.
+
+use std::collections::HashMap;
+
+use anyhow::{Context, Result};
+use music_dht::{ItemKind, LibraryItem, normalize_content_id};
+use serde::Serialize;
+use serde_json::{Value, json};
+use sqlx::Row as _;
+use tokio::io::AsyncReadExt;
+
+use super::{Federation, now_iso};
+
+const MAX_CATALOG_BYTES: u64 = 4 * 1024 * 1024;
+
+#[derive(Debug, Clone, Serialize)]
+pub struct TrackKeyDto {
+    pub content_id: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ArtistKeyDto {
+    pub normalized_name: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ArtistRefDto {
+    pub key: ArtistKeyDto,
+    pub name: String,
+    pub local_id: Option<i64>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ReleaseKeyDto {
+    pub normalized_title: String,
+    pub primary_artists: Vec<String>,
+    pub release_type: Option<String>,
+    pub year: Option<i32>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ReleaseRefDto {
+    pub key: ReleaseKeyDto,
+    pub local_id: Option<i64>,
+    pub title: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct FederationSourceDto {
+    pub owner: String,
+    pub item_id: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct LocalAvailabilityDto {
+    pub track_id: i64,
+    pub stream_url: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct TrackMetadataDto {
+    pub title: String,
+    pub artists: Vec<ArtistRefDto>,
+    pub featured_artists: Vec<ArtistRefDto>,
+    pub release: Option<ReleaseRefDto>,
+    pub year: Option<i32>,
+    pub duration_seconds: Option<f64>,
+    pub track_number: Option<i32>,
+    pub disc_number: Option<i32>,
+    pub cover_url: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct TrackAvailabilityDto {
+    pub state: &'static str,
+    pub local: Option<LocalAvailabilityDto>,
+    pub federation: Vec<FederationSourceDto>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct TrackDto {
+    pub key: TrackKeyDto,
+    pub metadata: TrackMetadataDto,
+    pub availability: TrackAvailabilityDto,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct SearchEvent {
+    pub search_id: String,
+    pub sequence: u64,
+    pub kind: &'static str,
+    pub peer: Option<String>,
+    pub entity_key: Value,
+    pub entity: Value,
+}
+
+impl Federation {
+    pub fn stream_artist_catalogs(
+        self: &std::sync::Arc<Self>,
+        name: String,
+    ) -> tokio::sync::mpsc::UnboundedReceiver<Result<(String, music_dht::catalog::CatalogArtist)>>
+    {
+        let (sender, receiver) = tokio::sync::mpsc::unbounded_channel();
+        let federation = std::sync::Arc::clone(self);
+        tokio::spawn(async move {
+            let result = async {
+                let service = federation.service().await?;
+                let normalized = music_dht::normalize_name(&name);
+                let outcome = service
+                    .search_network(&name)
+                    .await
+                    .map_err(|err| anyhow::anyhow!("federated artist search failed: {err}"))?;
+                let owners: std::collections::HashSet<_> = outcome
+                    .network_results
+                    .iter()
+                    .filter(|item| {
+                        (item.kind == ItemKind::Artist && item.normalized_name == normalized)
+                            || item
+                                .artist_names
+                                .iter()
+                                .chain(&item.featured_artist_names)
+                                .any(|artist| music_dht::normalize_name(artist) == normalized)
+                    })
+                    .map(|item| item.owner)
+                    .collect();
+                for owner in owners {
+                    let service = std::sync::Arc::clone(&service);
+                    let sender = sender.clone();
+                    let name = name.clone();
+                    tokio::spawn(async move {
+                        let result = tokio::time::timeout(
+                            std::time::Duration::from_secs(8),
+                            fetch_artist_catalog(&service, owner, &name),
+                        )
+                        .await
+                        .map_err(|_| anyhow::anyhow!("catalog request timed out"))
+                        .and_then(|result| result)
+                        .map(|artist| (owner.to_string(), artist));
+                        let _ = sender.send(result);
+                    });
+                }
+                Ok::<(), anyhow::Error>(())
+            }
+            .await;
+            if let Err(err) = result {
+                let _ = sender.send(Err(err));
+            }
+        });
+        receiver
+    }
+
+    /// Performs one bounded DHT search and returns entity upserts. The HTTP
+    /// layer streams each upsert independently; catalog fan-out can append
+    /// events to the same contract without changing the browser model.
+    pub async fn search_events(&self, search_id: &str, query: &str) -> Result<Vec<SearchEvent>> {
+        let query = query.trim();
+        anyhow::ensure!(!query.is_empty(), "search query is empty");
+        anyhow::ensure!(query.chars().count() <= 200, "search query is too long");
+
+        let started = std::time::Instant::now();
+        let service = self.service().await?;
+        tracing::info!(
+            search_id,
+            query,
+            connected_peers = service.connected_peers().len(),
+            known_contacts = service.known_peers().len(),
+            "federated search started"
+        );
+        let own = service.endpoint_id();
+        let result = tokio::time::timeout(
+            std::time::Duration::from_secs(20),
+            service.search_network(query),
+        )
+        .await
+        .map_err(|_| anyhow::anyhow!("federated search timed out after 20 seconds"))?
+        .map_err(|err| anyhow::anyhow!("federated search failed: {err}"))?;
+        tracing::info!(
+            search_id,
+            query,
+            local_results = result.local_results.len(),
+            network_results = result.network_results.len(),
+            queried_nodes = result.queried_nodes,
+            elapsed_ms = started.elapsed().as_millis() as u64,
+            "federated DHT search finished"
+        );
+        let all_items: Vec<LibraryItem> = result
+            .local_results
+            .into_iter()
+            .chain(result.network_results)
+            .collect();
+
+        let pool = self.pool().await?;
+        let mut by_content: HashMap<String, TrackDto> = HashMap::new();
+        for item in all_items.iter().filter(|item| item.kind == ItemKind::Track) {
+            let Some(content_id) = item.content_id.as_deref().and_then(normalize_content_id) else {
+                // A globally usable track reference must be verifiable.
+                continue;
+            };
+            let local = local_availability(&pool, &content_id).await?;
+            let source = FederationSourceDto {
+                owner: item.owner.to_string(),
+                item_id: hex(item.id.as_bytes()),
+            };
+            let entry = by_content.entry(content_id.clone()).or_insert_with(|| {
+                track_from_item(content_id.clone(), item, local, item.owner == own)
+            });
+            if !entry.availability.federation.iter().any(|candidate| {
+                candidate.owner == source.owner && candidate.item_id == source.item_id
+            }) {
+                entry.availability.federation.push(source);
+            }
+            if entry.availability.local.is_some() {
+                entry.availability.state = "local";
+            }
+        }
+
+        let mut tracks: Vec<_> = by_content.into_values().collect();
+        tracks.sort_by(|left, right| {
+            left.metadata
+                .title
+                .to_lowercase()
+                .cmp(&right.metadata.title.to_lowercase())
+        });
+
+        let mut events = Vec::with_capacity(all_items.len());
+        for (index, track) in tracks.into_iter().enumerate() {
+            persist_track_ref(&pool, &track).await?;
+            let peer = track
+                .availability
+                .federation
+                .first()
+                .map(|source| source.owner.clone());
+            events.push(SearchEvent {
+                search_id: search_id.to_owned(),
+                sequence: index as u64 + 1,
+                kind: "federation.track",
+                peer,
+                entity_key: serde_json::to_value(&track.key)?,
+                entity: serde_json::to_value(track)?,
+            });
+        }
+        let mut artist_peers: HashMap<String, (String, Vec<String>)> = HashMap::new();
+        let mut releases: HashMap<String, Value> = HashMap::new();
+        for item in &all_items {
+            match item.kind {
+                ItemKind::Artist => {
+                    let key = music_dht::normalize_name(&item.name);
+                    let entry = artist_peers
+                        .entry(key)
+                        .or_insert_with(|| (item.name.clone(), Vec::new()));
+                    let owner = item.owner.to_string();
+                    if !entry.1.contains(&owner) {
+                        entry.1.push(owner);
+                    }
+                }
+                ItemKind::Release => {
+                    let artist_keys: Vec<String> = item
+                        .artist_names
+                        .iter()
+                        .map(|name| music_dht::normalize_name(name))
+                        .collect();
+                    let normalized_title = music_dht::normalize_name(&item.name);
+                    let cover_url = all_items
+                        .iter()
+                        .find(|track| {
+                            track.kind == ItemKind::Track
+                                && track.release_title.as_deref().is_some_and(|title| {
+                                    music_dht::normalize_name(title) == normalized_title
+                                })
+                                && track.year == item.year
+                        })
+                        .map(|track| {
+                            format!(
+                                "/api/player/federation/tracks/artwork?owner={}&item_id={}",
+                                track.owner,
+                                hex(track.id.as_bytes())
+                            )
+                        });
+                    let key = format!(
+                        "{}|{}|{}",
+                        normalized_title,
+                        artist_keys.join(","),
+                        item.year.map_or_else(String::new, |year| year.to_string())
+                    );
+                    releases.entry(key.clone()).or_insert_with(|| {
+                        json!({
+                            "key": {
+                                "normalized_title": music_dht::normalize_name(&item.name),
+                                "primary_artists": artist_keys,
+                                "release_type": null,
+                                "year": item.year,
+                            },
+                            "title": item.name,
+                            "artists": item.artist_names,
+                            "year": item.year,
+                            "cover_url": cover_url,
+                            "sources": [{
+                                "owner": item.owner.to_string(),
+                                "item_id": hex(item.id.as_bytes()),
+                            }],
+                        })
+                    });
+                }
+                ItemKind::Track => {}
+            }
+        }
+        for (key, (name, peers)) in artist_peers {
+            let sequence = events.len() as u64 + 1;
+            events.push(SearchEvent {
+                search_id: search_id.to_owned(),
+                sequence,
+                kind: "federation.artist",
+                peer: peers.first().cloned(),
+                entity_key: json!({ "normalized_name": key }),
+                entity: json!({
+                    "key": { "normalized_name": key },
+                    "name": name,
+                    "image_url": null,
+                    "peers": peers,
+                }),
+            });
+        }
+        for (key, release) in releases {
+            let sequence = events.len() as u64 + 1;
+            events.push(SearchEvent {
+                search_id: search_id.to_owned(),
+                sequence,
+                kind: "federation.release",
+                peer: None,
+                entity_key: json!({ "composite": key }),
+                entity: release,
+            });
+        }
+        tracing::info!(
+            search_id,
+            query,
+            events = events.len(),
+            elapsed_ms = started.elapsed().as_millis() as u64,
+            "federated search response ready"
+        );
+        Ok(events)
+    }
+}
+
+async fn fetch_artist_catalog(
+    service: &music_dht::MusicDhtService,
+    owner: music_dht::EndpointId,
+    artist: &str,
+) -> Result<music_dht::catalog::CatalogArtist> {
+    let mut stream = service
+        .open_stream(owner, super::CATALOG_ALPN)
+        .await
+        .map_err(|err| anyhow::anyhow!("cannot reach catalog peer: {err}"))?;
+    let mut request = serde_json::to_vec(&music_dht::catalog::CatalogRequest {
+        artist: artist.to_owned(),
+        want: Some("catalog".to_owned()),
+        ..Default::default()
+    })?;
+    request.push(b'\n');
+    stream.send.write_all(&request).await?;
+    stream.send.finish()?;
+    let mut payload = Vec::new();
+    stream
+        .recv
+        .take(MAX_CATALOG_BYTES + 1)
+        .read_to_end(&mut payload)
+        .await?;
+    anyhow::ensure!(
+        payload.len() as u64 <= MAX_CATALOG_BYTES,
+        "catalog response is too large"
+    );
+    let response: music_dht::catalog::CatalogResponse =
+        serde_json::from_slice(&payload).context("invalid catalog response")?;
+    anyhow::ensure!(
+        response.ok,
+        "peer refused catalog: {}",
+        response.error.unwrap_or_else(|| "unknown error".to_owned())
+    );
+    response.artist.context("peer returned no artist catalog")
+}
+
+fn track_from_item(
+    content_id: String,
+    item: &LibraryItem,
+    local: Option<LocalAvailabilityDto>,
+    own: bool,
+) -> TrackDto {
+    let owner = item.owner.to_string();
+    let item_id = hex(item.id.as_bytes());
+    let artists = artist_refs(&item.artist_names);
+    let featured_artists = artist_refs(&item.featured_artist_names);
+    let release = item.release_title.as_ref().map(|title| ReleaseRefDto {
+        key: ReleaseKeyDto {
+            normalized_title: music_dht::normalize_name(title),
+            primary_artists: item
+                .artist_names
+                .iter()
+                .map(|artist| music_dht::normalize_name(artist))
+                .collect(),
+            release_type: None,
+            year: item.year,
+        },
+        local_id: None,
+        title: title.clone(),
+    });
+    let state = if local.is_some() || own {
+        "local"
+    } else {
+        "federated"
+    };
+    TrackDto {
+        key: TrackKeyDto { content_id },
+        metadata: TrackMetadataDto {
+            title: item.name.clone(),
+            artists,
+            featured_artists,
+            release,
+            year: item.year,
+            duration_seconds: item.duration_seconds,
+            track_number: item.track_number,
+            disc_number: item.disc_number,
+            cover_url: Some(format!(
+                "/api/player/federation/tracks/artwork?owner={owner}&item_id={item_id}"
+            )),
+        },
+        availability: TrackAvailabilityDto {
+            state,
+            local,
+            federation: vec![FederationSourceDto { owner, item_id }],
+        },
+    }
+}
+
+fn artist_refs(names: &[String]) -> Vec<ArtistRefDto> {
+    names
+        .iter()
+        .map(|name| ArtistRefDto {
+            key: ArtistKeyDto {
+                normalized_name: music_dht::normalize_name(name),
+            },
+            name: name.clone(),
+            local_id: None,
+        })
+        .collect()
+}
+
+async fn local_availability(
+    pool: &sqlx::PgPool,
+    content_id: &str,
+) -> Result<Option<LocalAvailabilityDto>> {
+    let row = sqlx::query(
+        "SELECT t.id
+           FROM furumusic__federation_content_id_cache c
+           JOIN furumusic__track t ON t.audio_file_id = c.media_file_id
+          WHERE c.content_id = $1 AND t.is_hidden = false
+          LIMIT 1",
+    )
+    .bind(content_id)
+    .fetch_optional(pool)
+    .await?;
+    Ok(row.map(|row| {
+        let track_id: i64 = row.get(0);
+        LocalAvailabilityDto {
+            track_id,
+            stream_url: format!("/api/player/stream/{track_id}"),
+        }
+    }))
+}
+
+async fn persist_track_ref(pool: &sqlx::PgPool, track: &TrackDto) -> Result<()> {
+    let metadata = serde_json::to_value(&track.metadata)?;
+    let local_id = track
+        .availability
+        .local
+        .as_ref()
+        .map(|local| local.track_id);
+    let row = sqlx::query(
+        "INSERT INTO furumusic__track_ref
+            (content_id, local_track_id, title, release_title, year,
+             duration_seconds, metadata_json, metadata_authority, created_at, updated_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, 'federation', $8, $8)
+         ON CONFLICT (content_id) DO UPDATE SET
+            local_track_id = COALESCE(furumusic__track_ref.local_track_id, EXCLUDED.local_track_id),
+            title = EXCLUDED.title,
+            release_title = EXCLUDED.release_title,
+            year = EXCLUDED.year,
+            duration_seconds = EXCLUDED.duration_seconds,
+            metadata_json = EXCLUDED.metadata_json,
+            updated_at = EXCLUDED.updated_at
+         RETURNING id",
+    )
+    .bind(&track.key.content_id)
+    .bind(local_id)
+    .bind(&track.metadata.title)
+    .bind(
+        track
+            .metadata
+            .release
+            .as_ref()
+            .map(|release| &release.title),
+    )
+    .bind(track.metadata.year)
+    .bind(track.metadata.duration_seconds)
+    .bind(metadata)
+    .bind(now_iso())
+    .fetch_one(pool)
+    .await
+    .context("persisting content-addressed track reference failed")?;
+    let track_ref_id: i64 = row.get(0);
+    for source in &track.availability.federation {
+        sqlx::query(
+            "INSERT INTO furumusic__federation_track_source
+                (track_ref_id, owner_peer_id, item_id, last_seen_ms, metadata_json)
+             VALUES ($1, $2, $3, $4, $5)
+             ON CONFLICT (owner_peer_id, item_id) DO UPDATE SET
+                track_ref_id = EXCLUDED.track_ref_id,
+                last_seen_ms = EXCLUDED.last_seen_ms,
+                metadata_json = EXCLUDED.metadata_json",
+        )
+        .bind(track_ref_id)
+        .bind(&source.owner)
+        .bind(&source.item_id)
+        .bind(chrono::Utc::now().timestamp_millis())
+        .bind(json!({ "track": track.metadata }))
+        .execute(pool)
+        .await?;
+    }
+    Ok(())
+}
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|byte| format!("{byte:02x}")).collect()
+}

src/federation/mod.rs

@@ -9,21 +9,24 @@
 //! or download from other peers.
 //!
 //! Settings are the regular admin config entries (`federation_enabled`,
-//! `federation_network_id`) and apply on the fly — saving the settings
+//! `federation_network_id`, `federation_save_on_listen`) and apply on the fly — saving the settings
 //! starts, stops or re-joins the node without a server restart.
 
+pub mod client;
+pub mod devices;
+mod receive;
 mod serve;
 mod storage;
 
-use std::collections::{HashMap, HashSet};
+use std::collections::{HashMap, HashSet, VecDeque};
 use std::path::PathBuf;
 use std::sync::{Arc, OnceLock};
 use std::time::Duration;
 
 use anyhow::{Context, Result};
 use music_dht::{
-    ItemKind, ItemSpec, MusicDhtConfig, MusicDhtService, NetworkId, PeerTicket, PublishStats,
-    RendezvousConfig, SyncStats,
+    ByteStream, ByteStreamConnectionStats, ItemKind, ItemSpec, MusicDhtConfig, MusicDhtService,
+    NetworkId, PeerTicket, PublishStats, RendezvousConfig, SyncStats,
 };
 use serde_json::{Value, json};
 use sqlx::PgPool;
@@ -36,6 +39,7 @@ pub use serve::{AUDIO_ALPN, CATALOG_ALPN};
 
 /// How often the published library is re-synchronized with the database.
 const SYNC_INTERVAL: Duration = Duration::from_secs(60);
+const TRANSPORT_SAMPLE_LIMIT: usize = 16;
 
 struct Running {
     service: Arc<MusicDhtService>,
@@ -49,17 +53,180 @@ struct ContentHashJob {
     file_path: String,
 }
 
+#[derive(Clone)]
+struct CachedArtwork {
+    bytes: Vec<u8>,
+    mime: String,
+    fetched_at: std::time::Instant,
+}
+
+#[derive(Debug, Clone)]
+struct TransportSample {
+    at: String,
+    protocol: &'static str,
+    direction: &'static str,
+    phase: &'static str,
+    peer_id: String,
+    selected_path: String,
+    open_paths: usize,
+    direct_paths: usize,
+    relay_paths: usize,
+    custom_paths: usize,
+    selected_rtt_ms: Option<u64>,
+    selected_tx_bytes: u64,
+    selected_rx_bytes: u64,
+    total_tx_bytes: u64,
+    total_rx_bytes: u64,
+    lost_packets: u64,
+    lost_bytes: u64,
+}
+
+impl TransportSample {
+    fn from_stats(
+        protocol: &'static str,
+        direction: &'static str,
+        phase: &'static str,
+        stats: ByteStreamConnectionStats,
+    ) -> Self {
+        Self {
+            at: now_iso(),
+            protocol,
+            direction,
+            phase,
+            peer_id: stats.peer_id.to_string(),
+            selected_path: stats.selected_path.as_str().to_string(),
+            open_paths: stats.open_paths,
+            direct_paths: stats.direct_paths,
+            relay_paths: stats.relay_paths,
+            custom_paths: stats.custom_paths,
+            selected_rtt_ms: stats
+                .selected_rtt
+                .map(|duration| duration.as_millis() as u64),
+            selected_tx_bytes: stats.selected_tx_bytes,
+            selected_rx_bytes: stats.selected_rx_bytes,
+            total_tx_bytes: stats.total_tx_bytes,
+            total_rx_bytes: stats.total_rx_bytes,
+            lost_packets: stats.lost_packets,
+            lost_bytes: stats.lost_bytes,
+        }
+    }
+}
+
+#[derive(Debug, Default)]
+struct TransportStatsState {
+    total_samples: u64,
+    direct_samples: u64,
+    relay_samples: u64,
+    custom_samples: u64,
+    unknown_samples: u64,
+    audio_samples: u64,
+    catalog_samples: u64,
+    sync_samples: u64,
+    last: VecDeque<TransportSample>,
+}
+
+#[derive(Debug, Default)]
+pub struct TransportStats {
+    inner: std::sync::Mutex<TransportStatsState>,
+}
+
+impl TransportStats {
+    fn reset(&self) {
+        *lock(&self.inner) = TransportStatsState::default();
+    }
+
+    fn record(
+        &self,
+        protocol: &'static str,
+        direction: &'static str,
+        phase: &'static str,
+        stats: ByteStreamConnectionStats,
+    ) {
+        let sample = TransportSample::from_stats(protocol, direction, phase, stats);
+        let mut state = lock(&self.inner);
+        state.total_samples += 1;
+        match sample.selected_path.as_str() {
+            "direct" => state.direct_samples += 1,
+            "relay" => state.relay_samples += 1,
+            "custom" => state.custom_samples += 1,
+            _ => state.unknown_samples += 1,
+        }
+        match protocol {
+            "audio" => state.audio_samples += 1,
+            "catalog" => state.catalog_samples += 1,
+            "device-sync" => state.sync_samples += 1,
+            _ => {}
+        }
+        state.last.push_front(sample);
+        while state.last.len() > TRANSPORT_SAMPLE_LIMIT {
+            state.last.pop_back();
+        }
+    }
+
+    fn snapshot(&self) -> Value {
+        let state = lock(&self.inner);
+        let latest = state.last.front();
+        json!({
+            "total_samples": state.total_samples,
+            "direct_samples": state.direct_samples,
+            "relay_samples": state.relay_samples,
+            "custom_samples": state.custom_samples,
+            "unknown_samples": state.unknown_samples,
+            "audio_samples": state.audio_samples,
+            "catalog_samples": state.catalog_samples,
+            "sync_samples": state.sync_samples,
+            "last_path": latest.map(|sample| sample.selected_path.clone()),
+            "last_rtt_ms": latest.and_then(|sample| sample.selected_rtt_ms),
+            "last_peer": latest.map(|sample| sample.peer_id.clone()),
+            "last": state.last.iter().map(|sample| json!({
+                "at": sample.at,
+                "protocol": sample.protocol,
+                "direction": sample.direction,
+                "phase": sample.phase,
+                "peer_id": sample.peer_id,
+                "selected_path": sample.selected_path,
+                "open_paths": sample.open_paths,
+                "direct_paths": sample.direct_paths,
+                "relay_paths": sample.relay_paths,
+                "custom_paths": sample.custom_paths,
+                "selected_rtt_ms": sample.selected_rtt_ms,
+                "selected_tx_bytes": sample.selected_tx_bytes,
+                "selected_rx_bytes": sample.selected_rx_bytes,
+                "total_tx_bytes": sample.total_tx_bytes,
+                "total_rx_bytes": sample.total_rx_bytes,
+                "lost_packets": sample.lost_packets,
+                "lost_bytes": sample.lost_bytes,
+            })).collect::<Vec<_>>(),
+        })
+    }
+}
+
+pub fn record_stream_transport(
+    stats: &Arc<TransportStats>,
+    protocol: &'static str,
+    direction: &'static str,
+    phase: &'static str,
+    stream: &ByteStream,
+) {
+    stats.record(protocol, direction, phase, stream.connection_stats());
+}
+
 pub struct Federation {
     /// Transport data directory; server-side DHT state and identity live in PostgreSQL.
     data_dir: PathBuf,
     database_url: std::sync::Mutex<String>,
     storage_dir: std::sync::Mutex<String>,
+    save_on_listen: std::sync::atomic::AtomicBool,
     content_cache: std::sync::Mutex<HashMap<i64, (String, String)>>,
     content_pending: std::sync::Mutex<HashSet<i64>>,
+    prepared_cache: std::sync::Mutex<HashMap<String, (PathBuf, String)>>,
+    artwork_cache: std::sync::Mutex<HashMap<String, CachedArtwork>>,
+    download_locks: std::sync::Mutex<HashMap<String, Arc<tokio::sync::Mutex<()>>>>,
     pool: tokio::sync::OnceCell<PgPool>,
     running: tokio::sync::Mutex<Option<Running>>,
     last_sync: std::sync::Mutex<Option<String>>,
     last_error: std::sync::Mutex<Option<String>>,
+    transport_stats: Arc<TransportStats>,
 }
 
 fn now_iso() -> String {
@@ -80,12 +247,17 @@ pub fn handle() -> Arc<Federation> {
             data_dir: PathBuf::from(crate::media_paths::resolve_config_path("federation")),
             database_url: std::sync::Mutex::new(String::new()),
             storage_dir: std::sync::Mutex::new(String::new()),
+            save_on_listen: std::sync::atomic::AtomicBool::new(false),
             content_cache: std::sync::Mutex::new(Default::default()),
             content_pending: std::sync::Mutex::new(Default::default()),
+            prepared_cache: std::sync::Mutex::new(Default::default()),
+            artwork_cache: std::sync::Mutex::new(Default::default()),
+            download_locks: std::sync::Mutex::new(Default::default()),
             pool: tokio::sync::OnceCell::new(),
             running: tokio::sync::Mutex::new(None),
             last_sync: std::sync::Mutex::new(None),
             last_error: std::sync::Mutex::new(None),
+            transport_stats: Arc::new(TransportStats::default()),
         })
     }))
 }
@@ -130,7 +302,8 @@ impl Federation {
         let mut effective = config.clone();
         let rows = sqlx::query(
             "SELECT key, value FROM furumusic__config_entry
-             WHERE key IN ('federation_enabled', 'federation_network_id', 'agent_storage_dir')",
+             WHERE key IN ('federation_enabled', 'federation_network_id',
+                           'federation_save_on_listen', 'agent_storage_dir')",
         )
         .fetch_all(&pool)
         .await
@@ -149,6 +322,11 @@ impl Federation {
                     }
                 }
                 "federation_network_id" => effective.federation_network_id = value,
+                "federation_save_on_listen" => {
+                    if let Ok(parsed) = value.parse() {
+                        effective.federation_save_on_listen = parsed;
+                    }
+                }
                 "agent_storage_dir" => {
                     effective.agent_storage_dir = crate::media_paths::resolve_config_path(&value);
                 }
@@ -163,6 +341,10 @@ impl Federation {
     pub async fn apply(self: &Arc<Self>, config: &AppConfig) {
         *lock(&self.database_url) = config.database_url.clone();
         *lock(&self.storage_dir) = config.agent_storage_dir.clone();
+        self.save_on_listen.store(
+            config.federation_save_on_listen,
+            std::sync::atomic::Ordering::Relaxed,
+        );
         let network = config.federation_network_id.trim().to_string();
         if config.federation_enabled && !network.is_empty() {
             if let Err(err) = self.start(network, config.agent_storage_dir.clone()).await {
@@ -188,6 +370,7 @@ impl Federation {
 
         let dht_storage = Arc::new(PostgresFederationStorage::new(pool.clone()).await?);
         let secret_key = dht_storage.load_or_create_secret_key().await?;
+        self.transport_stats.reset();
 
         let config = MusicDhtConfig::builder()
             .data_dir(&self.data_dir)
@@ -196,6 +379,7 @@ impl Federation {
             .rendezvous(RendezvousConfig::default())
             .stream_protocol(AUDIO_ALPN)
             .stream_protocol(CATALOG_ALPN)
+            .stream_protocol(devices::SYNC_ALPN)
             .build()
             .map_err(|err| anyhow::anyhow!("invalid federation config: {err}"))?;
         let (service, mut events) =
@@ -234,21 +418,47 @@ impl Federation {
             pool.clone(),
             storage_dir.clone(),
             service.endpoint_id(),
+            Arc::clone(&self.transport_stats),
         ));
         let catalog_acceptor = service
             .stream_acceptor(CATALOG_ALPN)
             .map_err(|err| anyhow::anyhow!("failed to take the catalog acceptor: {err}"))?;
         let catalog_task = tokio::spawn(serve::serve_catalog(
             catalog_acceptor,
-            pool,
+            pool.clone(),
             storage_dir,
             service.endpoint_id(),
+            Arc::clone(&self.transport_stats),
+        ));
+        let device_acceptor = service
+            .stream_acceptor(devices::SYNC_ALPN)
+            .map_err(|err| anyhow::anyhow!("failed to take the device-sync acceptor: {err}"))?;
+        let device_hub = crate::player::PlayerDeviceHub::shared();
+        let device_task = tokio::spawn(devices::serve_peers(
+            device_acceptor,
+            pool.clone(),
+            Arc::clone(&service),
+            Arc::clone(&device_hub),
+            Arc::clone(&self.transport_stats),
+        ));
+        let device_sync_task = tokio::spawn(devices::sync_loop(
+            pool,
+            Arc::clone(&service),
+            device_hub,
+            Arc::clone(&self.transport_stats),
         ));
 
         *guard = Some(Running {
             service,
             network_name,
-            tasks: vec![event_task, sync_task, audio_task, catalog_task],
+            tasks: vec![
+                event_task,
+                sync_task,
+                audio_task,
+                catalog_task,
+                device_task,
+                device_sync_task,
+            ],
         });
         self.set_error(None);
         drop(guard);
@@ -575,6 +785,7 @@ impl Federation {
                     "connected_peers": peers,
                     "known_contacts": service.known_peers().len(),
                     "published_items": published,
+                    "transport": self.transport_stats.snapshot(),
                 })
             }
             None => json!({ "running": false }),
@@ -607,6 +818,130 @@ impl Federation {
             .map_err(|err| anyhow::anyhow!("connect failed: {err}"))?;
         Ok(peer.to_string())
     }
+
+    pub async fn fed_device_status(
+        &self,
+        user_id: i64,
+        user_name: &str,
+    ) -> Result<devices::FedDeviceStatus> {
+        let pool = self.pool().await?;
+        devices::status(&pool, user_id, user_name).await
+    }
+
+    pub async fn fed_device_invite(&self, user_id: i64, user_name: &str) -> Result<String> {
+        let service = self.service().await?;
+        let pool = self.pool().await?;
+        devices::create_invite(&pool, service, user_id, user_name).await
+    }
+
+    pub async fn fed_device_connect(
+        &self,
+        user_id: i64,
+        user_name: &str,
+        invite: &str,
+    ) -> Result<String> {
+        let network_id = devices::invite_network_id(invite)?;
+        {
+            let guard = self.running.lock().await;
+            let Some(running) = guard.as_ref() else {
+                anyhow::bail!("federation is not running");
+            };
+            let expected = NetworkId::from_name(&running.network_name);
+            anyhow::ensure!(
+                network_id == expected,
+                "device invite belongs to a different federation network"
+            );
+        }
+        let service = self.service().await?;
+        let pool = self.pool().await?;
+        devices::connect_invite(
+            &pool,
+            service,
+            crate::player::PlayerDeviceHub::shared(),
+            Arc::clone(&self.transport_stats),
+            user_id,
+            user_name,
+            invite,
+        )
+        .await
+    }
+
+    pub async fn fed_device_answer_pairing(
+        &self,
+        user_id: i64,
+        request_id: &str,
+        accept: bool,
+        use_requester_group: bool,
+    ) -> Result<()> {
+        let pool = self.pool().await?;
+        devices::answer_pairing(&pool, user_id, request_id, accept, use_requester_group).await
+    }
+
+    pub async fn fed_device_revoke(&self, user_id: i64, device_id: &str) -> Result<()> {
+        let pool = self.pool().await?;
+        devices::revoke_device(&pool, user_id, device_id).await
+    }
+
+    pub async fn fed_device_sync_now(&self, user_id: i64) -> Result<()> {
+        let service = self.service().await?;
+        let pool = self.pool().await?;
+        devices::sync_once(
+            &pool,
+            service,
+            crate::player::PlayerDeviceHub::shared(),
+            Arc::clone(&self.transport_stats),
+            user_id,
+        )
+        .await
+    }
+
+    pub async fn fed_device_web_command(
+        &self,
+        user_id: i64,
+        target_device_id: &str,
+        command: &str,
+        payload: serde_json::Value,
+        current_state: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let pool = self.pool().await?;
+        devices::record_web_playback_command(
+            &pool,
+            user_id,
+            target_device_id,
+            command,
+            payload,
+            current_state,
+        )
+        .await
+    }
+
+    pub async fn fed_device_web_active_transfer(
+        &self,
+        user_id: i64,
+        target_device_id: &str,
+        previous_device_id: Option<&str>,
+        state: serde_json::Value,
+    ) -> Result<()> {
+        let pool = self.pool().await?;
+        devices::record_web_active_transfer(
+            &pool,
+            user_id,
+            target_device_id,
+            previous_device_id,
+            state,
+        )
+        .await
+    }
+
+    pub async fn fed_device_web_active_takeover(
+        &self,
+        user_id: i64,
+        previous_device_id: &str,
+        state: serde_json::Value,
+    ) -> Result<()> {
+        let pool = self.pool().await?;
+        devices::record_web_active_takeover(&pool, user_id, previous_device_id, state).await
+    }
 }
 
 async fn persist_content_id(

src/federation/receive.rs

@@ -0,0 +1,914 @@
+//! Verified federated audio download and trusted materialization.
+//!
+//! This module never writes inbox, processing-task, or review tables. Peer
+//! metadata is the authority for this import path.
+
+use std::path::{Path, PathBuf};
+use std::str::FromStr;
+
+use anyhow::{Context, Result};
+use music_dht::EndpointId;
+use serde::{Deserialize, Serialize};
+use sha2::{Digest as _, Sha256};
+use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
+
+use super::{Federation, now_iso};
+
+const MAX_LINE: usize = 4096;
+const MAX_AUDIO_BYTES: u64 = 4 * 1024 * 1024 * 1024;
+const MAX_IMAGE_BYTES: u64 = 16 * 1024 * 1024;
+const ARTWORK_CACHE_TTL: std::time::Duration = std::time::Duration::from_secs(60 * 60);
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+struct TrackMetadata {
+    title: String,
+    #[serde(default)]
+    artists: Vec<String>,
+    #[serde(default)]
+    featured_artists: Vec<String>,
+    #[serde(default)]
+    album_artists: Vec<String>,
+    #[serde(default)]
+    release_title: String,
+    release_type: Option<String>,
+    year: Option<i32>,
+    track_number: Option<i32>,
+    disc_number: Option<i32>,
+}
+
+#[derive(Serialize)]
+struct AudioRequest<'a> {
+    item_id: &'a str,
+    offset: u64,
+    want_cover: bool,
+}
+
+#[derive(Deserialize)]
+struct AudioHeader {
+    ok: bool,
+    #[serde(default)]
+    error: Option<String>,
+    #[serde(default)]
+    mime_type: String,
+    #[serde(default)]
+    total_size: u64,
+    #[serde(default)]
+    metadata: Option<TrackMetadata>,
+    #[serde(default)]
+    cover_size: u64,
+    #[serde(default)]
+    cover_mime: String,
+    #[serde(default)]
+    artist_image_size: u64,
+    #[serde(default)]
+    artist_image_mime: String,
+}
+
+pub struct PreparedTrack {
+    pub local_track_id: Option<i64>,
+    pub stream_url: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct DownloadProgress {
+    pub phase: &'static str,
+    pub received: u64,
+    pub total: u64,
+}
+
+struct Downloaded {
+    path: PathBuf,
+    mime: String,
+    metadata: TrackMetadata,
+    cover: Option<(Vec<u8>, String)>,
+    artist_image: Option<(Vec<u8>, String)>,
+}
+
+impl Federation {
+    pub async fn discover_catalog_artwork(
+        &self,
+        artist: &str,
+        release: Option<&str>,
+    ) -> Result<Option<(Vec<u8>, String)>> {
+        let service = self.service().await?;
+        let normalized = music_dht::normalize_name(artist);
+        let outcome = service
+            .search_network(artist)
+            .await
+            .map_err(|err| anyhow::anyhow!("artwork peer discovery failed: {err}"))?;
+        let mut owners = Vec::new();
+        for item in outcome.local_results.iter().chain(&outcome.network_results) {
+            let matches = (item.kind == music_dht::ItemKind::Artist
+                && item.normalized_name == normalized)
+                || item
+                    .artist_names
+                    .iter()
+                    .chain(&item.featured_artist_names)
+                    .any(|name| music_dht::normalize_name(name) == normalized);
+            let owner = item.owner.to_string();
+            if matches && !owners.contains(&owner) {
+                owners.push(owner);
+            }
+        }
+        for owner in owners {
+            match tokio::time::timeout(
+                std::time::Duration::from_secs(5),
+                self.catalog_artwork(&owner, artist, release),
+            )
+            .await
+            {
+                Ok(Ok(Some(artwork))) => return Ok(Some(artwork)),
+                Ok(Ok(None)) => {}
+                Ok(Err(err)) => {
+                    tracing::debug!(%owner, %artist, ?release, "catalog artwork peer failed: {err:#}");
+                }
+                Err(_) => {
+                    tracing::debug!(%owner, %artist, ?release, "catalog artwork peer timed out");
+                }
+            }
+        }
+        Ok(None)
+    }
+
+    pub async fn catalog_artwork(
+        &self,
+        owner: &str,
+        artist: &str,
+        release: Option<&str>,
+    ) -> Result<Option<(Vec<u8>, String)>> {
+        let cache_key = format!("catalog:{owner}:{artist}:{}", release.unwrap_or_default());
+        if let Some(cached) = cached_artwork(self, &cache_key) {
+            return Ok(Some(cached));
+        }
+        let owner = EndpointId::from_str(owner).context("invalid federation owner")?;
+        let service = self.service().await?;
+        let mut stream = service
+            .open_stream(owner, super::CATALOG_ALPN)
+            .await
+            .map_err(|err| anyhow::anyhow!("cannot reach catalog peer: {err}"))?;
+        let mut request = serde_json::to_vec(&music_dht::catalog::CatalogRequest {
+            artist: artist.to_owned(),
+            want: Some(if release.is_some() {
+                "release_cover".to_owned()
+            } else {
+                "artist_image".to_owned()
+            }),
+            release: release.map(str::to_owned),
+            ..Default::default()
+        })?;
+        request.push(b'\n');
+        stream.send.write_all(&request).await?;
+        stream.send.finish()?;
+        let header: music_dht::catalog::CatalogImageHeader =
+            serde_json::from_slice(&read_line(&mut stream.recv).await?)
+                .context("invalid catalog artwork response")?;
+        if !header.ok || header.size == 0 {
+            return Ok(None);
+        }
+        anyhow::ensure!(
+            header.size <= MAX_IMAGE_BYTES,
+            "catalog artwork is too large"
+        );
+        anyhow::ensure!(
+            header.mime_type.starts_with("image/"),
+            "invalid catalog artwork mime type"
+        );
+        let mut bytes = vec![0; header.size as usize];
+        stream.recv.read_exact(&mut bytes).await?;
+        let artwork = (bytes, header.mime_type);
+        cache_artwork(self, cache_key, &artwork);
+        Ok(Some(artwork))
+    }
+
+    pub async fn track_artwork(
+        &self,
+        owner: &str,
+        item_id: &str,
+    ) -> Result<Option<(Vec<u8>, String)>> {
+        let cache_key = format!("{owner}:{item_id}");
+        if let Some(cached) = cached_artwork(self, &cache_key) {
+            return Ok(Some(cached));
+        }
+        let owner = EndpointId::from_str(owner).context("invalid federation owner")?;
+        anyhow::ensure!(item_id.len() == 64, "invalid federation item id");
+        let service = self.service().await?;
+        let mut stream = service
+            .open_stream(owner, super::AUDIO_ALPN)
+            .await
+            .map_err(|err| anyhow::anyhow!("cannot reach track owner: {err}"))?;
+        write_line(
+            &mut stream.send,
+            &AudioRequest {
+                item_id,
+                offset: 0,
+                want_cover: true,
+            },
+        )
+        .await?;
+        stream.send.finish()?;
+        let header: AudioHeader = serde_json::from_slice(&read_line(&mut stream.recv).await?)
+            .context("invalid artwork response")?;
+        anyhow::ensure!(
+            header.ok,
+            "peer refused artwork: {}",
+            header.error.unwrap_or_else(|| "unknown error".to_string())
+        );
+        let artwork = read_segment(
+            &mut stream.recv,
+            header.cover_size,
+            &header.cover_mime,
+            "cover",
+        )
+        .await?;
+        if let Some((bytes, mime)) = artwork {
+            let artwork = (bytes, mime);
+            cache_artwork(self, cache_key, &artwork);
+            Ok(Some(artwork))
+        } else {
+            Ok(None)
+        }
+    }
+
+    pub async fn prepare_content_with_progress<F>(
+        self: &std::sync::Arc<Self>,
+        content_id: &str,
+        owner: &str,
+        item_id: &str,
+        mut progress: F,
+    ) -> Result<PreparedTrack>
+    where
+        F: FnMut(DownloadProgress) + Send,
+    {
+        progress(DownloadProgress {
+            phase: "checking",
+            received: 0,
+            total: 0,
+        });
+        let content_id =
+            music_dht::normalize_content_id(content_id).context("invalid content id")?;
+        let pool = self.pool().await?;
+        let token = content_id.trim_start_matches("b3:").to_owned();
+        let download_lock = {
+            let mut locks = super::lock(&self.download_locks);
+            std::sync::Arc::clone(
+                locks
+                    .entry(content_id.clone())
+                    .or_insert_with(|| std::sync::Arc::new(tokio::sync::Mutex::new(()))),
+            )
+        };
+        let _download_guard = download_lock.lock().await;
+        if let Some(track_id) = local_track_id(&pool, &content_id).await? {
+            progress(DownloadProgress {
+                phase: "ready",
+                received: 1,
+                total: 1,
+            });
+            return Ok(PreparedTrack {
+                local_track_id: Some(track_id),
+                stream_url: format!("/api/player/stream/{track_id}"),
+            });
+        }
+
+        let save = self
+            .save_on_listen
+            .load(std::sync::atomic::Ordering::Relaxed);
+        if !save
+            && let Some((_path, _mime)) = super::lock(&self.prepared_cache).get(&token).cloned()
+        {
+            return Ok(PreparedTrack {
+                local_track_id: None,
+                stream_url: format!("/api/player/federation/cache/{token}"),
+            });
+        }
+        let owner = EndpointId::from_str(owner).context("invalid federation owner")?;
+        anyhow::ensure!(item_id.len() == 64, "invalid federation item id");
+        let service = self.service().await?;
+        let storage_root = if save {
+            PathBuf::from(super::lock(&self.storage_dir).clone())
+        } else {
+            PathBuf::from(crate::media_paths::resolve_config_path("federation-cache"))
+        };
+        anyhow::ensure!(
+            !storage_root.as_os_str().is_empty(),
+            "media storage directory is not configured"
+        );
+        let dir = storage_root.join("federation");
+        tokio::fs::create_dir_all(&dir).await?;
+        let downloaded =
+            download(&service, owner, item_id, &content_id, &dir, &mut progress).await?;
+        if !save {
+            super::lock(&self.prepared_cache)
+                .insert(token.clone(), (downloaded.path, downloaded.mime));
+            return Ok(PreparedTrack {
+                local_track_id: None,
+                stream_url: format!("/api/player/federation/cache/{token}"),
+            });
+        }
+        progress(DownloadProgress {
+            phase: "saving",
+            received: 1,
+            total: 1,
+        });
+        let track_id = materialize(&pool, &storage_root, &content_id, downloaded).await?;
+        // The normal periodic sync will publish it; this immediate sync keeps
+        // save-on-listen useful to the federation without waiting a minute.
+        if let Err(err) = self.sync_now().await {
+            tracing::warn!(track_id, "post-import federation publish failed: {err:#}");
+        }
+        Ok(PreparedTrack {
+            local_track_id: Some(track_id),
+            stream_url: format!("/api/player/stream/{track_id}"),
+        })
+    }
+
+    pub fn prepared_cache_file(&self, token: &str) -> Option<(PathBuf, String)> {
+        if token.len() != 64 || !token.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+            return None;
+        }
+        super::lock(&self.prepared_cache).get(token).cloned()
+    }
+}
+
+fn cached_artwork(federation: &Federation, key: &str) -> Option<(Vec<u8>, String)> {
+    let mut cache = super::lock(&federation.artwork_cache);
+    let cached = cache.get(key).cloned()?;
+    if cached.fetched_at.elapsed() > ARTWORK_CACHE_TTL {
+        cache.remove(key);
+        return None;
+    }
+    Some((cached.bytes, cached.mime))
+}
+
+fn cache_artwork(federation: &Federation, key: String, artwork: &(Vec<u8>, String)) {
+    let mut cache = super::lock(&federation.artwork_cache);
+    if cache.len() >= 512 {
+        cache.retain(|_, value| value.fetched_at.elapsed() <= ARTWORK_CACHE_TTL);
+        if cache.len() >= 512
+            && let Some(oldest) = cache
+                .iter()
+                .min_by_key(|(_, value)| value.fetched_at)
+                .map(|(key, _)| key.clone())
+        {
+            cache.remove(&oldest);
+        }
+    }
+    cache.insert(
+        key,
+        super::CachedArtwork {
+            bytes: artwork.0.clone(),
+            mime: artwork.1.clone(),
+            fetched_at: std::time::Instant::now(),
+        },
+    );
+}
+
+async fn download(
+    service: &music_dht::MusicDhtService,
+    owner: EndpointId,
+    item_id: &str,
+    content_id: &str,
+    dir: &Path,
+    progress: &mut (impl FnMut(DownloadProgress) + Send),
+) -> Result<Downloaded> {
+    progress(DownloadProgress {
+        phase: "connecting",
+        received: 0,
+        total: 0,
+    });
+    let mut stream = service
+        .open_stream(owner, super::AUDIO_ALPN)
+        .await
+        .map_err(|err| anyhow::anyhow!("cannot reach track owner: {err}"))?;
+    write_line(
+        &mut stream.send,
+        &AudioRequest {
+            item_id,
+            offset: 0,
+            want_cover: true,
+        },
+    )
+    .await?;
+    stream.send.finish()?;
+    let header: AudioHeader = serde_json::from_slice(&read_line(&mut stream.recv).await?)
+        .context("invalid audio response")?;
+    anyhow::ensure!(
+        header.ok,
+        "peer refused audio: {}",
+        header.error.unwrap_or_else(|| "unknown error".to_string())
+    );
+    anyhow::ensure!(
+        header.total_size > 0 && header.total_size <= MAX_AUDIO_BYTES,
+        "invalid federated audio size"
+    );
+    progress(DownloadProgress {
+        phase: "downloading",
+        received: 0,
+        total: header.total_size,
+    });
+    let metadata = header.metadata.context("peer returned no track metadata")?;
+    let cover = read_segment(
+        &mut stream.recv,
+        header.cover_size,
+        &header.cover_mime,
+        "cover",
+    )
+    .await?;
+    let artist_image = read_segment(
+        &mut stream.recv,
+        header.artist_image_size,
+        &header.artist_image_mime,
+        "artist image",
+    )
+    .await?;
+
+    let stem = content_id.trim_start_matches("b3:");
+    let extension = audio_extension(&header.mime_type);
+    let final_path = dir.join(format!("{stem}.{extension}"));
+    let part_path = dir.join(format!(".{stem}.{extension}.part"));
+    let mut file = tokio::fs::File::create(&part_path).await?;
+    let mut hasher = blake3::Hasher::new();
+    let mut received = 0u64;
+    let mut buf = vec![0u8; 64 * 1024];
+    while received < header.total_size {
+        let remaining = (header.total_size - received).min(buf.len() as u64) as usize;
+        let count = stream.recv.read(&mut buf[..remaining]).await?.unwrap_or(0);
+        anyhow::ensure!(count > 0, "audio stream ended early");
+        file.write_all(&buf[..count]).await?;
+        hasher.update(&buf[..count]);
+        received += count as u64;
+        progress(DownloadProgress {
+            phase: "downloading",
+            received,
+            total: header.total_size,
+        });
+    }
+    file.flush().await?;
+    drop(file);
+    let actual = format!("b3:{}", hasher.finalize().to_hex());
+    progress(DownloadProgress {
+        phase: "verifying",
+        received,
+        total: header.total_size,
+    });
+    if actual != content_id {
+        let _ = tokio::fs::remove_file(&part_path).await;
+        anyhow::bail!("downloaded audio content id mismatch");
+    }
+    tokio::fs::rename(&part_path, &final_path).await?;
+    Ok(Downloaded {
+        path: final_path,
+        mime: header.mime_type,
+        metadata,
+        cover,
+        artist_image,
+    })
+}
+
+async fn materialize(
+    pool: &sqlx::PgPool,
+    storage_root: &Path,
+    content_id: &str,
+    downloaded: Downloaded,
+) -> Result<i64> {
+    if let Some(track_id) = local_track_id(pool, content_id).await? {
+        return Ok(track_id);
+    }
+    let bytes = tokio::fs::read(&downloaded.path).await?;
+    let sha256 = format!("{:x}", Sha256::digest(&bytes));
+    let relative = downloaded
+        .path
+        .strip_prefix(storage_root)
+        .unwrap_or(&downloaded.path)
+        .to_string_lossy()
+        .into_owned();
+    let mut tx = pool.begin().await?;
+    let existing_media: Option<i64> = sqlx::query_scalar(
+        "SELECT id FROM furumusic__media_file
+          WHERE file_type = 'audio' AND sha256_hash = $1 LIMIT 1",
+    )
+    .bind(&sha256)
+    .fetch_optional(&mut *tx)
+    .await?;
+    let media_id = match existing_media {
+        Some(id) => id,
+        None => {
+            sqlx::query_scalar(
+                "INSERT INTO furumusic__media_file
+                    (file_type, file_path, original_filename, mime_type,
+                     file_size_bytes, sha256_hash, audio_format,
+                     uploaded_by_user_id, uploader_name, created_at)
+                 VALUES ('audio', $1, $2, $3, $4, $5, $6, NULL, 'Federation', $7)
+                 RETURNING id",
+            )
+            .bind(&relative)
+            .bind(
+                downloaded
+                    .path
+                    .file_name()
+                    .and_then(|name| name.to_str())
+                    .unwrap_or("federated-audio"),
+            )
+            .bind(&downloaded.mime)
+            .bind(bytes.len() as i64)
+            .bind(&sha256)
+            .bind(audio_extension(&downloaded.mime))
+            .bind(now_iso())
+            .fetch_one(&mut *tx)
+            .await?
+        }
+    };
+    sqlx::query(
+        "INSERT INTO furumusic__federation_content_id_cache
+            (media_file_id, sha256_hash, content_id, updated_at)
+         VALUES ($1, $2, $3, $4)
+         ON CONFLICT (media_file_id) DO UPDATE SET
+            sha256_hash = EXCLUDED.sha256_hash,
+            content_id = EXCLUDED.content_id,
+            updated_at = EXCLUDED.updated_at",
+    )
+    .bind(media_id)
+    .bind(&sha256)
+    .bind(content_id)
+    .bind(now_iso())
+    .execute(&mut *tx)
+    .await?;
+    if let Some(track_id) = sqlx::query_scalar::<_, i64>(
+        "SELECT id FROM furumusic__track WHERE audio_file_id = $1 LIMIT 1",
+    )
+    .bind(media_id)
+    .fetch_optional(&mut *tx)
+    .await?
+    {
+        tx.commit().await?;
+        return Ok(track_id);
+    }
+
+    let release_title = nonempty(&downloaded.metadata.release_title).unwrap_or("Unknown release");
+    let release_sort = music_dht::normalize_name(release_title);
+    let release_id: i64 = if let Some(id) = sqlx::query_scalar(
+        "SELECT id FROM furumusic__release
+          WHERE title_sort = $1 AND year IS NOT DISTINCT FROM $2
+          ORDER BY id LIMIT 1",
+    )
+    .bind(&release_sort)
+    .bind(downloaded.metadata.year)
+    .fetch_optional(&mut *tx)
+    .await?
+    {
+        id
+    } else {
+        sqlx::query_scalar(
+            "INSERT INTO furumusic__release
+                (title, title_sort, release_type, year, is_hidden, model_name,
+                 created_at, updated_at)
+             VALUES ($1, $2, $3, $4, false, NULL, $5, $5)
+             RETURNING id",
+        )
+        .bind(release_title)
+        .bind(&release_sort)
+        .bind(
+            downloaded
+                .metadata
+                .release_type
+                .as_deref()
+                .unwrap_or("album"),
+        )
+        .bind(downloaded.metadata.year)
+        .bind(now_iso())
+        .fetch_one(&mut *tx)
+        .await?
+    };
+    let duration: f64 = sqlx::query_scalar(
+        "SELECT COALESCE(duration_seconds, 0)
+           FROM furumusic__track_ref WHERE content_id = $1",
+    )
+    .bind(content_id)
+    .fetch_optional(&mut *tx)
+    .await?
+    .unwrap_or(0.0);
+    let track_id: i64 = sqlx::query_scalar(
+        "INSERT INTO furumusic__track
+            (title, title_sort, release_id, track_number, disc_number,
+             duration_seconds, audio_file_id, year, is_hidden, model_name,
+             created_at, updated_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, false, NULL, $9, $9)
+         RETURNING id",
+    )
+    .bind(&downloaded.metadata.title)
+    .bind(music_dht::normalize_name(&downloaded.metadata.title))
+    .bind(release_id)
+    .bind(downloaded.metadata.track_number)
+    .bind(downloaded.metadata.disc_number)
+    .bind(duration)
+    .bind(media_id)
+    .bind(downloaded.metadata.year)
+    .bind(now_iso())
+    .fetch_one(&mut *tx)
+    .await?;
+
+    let main_artists = if downloaded.metadata.artists.is_empty() {
+        &downloaded.metadata.album_artists
+    } else {
+        &downloaded.metadata.artists
+    };
+    let mut main_artist_ids = Vec::new();
+    for (position, name) in main_artists.iter().enumerate() {
+        let artist_id = ensure_artist(&mut tx, name).await?;
+        main_artist_ids.push(artist_id);
+        link_track_artist(&mut tx, track_id, artist_id, "main", position as i32).await?;
+        link_release_artist(&mut tx, release_id, artist_id, position as i32).await?;
+    }
+    for (position, name) in downloaded.metadata.featured_artists.iter().enumerate() {
+        let artist_id = ensure_artist(&mut tx, name).await?;
+        link_track_artist(&mut tx, track_id, artist_id, "featuring", position as i32).await?;
+    }
+    sqlx::query(
+        "UPDATE furumusic__track_ref
+            SET local_track_id = $2, metadata_authority = 'federation', updated_at = $3
+          WHERE content_id = $1",
+    )
+    .bind(content_id)
+    .bind(track_id)
+    .bind(now_iso())
+    .execute(&mut *tx)
+    .await?;
+    sqlx::query(
+        "UPDATE furumusic__fed_state_like
+            SET local_track_id = $2 WHERE content_id = $1",
+    )
+    .bind(content_id)
+    .bind(track_id)
+    .execute(&mut *tx)
+    .await?;
+    sqlx::query(
+        "UPDATE furumusic__fed_state_playlist_item
+            SET local_track_id = $2 WHERE content_id = $1",
+    )
+    .bind(content_id)
+    .bind(track_id)
+    .execute(&mut *tx)
+    .await?;
+    tx.commit().await?;
+    super::devices::materialize_content_state(pool, content_id, track_id).await?;
+
+    // Artwork is non-authoritative for identity and may be installed after
+    // the audio transaction. Failure does not invalidate a verified track.
+    if let Some((bytes, mime)) = downloaded.cover
+        && let Err(err) =
+            install_release_artwork(pool, storage_root, release_id, &bytes, &mime).await
+    {
+        tracing::warn!(
+            release_id,
+            "failed to install federated release artwork: {err:#}"
+        );
+    }
+    if let Some((bytes, mime)) = downloaded.artist_image
+        && let Err(err) =
+            install_artist_artwork(pool, storage_root, &main_artist_ids, &bytes, &mime).await
+    {
+        tracing::warn!("failed to install federated artist artwork: {err:#}");
+    }
+    Ok(track_id)
+}
+
+async fn install_release_artwork(
+    pool: &sqlx::PgPool,
+    storage_root: &Path,
+    release_id: i64,
+    bytes: &[u8],
+    mime: &str,
+) -> Result<()> {
+    let media_id = persist_artwork(pool, storage_root, bytes, mime).await?;
+    sqlx::query(
+        "UPDATE furumusic__release
+            SET cover_file_id = $1, updated_at = $3
+          WHERE id = $2 AND cover_file_id IS NULL",
+    )
+    .bind(media_id)
+    .bind(release_id)
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn install_artist_artwork(
+    pool: &sqlx::PgPool,
+    storage_root: &Path,
+    artist_ids: &[i64],
+    bytes: &[u8],
+    mime: &str,
+) -> Result<()> {
+    if artist_ids.is_empty() {
+        return Ok(());
+    }
+    let media_id = persist_artwork(pool, storage_root, bytes, mime).await?;
+    sqlx::query(
+        "UPDATE furumusic__artist
+            SET image_file_id = $1, updated_at = $3
+          WHERE id = ANY($2) AND image_file_id IS NULL",
+    )
+    .bind(media_id)
+    .bind(artist_ids)
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn persist_artwork(
+    pool: &sqlx::PgPool,
+    storage_root: &Path,
+    bytes: &[u8],
+    mime: &str,
+) -> Result<i64> {
+    anyhow::ensure!(!bytes.is_empty() && bytes.len() as u64 <= MAX_IMAGE_BYTES);
+    anyhow::ensure!(mime.starts_with("image/"), "invalid artwork mime type");
+    let hash = format!("{:x}", Sha256::digest(bytes));
+    if let Some(id) = sqlx::query_scalar(
+        "SELECT id FROM furumusic__media_file
+          WHERE file_type = 'cover_art' AND sha256_hash = $1 LIMIT 1",
+    )
+    .bind(&hash)
+    .fetch_optional(pool)
+    .await?
+    {
+        return Ok(id);
+    }
+    let extension = image_extension(mime);
+    let filename = format!("federation-artwork-{}.{}", &hash[..16], extension);
+    let dir = storage_root.join("federation").join("artwork");
+    tokio::fs::create_dir_all(&dir).await?;
+    let path = dir.join(&filename);
+    tokio::fs::write(&path, bytes).await?;
+    let relative = path
+        .strip_prefix(storage_root)
+        .unwrap_or(&path)
+        .to_string_lossy()
+        .into_owned();
+    let id = sqlx::query_scalar(
+        "INSERT INTO furumusic__media_file
+            (file_type, file_path, original_filename, mime_type,
+             file_size_bytes, sha256_hash, uploaded_by_user_id,
+             uploader_name, created_at)
+         VALUES ('cover_art', $1, $2, $3, $4, $5, NULL, 'Federation', $6)
+         RETURNING id",
+    )
+    .bind(&relative)
+    .bind(&filename)
+    .bind(mime)
+    .bind(bytes.len() as i64)
+    .bind(&hash)
+    .bind(now_iso())
+    .fetch_one(pool)
+    .await?;
+    if let Err(err) = crate::agent::cover_variants::ensure_cover_variants(&path).await {
+        tracing::warn!(
+            media_id = id,
+            "failed to generate federated artwork variants: {err}"
+        );
+    }
+    Ok(id)
+}
+
+fn image_extension(mime: &str) -> &'static str {
+    match mime {
+        "image/png" => "png",
+        "image/webp" => "webp",
+        "image/gif" => "gif",
+        "image/avif" => "avif",
+        _ => "jpg",
+    }
+}
+
+async fn ensure_artist(tx: &mut sqlx::Transaction<'_, sqlx::Postgres>, name: &str) -> Result<i64> {
+    let normalized = music_dht::normalize_name(name);
+    if let Some(id) = sqlx::query_scalar(
+        "SELECT id FROM furumusic__artist WHERE name_sort = $1 ORDER BY id LIMIT 1",
+    )
+    .bind(&normalized)
+    .fetch_optional(&mut **tx)
+    .await?
+    {
+        return Ok(id);
+    }
+    Ok(sqlx::query_scalar(
+        "INSERT INTO furumusic__artist
+            (name, name_sort, is_hidden, model_name, created_at, updated_at)
+         VALUES ($1, $2, false, NULL, $3, $3) RETURNING id",
+    )
+    .bind(name)
+    .bind(normalized)
+    .bind(now_iso())
+    .fetch_one(&mut **tx)
+    .await?)
+}
+
+async fn link_track_artist(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    track_id: i64,
+    artist_id: i64,
+    role: &str,
+    position: i32,
+) -> Result<()> {
+    sqlx::query(
+        "INSERT INTO furumusic__track_artist
+            (track_id, artist_id, role, position) VALUES ($1, $2, $3, $4)",
+    )
+    .bind(track_id)
+    .bind(artist_id)
+    .bind(role)
+    .bind(position)
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+async fn link_release_artist(
+    tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
+    release_id: i64,
+    artist_id: i64,
+    position: i32,
+) -> Result<()> {
+    sqlx::query(
+        "INSERT INTO furumusic__release_artist
+            (release_id, artist_id, position)
+         SELECT $1, $2, $3 WHERE NOT EXISTS (
+            SELECT 1 FROM furumusic__release_artist
+             WHERE release_id = $1 AND artist_id = $2
+         )",
+    )
+    .bind(release_id)
+    .bind(artist_id)
+    .bind(position)
+    .execute(&mut **tx)
+    .await?;
+    Ok(())
+}
+
+async fn local_track_id(pool: &sqlx::PgPool, content_id: &str) -> Result<Option<i64>> {
+    Ok(sqlx::query_scalar(
+        "SELECT t.id
+           FROM furumusic__federation_content_id_cache c
+           JOIN furumusic__track t ON t.audio_file_id = c.media_file_id
+          WHERE c.content_id = $1 AND t.is_hidden = false LIMIT 1",
+    )
+    .bind(content_id)
+    .fetch_optional(pool)
+    .await?)
+}
+
+async fn read_line<R: AsyncRead + Unpin>(reader: &mut R) -> Result<Vec<u8>> {
+    let mut line = Vec::new();
+    let mut byte = [0u8; 1];
+    loop {
+        anyhow::ensure!(
+            reader.read_exact(&mut byte).await.is_ok(),
+            "stream ended early"
+        );
+        if byte[0] == b'\n' {
+            return Ok(line);
+        }
+        line.push(byte[0]);
+        anyhow::ensure!(line.len() <= MAX_LINE, "protocol line too large");
+    }
+}
+
+async fn write_line<W: AsyncWrite + Unpin>(writer: &mut W, value: &impl Serialize) -> Result<()> {
+    let mut line = serde_json::to_vec(value)?;
+    line.push(b'\n');
+    writer.write_all(&line).await?;
+    Ok(())
+}
+
+async fn read_segment<R: AsyncRead + Unpin>(
+    reader: &mut R,
+    size: u64,
+    mime: &str,
+    label: &str,
+) -> Result<Option<(Vec<u8>, String)>> {
+    if size == 0 {
+        return Ok(None);
+    }
+    anyhow::ensure!(size <= MAX_IMAGE_BYTES, "{label} is too large");
+    let mut bytes = vec![0u8; size as usize];
+    reader.read_exact(&mut bytes).await?;
+    Ok(Some((bytes, mime.to_owned())))
+}
+
+fn audio_extension(mime: &str) -> &'static str {
+    match mime {
+        "audio/mpeg" => "mp3",
+        "audio/flac" => "flac",
+        "audio/ogg" => "ogg",
+        "audio/opus" => "opus",
+        "audio/wav" => "wav",
+        "audio/mp4" => "m4a",
+        "audio/aac" => "aac",
+        _ => "bin",
+    }
+}
+
+fn nonempty(value: &str) -> Option<&str> {
+    (!value.trim().is_empty()).then_some(value.trim())
+}

src/federation/serve.rs

@@ -3,18 +3,24 @@
 //! with the furumi TUI client and any other furumi peer.
 
 use std::path::{Path, PathBuf};
+use std::sync::Arc;
 
 use anyhow::Result;
-use music_dht::{ByteStream, EndpointId, ItemId, ItemKind, StreamAcceptor};
+pub use music_dht::catalog::CATALOG_ALPN;
+use music_dht::catalog::{
+    CatalogArtist, CatalogArtistPreview, CatalogImageHeader as ImageHeader, CatalogRelease,
+    CatalogRequest, CatalogResponse, CatalogTrack,
+};
+use music_dht::{ByteStream, EndpointId, ItemId, ItemKind, StreamAcceptor, normalize_name};
 use serde::{Deserialize, Serialize};
 use sqlx::PgPool;
 use sqlx::Row as _;
 use tokio::io::{AsyncRead, AsyncReadExt, AsyncSeekExt, AsyncWriteExt};
 
+use super::{TransportStats, record_stream_transport};
+
 /// ALPN of the peer-to-peer audio streaming protocol.
 pub const AUDIO_ALPN: &[u8] = b"furumi-fd/audio/1";
-/// ALPN of the per-artist catalog protocol.
-pub const CATALOG_ALPN: &[u8] = b"furumi-fd/catalog/1";
 
 /// Maximum size of a JSON protocol line (request or response header).
 const MAX_PROTOCOL_LINE: usize = 4096;
@@ -63,58 +69,6 @@ struct TrackMetadata {
     disc_number: Option<i32>,
 }
 
-#[derive(Debug, Deserialize)]
-struct CatalogRequest {
-    artist: String,
-    #[serde(default)]
-    want: Option<String>,
-    #[serde(default)]
-    release: Option<String>,
-}
-
-#[derive(Debug, Default, Serialize)]
-struct CatalogResponse {
-    ok: bool,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    error: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    artist: Option<CatalogArtist>,
-}
-
-#[derive(Debug, Default, Serialize)]
-struct CatalogArtist {
-    name: String,
-    releases: Vec<CatalogRelease>,
-}
-
-#[derive(Debug, Default, Serialize)]
-struct CatalogRelease {
-    title: String,
-    release_type: String,
-    year: Option<i32>,
-    tracks: Vec<CatalogTrack>,
-}
-
-#[derive(Debug, Default, Serialize)]
-struct CatalogTrack {
-    title: String,
-    track_number: Option<i32>,
-    disc_number: Option<i32>,
-    duration_seconds: Option<f64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    content_id: Option<String>,
-    item_id: String,
-}
-
-#[derive(Debug, Default, Serialize)]
-struct ImageHeader {
-    ok: bool,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    error: Option<String>,
-    mime_type: String,
-    size: u64,
-}
-
 // ---------------------------------------------------------------------------
 // Framing helpers
 // ---------------------------------------------------------------------------
@@ -274,6 +228,31 @@ async fn track_artist_image_file(pool: &PgPool, track_id: i64) -> Result<Option<
     Ok(row.map(|row| (row.get(0), row.get(1))))
 }
 
+async fn track_catalog_artist_names(
+    pool: &PgPool,
+    track_id: i64,
+) -> Result<(Vec<String>, Vec<String>)> {
+    let mut artists = Vec::new();
+    let mut featured = Vec::new();
+    let rows = sqlx::query(
+        "SELECT a.name, ta.role FROM furumusic__track_artist ta
+         JOIN furumusic__artist a ON a.id = ta.artist_id
+         WHERE ta.track_id = $1 ORDER BY ta.position",
+    )
+    .bind(track_id)
+    .fetch_all(pool)
+    .await?;
+    for row in rows {
+        let name: String = row.get(0);
+        match row.get::<String, _>(1).as_str() {
+            "featuring" => featured.push(name),
+            "main" => artists.push(name),
+            _ => {}
+        }
+    }
+    Ok((artists, featured))
+}
+
 async fn track_metadata(pool: &PgPool, track_id: i64) -> Result<Option<TrackMetadata>> {
     let Some(track) = sqlx::query(
         "SELECT t.title, t.track_number, t.disc_number, COALESCE(t.year, r.year),
@@ -344,13 +323,16 @@ pub async fn serve_audio(
     pool: PgPool,
     storage_dir: String,
     own: EndpointId,
+    transport_stats: Arc<TransportStats>,
 ) {
     while let Some(stream) = acceptor.accept().await {
         let pool = pool.clone();
         let storage_dir = storage_dir.clone();
+        let transport_stats = Arc::clone(&transport_stats);
         tokio::spawn(async move {
             let peer = stream.peer_id;
-            if let Err(err) = serve_audio_one(stream, pool, storage_dir, own).await {
+            if let Err(err) = serve_audio_one(stream, pool, storage_dir, own, transport_stats).await
+            {
                 tracing::warn!(peer = %peer, "federation audio stream failed: {err:#}");
             }
         });
@@ -362,7 +344,9 @@ async fn serve_audio_one(
     pool: PgPool,
     storage_dir: String,
     own: EndpointId,
+    transport_stats: Arc<TransportStats>,
 ) -> Result<()> {
+    record_stream_transport(&transport_stats, "audio", "inbound", "open", &stream);
     let request: AudioRequest = serde_json::from_slice(&read_line(&mut stream.recv).await?)?;
     tracing::info!(
         peer = %stream.peer_id,
@@ -465,6 +449,7 @@ async fn serve_audio_one(
     // Wait until the peer read everything before dropping the stream,
     // otherwise the tail of the file is lost.
     let _ = stream.send.stopped().await;
+    record_stream_transport(&transport_stats, "audio", "inbound", "done", &stream);
     Ok(())
 }
 
@@ -493,13 +478,17 @@ pub async fn serve_catalog(
     pool: PgPool,
     storage_dir: String,
     own: EndpointId,
+    transport_stats: Arc<TransportStats>,
 ) {
     while let Some(stream) = acceptor.accept().await {
         let pool = pool.clone();
         let storage_dir = storage_dir.clone();
+        let transport_stats = Arc::clone(&transport_stats);
         tokio::spawn(async move {
             let peer = stream.peer_id;
-            if let Err(err) = serve_catalog_one(stream, pool, storage_dir, own).await {
+            if let Err(err) =
+                serve_catalog_one(stream, pool, storage_dir, own, transport_stats).await
+            {
                 tracing::warn!(peer = %peer, "federation catalog request failed: {err:#}");
             }
         });
@@ -511,7 +500,9 @@ async fn serve_catalog_one(
     pool: PgPool,
     storage_dir: String,
     own: EndpointId,
+    transport_stats: Arc<TransportStats>,
 ) -> Result<()> {
+    record_stream_transport(&transport_stats, "catalog", "inbound", "open", &stream);
     let request: CatalogRequest = serde_json::from_slice(&read_line(&mut stream.recv).await?)?;
     tracing::info!(
         peer = %stream.peer_id,
@@ -527,7 +518,23 @@ async fn serve_catalog_one(
                 Err(err) => CatalogResponse {
                     ok: false,
                     error: Some(format!("catalog lookup failed: {err:#}")),
-                    artist: None,
+                    ..CatalogResponse::default()
+                },
+            };
+            stream
+                .send
+                .write_all(&serde_json::to_vec(&response)?)
+                .await?;
+        }
+        Some("artists") => {
+            let cursor = request.cursor.clone();
+            let limit = request.limit.unwrap_or(64).clamp(1, 200);
+            let response = match build_artist_slice(&pool, cursor, limit).await {
+                Ok(response) => response,
+                Err(err) => CatalogResponse {
+                    ok: false,
+                    error: Some(format!("artist slice lookup failed: {err:#}")),
+                    ..CatalogResponse::default()
                 },
             };
             stream
@@ -569,7 +576,7 @@ async fn serve_catalog_one(
             let response = CatalogResponse {
                 ok: false,
                 error: Some(format!("unknown request kind '{other}'")),
-                artist: None,
+                ..CatalogResponse::default()
             };
             stream
                 .send
@@ -579,6 +586,7 @@ async fn serve_catalog_one(
     }
     stream.send.finish()?;
     let _ = stream.send.stopped().await;
+    record_stream_transport(&transport_stats, "catalog", "inbound", "done", &stream);
     Ok(())
 }
 
@@ -595,7 +603,7 @@ async fn build_catalog(pool: &PgPool, own: &EndpointId, artist: &str) -> Result<
         return Ok(CatalogResponse {
             ok: false,
             error: Some("artist not found in the library".to_string()),
-            artist: None,
+            ..CatalogResponse::default()
         });
     };
     let artist_id: i64 = artist_row.get(0);
@@ -630,8 +638,11 @@ async fn build_catalog(pool: &PgPool, own: &EndpointId, artist: &str) -> Result<
         for row in track_rows {
             let track_id: i64 = row.get(0);
             let duration: f64 = row.get(4);
+            let (artists, featured_artists) = track_catalog_artist_names(pool, track_id).await?;
             tracks.push(CatalogTrack {
                 title: row.get(1),
+                artists,
+                featured_artists,
                 track_number: row.get(2),
                 disc_number: row.get(3),
                 duration_seconds: (duration > 0.0).then_some(duration),
@@ -649,11 +660,82 @@ async fn build_catalog(pool: &PgPool, own: &EndpointId, artist: &str) -> Result<
 
     Ok(CatalogResponse {
         ok: true,
-        error: None,
         artist: Some(CatalogArtist {
             name: artist_row.get(1),
             releases,
+            appears_on: Vec::new(),
         }),
+        ..CatalogResponse::default()
+    })
+}
+
+async fn build_artist_slice(
+    pool: &PgPool,
+    cursor: Option<String>,
+    limit: usize,
+) -> Result<CatalogResponse> {
+    let offset = cursor
+        .as_deref()
+        .and_then(|value| value.parse::<i64>().ok())
+        .unwrap_or(0)
+        .max(0);
+    let rows = sqlx::query(
+        r#"SELECT a.name::text AS name,
+                  mf.file_path::text AS image_path,
+                  COALESCE(s.release_count, 0)::bigint AS release_count,
+                  COALESCE(s.track_count, 0)::bigint AS track_count
+           FROM furumusic__artist a
+           LEFT JOIN furumusic__media_file mf ON mf.id = a.image_file_id
+           LEFT JOIN (
+               SELECT appearance.artist_id,
+                      COUNT(DISTINCT appearance.release_id) FILTER (WHERE appearance.is_primary_release_artist) AS release_count,
+                      COUNT(DISTINCT appearance.track_id) AS track_count
+                 FROM (
+                        SELECT ta.artist_id,
+                               t.id AS track_id,
+                               r.id AS release_id,
+                               primary_release.artist_id IS NOT NULL AS is_primary_release_artist
+                          FROM furumusic__track_artist ta
+                          JOIN furumusic__track t ON t.id = ta.track_id AND t.is_hidden = false
+                          JOIN furumusic__release r ON r.id = t.release_id AND r.is_hidden = false
+                          LEFT JOIN furumusic__release_artist primary_release
+                            ON primary_release.release_id = r.id
+                           AND primary_release.artist_id = ta.artist_id
+                           AND primary_release.position = 0
+                      ) appearance
+                GROUP BY appearance.artist_id
+           ) s ON s.artist_id = a.id
+           WHERE a.is_hidden = false
+             AND COALESCE(s.track_count, 0) > 0
+           ORDER BY (COALESCE(s.release_count, 0) > 0) DESC,
+                    COALESCE(s.release_count, 0) DESC,
+                    COALESCE(s.track_count, 0) DESC,
+                    a.name_sort
+           LIMIT $1 OFFSET $2"#,
+    )
+    .bind(limit as i64 + 1)
+    .bind(offset)
+    .fetch_all(pool)
+    .await?;
+
+    let mut artists = Vec::with_capacity(rows.len().min(limit));
+    let has_more = rows.len() > limit;
+    for row in rows.into_iter().take(limit) {
+        let name: String = row.get(0);
+        artists.push(CatalogArtistPreview {
+            artist_key: normalize_name(&name),
+            name,
+            image_path: row.get(1),
+            release_count: row.get(2),
+            track_count: row.get(3),
+        });
+    }
+    let next_cursor = has_more.then(|| (offset + artists.len() as i64).to_string());
+    Ok(CatalogResponse {
+        ok: true,
+        artists,
+        next_cursor,
+        ..CatalogResponse::default()
     })
 }
 

src/i18n/phrases.rs

@@ -309,6 +309,7 @@ translations! {
     player_cancel:           "Cancel"                          , "Отмена";
     player_create:           "Create"                          , "Создать";
     player_save:             "Save"                            , "Сохранить";
+    player_done:             "Done"                            , "Готово";
     player_delete:           "Delete"                          , "Удалить";
     player_delete_playlist_confirm: "Delete this playlist?"     , "Удалить этот плейлист?";
     player_rename:           "Rename"                          , "Переименовать";

src/music/mod.rs

@@ -1951,6 +1951,377 @@ pub mod db_migrations {
             &[Operation::custom(create_playlist_share_links).build()];
     }
 
+    #[cot::db::migrations::migration_op]
+    async fn create_fed_device_sync(ctx: migrations::MigrationContext<'_>) -> cot::db::Result<()> {
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__federation_content_id_cache (
+                    media_file_id BIGINT PRIMARY KEY,
+                    sha256_hash TEXT NOT NULL,
+                    content_id TEXT NOT NULL,
+                    updated_at TEXT NOT NULL
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_furumusic_federation_content_id_cache_content_id
+                   ON furumusic__federation_content_id_cache (content_id)",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__fed_device_identity (
+                    user_id BIGINT PRIMARY KEY,
+                    device_id TEXT NOT NULL UNIQUE,
+                    group_id TEXT NOT NULL,
+                    device_name TEXT NOT NULL,
+                    local_seq BIGINT NOT NULL DEFAULT 0,
+                    last_hlc_ms BIGINT NOT NULL DEFAULT 0,
+                    local_seeded_at_ms BIGINT NOT NULL DEFAULT 0,
+                    last_sync TEXT,
+                    last_error TEXT
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__fed_device (
+                    user_id BIGINT NOT NULL,
+                    device_id TEXT NOT NULL,
+                    name TEXT NOT NULL DEFAULT '',
+                    client_version TEXT NOT NULL DEFAULT '',
+                    protocol_version INTEGER NOT NULL DEFAULT 1,
+                    endpoint_id TEXT NOT NULL DEFAULT '',
+                    endpoint_ticket TEXT NOT NULL DEFAULT '',
+                    trusted_at_ms BIGINT,
+                    last_seen_ms BIGINT,
+                    revoked_at_ms BIGINT,
+                    revoked_by TEXT,
+                    revoke_cutoff_seq BIGINT,
+                    PRIMARY KEY (user_id, device_id)
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE UNIQUE INDEX IF NOT EXISTS idx_fed_device_single_user
+                   ON furumusic__fed_device (device_id)
+                 WHERE trusted_at_ms IS NOT NULL",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__fed_device_invite (
+                    invite_id TEXT PRIMARY KEY,
+                    user_id BIGINT NOT NULL,
+                    secret_hash TEXT NOT NULL,
+                    expires_at_ms BIGINT NOT NULL,
+                    created_at_ms BIGINT NOT NULL,
+                    used_at_ms BIGINT
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__fed_pending_pairing (
+                    request_id TEXT PRIMARY KEY,
+                    user_id BIGINT NOT NULL,
+                    device_id TEXT NOT NULL,
+                    name TEXT NOT NULL,
+                    client_version TEXT NOT NULL,
+                    endpoint_id TEXT NOT NULL,
+                    endpoint_ticket TEXT NOT NULL,
+                    invite_id TEXT NOT NULL,
+                    created_at_ms BIGINT NOT NULL,
+                    answered_at_ms BIGINT,
+                    status TEXT NOT NULL,
+                    requester_group_id TEXT,
+                    requester_group_active_devices BIGINT NOT NULL DEFAULT 1,
+                    requester_group_devices_json TEXT NOT NULL DEFAULT '[]',
+                    use_requester_group BOOLEAN NOT NULL DEFAULT false
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_fed_pending_pairing_user_status
+                   ON furumusic__fed_pending_pairing (user_id, status, created_at_ms DESC)",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__fed_sync_ops (
+                    user_id BIGINT NOT NULL,
+                    op_id TEXT NOT NULL,
+                    origin_device_id TEXT NOT NULL,
+                    seq BIGINT NOT NULL,
+                    kind TEXT NOT NULL,
+                    payload_json JSONB NOT NULL,
+                    hlc_ms BIGINT NOT NULL,
+                    received_at_ms BIGINT NOT NULL,
+                    tombstone BOOLEAN NOT NULL DEFAULT false,
+                    PRIMARY KEY (user_id, op_id)
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_fed_sync_ops_origin_seq
+                   ON furumusic__fed_sync_ops (user_id, origin_device_id, seq)",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_fed_sync_ops_tombstone
+                   ON furumusic__fed_sync_ops (user_id, tombstone)",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__fed_sync_vector (
+                    user_id BIGINT NOT NULL,
+                    device_id TEXT NOT NULL,
+                    max_seq BIGINT NOT NULL,
+                    PRIMARY KEY (user_id, device_id)
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__fed_peer_ack (
+                    user_id BIGINT NOT NULL,
+                    peer_device_id TEXT NOT NULL,
+                    origin_device_id TEXT NOT NULL,
+                    max_seq BIGINT NOT NULL,
+                    updated_at_ms BIGINT NOT NULL,
+                    PRIMARY KEY (user_id, peer_device_id, origin_device_id)
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__fed_state_like (
+                    user_id BIGINT NOT NULL,
+                    content_id TEXT NOT NULL,
+                    liked BOOLEAN NOT NULL,
+                    hlc_ms BIGINT NOT NULL,
+                    op_id TEXT NOT NULL,
+                    local_track_id BIGINT,
+                    fed_json JSONB,
+                    PRIMARY KEY (user_id, content_id)
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__fed_state_playlist (
+                    user_id BIGINT NOT NULL,
+                    playlist_id TEXT NOT NULL,
+                    local_playlist_id BIGINT,
+                    title TEXT NOT NULL,
+                    deleted BOOLEAN NOT NULL DEFAULT false,
+                    hlc_ms BIGINT NOT NULL,
+                    op_id TEXT NOT NULL,
+                    PRIMARY KEY (user_id, playlist_id)
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE UNIQUE INDEX IF NOT EXISTS idx_fed_state_playlist_local
+                   ON furumusic__fed_state_playlist (user_id, local_playlist_id)
+                 WHERE local_playlist_id IS NOT NULL",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__fed_state_playlist_item (
+                    user_id BIGINT NOT NULL,
+                    playlist_id TEXT NOT NULL,
+                    content_id TEXT NOT NULL,
+                    present BOOLEAN NOT NULL DEFAULT true,
+                    position BIGINT NOT NULL DEFAULT 0,
+                    hlc_ms BIGINT NOT NULL,
+                    op_id TEXT NOT NULL,
+                    local_track_id BIGINT,
+                    fed_json JSONB,
+                    PRIMARY KEY (user_id, playlist_id, content_id)
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_fed_state_playlist_item_playlist
+                   ON furumusic__fed_state_playlist_item
+                      (user_id, playlist_id, present, position)",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__fed_playback_applied (
+                    user_id BIGINT NOT NULL,
+                    op_id TEXT NOT NULL,
+                    applied_at_ms BIGINT NOT NULL,
+                    PRIMARY KEY (user_id, op_id)
+                )",
+            )
+            .await?;
+        Ok(())
+    }
+
+    #[derive(Debug, Copy, Clone)]
+    pub struct M0038CreateFedDeviceSync;
+
+    impl migrations::Migration for M0038CreateFedDeviceSync {
+        const APP_NAME: &'static str = "furumusic";
+        const MIGRATION_NAME: &'static str = "m_0038_create_fed_device_sync";
+        const DEPENDENCIES: &'static [migrations::MigrationDependency] =
+            &[migrations::MigrationDependency::migration(
+                "furumusic",
+                "m_0037_create_playlist_share_links",
+            )];
+        const OPERATIONS: &'static [Operation] =
+            &[Operation::custom(create_fed_device_sync).build()];
+    }
+
+    #[cot::db::migrations::migration_op]
+    async fn ensure_federation_content_id_cache(
+        ctx: migrations::MigrationContext<'_>,
+    ) -> cot::db::Result<()> {
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__federation_content_id_cache (
+                    media_file_id BIGINT PRIMARY KEY,
+                    sha256_hash TEXT NOT NULL,
+                    content_id TEXT NOT NULL,
+                    updated_at TEXT NOT NULL
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_furumusic_federation_content_id_cache_content_id
+                   ON furumusic__federation_content_id_cache (content_id)",
+            )
+            .await?;
+        Ok(())
+    }
+
+    #[derive(Debug, Copy, Clone)]
+    pub struct M0039EnsureFederationContentIdCache;
+
+    impl migrations::Migration for M0039EnsureFederationContentIdCache {
+        const APP_NAME: &'static str = "furumusic";
+        const MIGRATION_NAME: &'static str = "m_0039_ensure_federation_content_id_cache";
+        const DEPENDENCIES: &'static [migrations::MigrationDependency] =
+            &[migrations::MigrationDependency::migration(
+                "furumusic",
+                "m_0038_create_fed_device_sync",
+            )];
+        const OPERATIONS: &'static [Operation] =
+            &[Operation::custom(ensure_federation_content_id_cache).build()];
+    }
+
+    #[cot::db::migrations::migration_op]
+    async fn create_content_addressed_music_refs(
+        ctx: migrations::MigrationContext<'_>,
+    ) -> cot::db::Result<()> {
+        // A track reference is durable user-facing identity. `local_track_id`
+        // is availability, not identity: it may become non-NULL after a
+        // federated track is materialized without changing likes/playlists.
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__track_ref (
+                    id BIGSERIAL PRIMARY KEY,
+                    content_id TEXT NOT NULL UNIQUE,
+                    local_track_id BIGINT UNIQUE,
+                    title TEXT NOT NULL,
+                    release_title TEXT,
+                    year INTEGER,
+                    duration_seconds DOUBLE PRECISION,
+                    metadata_json JSONB NOT NULL DEFAULT '{}'::jsonb,
+                    metadata_authority TEXT NOT NULL DEFAULT 'local',
+                    created_at TEXT NOT NULL,
+                    updated_at TEXT NOT NULL
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_track_ref_local_track
+                   ON furumusic__track_ref (local_track_id)
+                 WHERE local_track_id IS NOT NULL",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__federation_track_source (
+                    track_ref_id BIGINT NOT NULL REFERENCES furumusic__track_ref(id)
+                        ON DELETE CASCADE,
+                    owner_peer_id TEXT NOT NULL,
+                    item_id TEXT NOT NULL,
+                    last_seen_ms BIGINT NOT NULL,
+                    metadata_json JSONB NOT NULL DEFAULT '{}'::jsonb,
+                    PRIMARY KEY (owner_peer_id, item_id)
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_federation_track_source_ref
+                   ON furumusic__federation_track_source (track_ref_id, last_seen_ms DESC)",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "ALTER TABLE furumusic__user_liked_track
+                   ADD COLUMN IF NOT EXISTS track_ref_id BIGINT
+                       REFERENCES furumusic__track_ref(id)",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE UNIQUE INDEX IF NOT EXISTS idx_user_liked_track_ref_uniq
+                   ON furumusic__user_liked_track (user_id, track_ref_id)
+                 WHERE track_ref_id IS NOT NULL",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "ALTER TABLE furumusic__playlist_track
+                   ADD COLUMN IF NOT EXISTS track_ref_id BIGINT
+                       REFERENCES furumusic__track_ref(id)",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_playlist_track_ref
+                   ON furumusic__playlist_track (track_ref_id)
+                 WHERE track_ref_id IS NOT NULL",
+            )
+            .await?;
+        // History deliberately remains local-track based. Only the web
+        // player's existing playback report records history and triggers
+        // Last.fm scrobbling.
+        Ok(())
+    }
+
+    #[derive(Debug, Copy, Clone)]
+    pub struct M0040CreateContentAddressedMusicRefs;
+
+    impl migrations::Migration for M0040CreateContentAddressedMusicRefs {
+        const APP_NAME: &'static str = "furumusic";
+        const MIGRATION_NAME: &'static str = "m_0040_create_content_addressed_music_refs";
+        const DEPENDENCIES: &'static [migrations::MigrationDependency] =
+            &[migrations::MigrationDependency::migration(
+                "furumusic",
+                "m_0039_ensure_federation_content_id_cache",
+            )];
+        const OPERATIONS: &'static [Operation] =
+            &[Operation::custom(create_content_addressed_music_refs).build()];
+    }
+
     pub const MIGRATIONS: &[&SyncDynMigration] = &[
         &M0006CreateMediaFile,
         &M0007CreateArtist,
@@ -1979,5 +2350,8 @@ pub mod db_migrations {
         &M0035CreateEntityGenreTags,
         &M0036CreateExternalMetadataIds,
         &M0037CreatePlaylistShareLinks,
+        &M0038CreateFedDeviceSync,
+        &M0039EnsureFederationContentIdCache,
+        &M0040CreateContentAddressedMusicRefs,
     ];
 }

src/player/dto.rs

@@ -51,6 +51,7 @@ pub(super) struct ArtistRef {
 #[derive(Debug, Clone, Serialize, JsonSchema)]
 pub(super) struct TrackItem {
     pub(super) id: i64,
+    pub(super) content_id: Option<String>,
     pub(super) title: String,
     pub(super) track_number: Option<i32>,
     pub(super) disc_number: Option<i32>,
@@ -74,6 +75,13 @@ pub(super) struct TrackItem {
     pub(super) lastfm_updated_at: Option<String>,
 }
 
+#[derive(Debug, Serialize, JsonSchema)]
+pub(super) struct PlaylistTrackItem {
+    pub(super) playlist_track_id: Option<i64>,
+    #[serde(flatten)]
+    pub(super) track: TrackItem,
+}
+
 #[derive(Debug, Serialize, JsonSchema)]
 pub(super) struct ArtistAppearanceTrack {
     pub(super) id: i64,
@@ -265,6 +273,24 @@ pub(super) struct PlayerDevicesResponse {
     pub(super) playback_state: Option<PlayerDevicePlaybackStateDto>,
 }
 
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct FedDeviceConnectRequest {
+    pub(super) invite: String,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct FedDevicePairingAnswerRequest {
+    pub(super) request_id: String,
+    pub(super) accept: bool,
+    #[serde(default)]
+    pub(super) use_requester_group: bool,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct FedDeviceRevokeRequest {
+    pub(super) device_id: String,
+}
+
 #[derive(Debug, Serialize, JsonSchema)]
 pub(super) struct PlayerDevicePollResponse {
     pub(super) device_id: String,
@@ -286,7 +312,7 @@ pub(super) struct PlaylistDetail {
     pub(super) is_public: bool,
     pub(super) is_saved: bool,
     pub(super) kind: String,
-    pub(super) tracks: Vec<TrackItem>,
+    pub(super) tracks: Vec<PlaylistTrackItem>,
 }
 
 #[derive(Debug, Serialize, JsonSchema)]
@@ -536,6 +562,46 @@ pub(super) struct LikeStatus {
     pub(super) liked: bool,
 }
 
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct ContentTrackMutation {
+    pub(super) content_id: String,
+    pub(super) liked: Option<bool>,
+    pub(super) playlist_id: Option<i64>,
+    pub(super) position: Option<i64>,
+    pub(super) federation: Option<serde_json::Value>,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct PrepareFederatedTrackRequest {
+    pub(super) content_id: String,
+    pub(super) owner: String,
+    pub(super) item_id: String,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct FederationArtworkQuery {
+    pub(super) owner: String,
+    pub(super) item_id: String,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct FederationArtistQuery {
+    pub(super) name: String,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct FederationCatalogArtworkQuery {
+    pub(super) owner: String,
+    pub(super) artist: String,
+    pub(super) release: Option<String>,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct FederationArtworkDiscoveryQuery {
+    pub(super) artist: String,
+    pub(super) release: Option<String>,
+}
+
 #[derive(Debug, Serialize, JsonSchema)]
 pub(super) struct LikedIds {
     pub(super) track_ids: Vec<i64>,

src/player/queries.rs

@@ -42,7 +42,13 @@ pub(super) struct AddTracksRequest {
 
 #[derive(Debug, Deserialize)]
 pub(super) struct RemoveTrackRequest {
-    pub(super) track_id: i64,
+    pub(super) track_id: Option<i64>,
+    pub(super) playlist_track_id: Option<i64>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(super) struct ReorderPlaylistRequest {
+    pub(super) playlist_track_ids: Vec<i64>,
 }
 
 #[derive(Debug, Deserialize)]

src/player/rows.rs

@@ -95,6 +95,7 @@ pub(super) struct PlaylistInfoRow {
 
 #[derive(sqlx::FromRow)]
 pub(super) struct PlaylistTrackRow {
+    pub(super) playlist_track_id: Option<i64>,
     pub(super) id: i64,
     pub(super) title: String,
     pub(super) track_number: Option<i32>,

templates/admin/v2.html

@@ -2293,6 +2293,17 @@ tbody tr:hover {
                                     <input x-model="settingsDraft.federation_network_id" placeholder="my-crew-music-7f3a" autocomplete="off" />
                                     <div class="setting-help">Every peer using the same id finds the others automatically.</div>
                                 </div>
+                                <div class="setting-field">
+                                    <label>
+                                        <span>Save federated tracks on play</span>
+                                        <span class="source-pill" :class="sourceClass('federation_save_on_listen')" x-text="settingSource('federation_save_on_listen')"></span>
+                                    </label>
+                                    <div class="setting-toggle-row">
+                                        <span x-text="settingsDraft.federation_save_on_listen ? 'Import into the shared library' : 'Use temporary cache'"></span>
+                                        <input type="checkbox" x-model="settingsDraft.federation_save_on_listen" />
+                                    </div>
+                                    <div class="setting-help">Server-wide policy. Imported tracks become available to every user and are published by this peer. Federation metadata is trusted and bypasses the AI agent.</div>
+                                </div>
                             </div>
                             <div class="probe-body" x-show="federationStatus.node">
                                 <div class="probe-table" x-show="federationStatus.node && federationStatus.node.running">
@@ -2303,6 +2314,29 @@ tbody tr:hover {
                                     <div class="probe-row"><span>Published items</span><strong x-text="(federationStatus.node && federationStatus.node.published_items) ?? '-'"></strong></div>
                                     <div class="probe-row"><span>Last sync</span><strong x-text="federationStatus.last_sync || 'not yet'"></strong></div>
                                 </div>
+                                <div class="probe-table" x-show="fedTransport().total_samples > 0" style="margin-top:10px">
+                                    <div class="probe-row">
+                                        <span>Transport path</span>
+                                        <strong>
+                                            <span class="badge" :class="fedPathBadge(fedTransport().last_path)" x-text="fedTransport().last_path || 'unknown'"></span>
+                                        </strong>
+                                    </div>
+                                    <div class="probe-row"><span>RTT</span><strong x-text="fedRtt(fedTransport().last_rtt_ms)"></strong></div>
+                                    <div class="probe-row"><span>Path samples</span><strong x-text="`${fedTransport().direct_samples || 0} direct · ${fedTransport().relay_samples || 0} relay · ${fedTransport().custom_samples || 0} custom · ${fedTransport().unknown_samples || 0} unknown`"></strong></div>
+                                    <div class="probe-row"><span>Protocols</span><strong x-text="`${fedTransport().audio_samples || 0} audio · ${fedTransport().catalog_samples || 0} catalog · ${fedTransport().sync_samples || 0} sync`"></strong></div>
+                                    <div class="probe-row"><span>Last peer</span><strong x-text="fedShort(fedTransport().last_peer)"></strong></div>
+                                </div>
+                                <div class="probe-table" x-show="fedTransport().last && fedTransport().last.length" style="margin-top:10px">
+                                    <template x-for="(sample, index) in fedTransport().last.slice(0, 5)" :key="`${sample.at}-${sample.protocol}-${sample.direction}-${sample.phase}-${sample.peer_id}-${index}`">
+                                        <div class="probe-row">
+                                            <span x-text="`${sample.protocol} · ${sample.direction} · ${sample.phase}`"></span>
+                                            <strong>
+                                                <span class="badge" :class="fedPathBadge(sample.selected_path)" x-text="sample.selected_path || 'unknown'"></span>
+                                                <span x-text="` ${fedRtt(sample.selected_rtt_ms)} · tx ${formatBytes(sample.total_tx_bytes || 0)} · rx ${formatBytes(sample.total_rx_bytes || 0)} · lost ${formatBytes(sample.lost_bytes || 0)}`"></span>
+                                            </strong>
+                                        </div>
+                                    </template>
+                                </div>
                                 <p class="probe-intro muted" x-show="federationStatus.last_error" x-text="federationStatus.last_error"></p>
                                 <div class="toolbar" style="margin-top:14px; flex-wrap:wrap; gap:8px">
                                     <button class="btn" type="button" @click="loadFederation()" :disabled="federationLoading">
@@ -2901,7 +2935,8 @@ function adminV2() {
             agent_context_limit: '',
             agent_concurrency: '',
             federation_enabled: false,
-            federation_network_id: ''
+            federation_network_id: '',
+            federation_save_on_listen: false
         },
         settingsProbe: { status: 'idle', ok: false },
         settingsProbeLoading: false,
@@ -3268,6 +3303,21 @@ function adminV2() {
             return id ? `${id.slice(0, 12)}…` : '-';
         },
 
+        fedTransport() {
+            return (this.federationStatus.node && this.federationStatus.node.transport) || {};
+        },
+
+        fedPathBadge(path) {
+            if (path === 'direct') return 'ok';
+            if (path === 'relay') return 'pending';
+            if (path === 'custom') return 'running';
+            return 'disabled';
+        },
+
+        fedRtt(ms) {
+            return ms != null ? `${Math.round(Number(ms))} ms` : '-';
+        },
+
         async loadSettingsProbe(showErrors = true) {
             this.settingsProbeLoading = true;
             try {

templates/player/modals.html

@@ -636,6 +636,144 @@
         </div>
     </template>
 
+    <!-- User Settings Modal -->
+    <template x-if="$store.user.settingsOpen">
+        <div class="modal-overlay" @click.self="$store.user.closeSettings()">
+            <div class="modal-box user-settings-modal">
+                <div class="user-settings-head">
+                    <div>
+                        <h3>User settings</h3>
+                        <p>Personal services, listening history and trusted devices.</p>
+                    </div>
+                    <button class="mobile-list-action" @click="$store.user.closeSettings()" title="{{ t.player_close }}">
+                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                            <line x1="18" y1="6" x2="6" y2="18"/>
+                            <line x1="6" y1="6" x2="18" y2="18"/>
+                        </svg>
+                    </button>
+                </div>
+
+                <section class="user-settings-section">
+                    <div class="user-settings-section-head">
+                        <div>
+                            <h4>Listening history</h4>
+                            <p>Review plays recorded by this web player.</p>
+                        </div>
+                        <button class="settings-secondary-btn" @click="$store.user.openHistoryFromSettings()">Open history</button>
+                    </div>
+                </section>
+
+                <section class="user-settings-section">
+                    <div class="user-settings-section-head">
+                        <div>
+                            <h4>Last.fm</h4>
+                            <p x-text="$store.user.lastfmStatusLabel()"></p>
+                        </div>
+                        <button class="settings-secondary-btn"
+                                :class="$store.user.lastfmClass()"
+                                :disabled="$store.user.lastfmBusy || !$store.user.lastfm?.configured"
+                                @click="$store.user.handleLastfm()"
+                                x-text="$store.user.lastfm?.connected && !$store.user.lastfm?.reauth_required ? 'Disconnect' : 'Connect'"></button>
+                    </div>
+                </section>
+
+                <section class="user-settings-section user-settings-devices">
+                    <div class="user-settings-section-head">
+                        <div>
+                            <h4>Connected devices</h4>
+                            <p x-text="$store.devices.fedSummary()"></p>
+                        </div>
+                        <button class="settings-secondary-btn"
+                                :disabled="$store.devices.fedBusy"
+                                @click="$store.devices.syncFedDevices()">Sync now</button>
+                    </div>
+                    <template x-if="$store.devices.fedError">
+                        <div class="fed-device-error" x-text="$store.devices.fedError"></div>
+                    </template>
+
+                    <div class="settings-device-group">
+                        <div class="settings-device-label">Web player sessions</div>
+                        <template x-for="device in $store.devices.webDevices()" :key="'settings-web-' + device.id">
+                            <div class="settings-device-row">
+                                <span class="device-row-icon">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                        <rect x="3" y="4" width="18" height="12" rx="2"/>
+                                        <path d="M8 20h8M12 16v4"/>
+                                    </svg>
+                                </span>
+                                <span class="fed-device-main">
+                                    <span class="fed-device-name" x-text="device.name"></span>
+                                    <span class="fed-device-meta"
+                                          x-text="device.is_current ? 'This browser session' : (device.is_active ? 'Active web session' : 'Web session')"></span>
+                                </span>
+                            </div>
+                        </template>
+                    </div>
+
+                    <div class="settings-device-group">
+                        <div class="settings-device-label">Trusted federation devices</div>
+                        <template x-for="request in $store.devices.fedPending()" :key="request.request_id">
+                            <div class="fed-pairing-card">
+                                <div class="fed-pairing-title" x-text="request.name || request.device_id"></div>
+                                <div class="fed-pairing-meta"
+                                     x-text="request.requester_group_id ? 'Already belongs to another sync group' : (request.client_version || 'Waiting for approval')"></div>
+                                <div class="fed-device-actions">
+                                    <button class="fed-action-btn primary"
+                                            @click="$store.devices.answerFedPairing(request, true, !!request.requester_group_id)"
+                                            x-text="request.requester_group_id ? 'Use existing group' : 'Approve'"></button>
+                                    <button class="fed-action-btn"
+                                            @click="$store.devices.answerFedPairing(request, false, false)">Reject</button>
+                                </div>
+                            </div>
+                        </template>
+                        <template x-for="device in $store.devices.fedDevices()" :key="'settings-fed-' + device.device_id">
+                            <div class="settings-device-row federation">
+                                <span class="device-row-icon federation-device-icon">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
+                                        <circle cx="12" cy="12" r="3"/>
+                                        <path d="M5.6 8.5a7.5 7.5 0 000 7M18.4 8.5a7.5 7.5 0 010 7"/>
+                                        <path d="M2.8 5.8a11 11 0 000 12.4M21.2 5.8a11 11 0 010 12.4"/>
+                                    </svg>
+                                </span>
+                                <span class="fed-device-main">
+                                    <span class="fed-device-name" x-text="device.name || device.device_id"></span>
+                                    <span class="fed-device-meta"
+                                          x-text="device.is_self ? 'This web player' : (device.client_version || 'Trusted device')"></span>
+                                </span>
+                                <button class="fed-revoke-btn"
+                                        x-show="!device.is_self"
+                                        :disabled="$store.devices.fedBusy"
+                                        @click="$store.devices.revokeFedDevice(device)">Revoke</button>
+                            </div>
+                        </template>
+                    </div>
+
+                    <div class="settings-pairing-actions">
+                        <button class="settings-primary-btn"
+                                :disabled="$store.devices.fedBusy"
+                                @click="$store.devices.generateFedInvite()">Invite a device</button>
+                        <template x-if="$store.devices.fedInvite">
+                            <input class="fed-device-input"
+                                   readonly
+                                   :value="$store.devices.fedInvite"
+                                   @focus="$event.target.select()">
+                        </template>
+                        <div class="fed-connect-row">
+                            <input class="fed-device-input"
+                                   type="text"
+                                   placeholder="Paste frid:// invite"
+                                   x-model="$store.devices.fedInviteInput"
+                                   @keydown.enter.prevent="$store.devices.connectFedInvite()">
+                            <button class="settings-secondary-btn"
+                                    :disabled="$store.devices.fedBusy || !$store.devices.fedInviteInput.trim()"
+                                    @click="$store.devices.connectFedInvite()">Connect</button>
+                        </div>
+                    </div>
+                </section>
+            </div>
+        </div>
+    </template>
+
     <!-- Play History Modal -->
     <template x-if="$store.history.modal">
         <div class="modal-overlay" @click.self="$store.history.close()">

templates/player/shell.html

@@ -16,13 +16,21 @@
                         <div class="user-name" x-text="$store.user.profile?.name || ''"></div>
                         <div class="user-role" x-text="$store.user.profile?.role || ''"></div>
                     </div>
-                    <button class="user-logout-btn" @click="$store.user.logout()" title="{{ t.player_log_out }}">
-                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                            <path d="M9 21H5a2 2 0 01-2-2V5a2 2 0 012-2h4"/>
-                            <polyline points="16 17 21 12 16 7"/>
-                            <line x1="21" y1="12" x2="9" y2="12"/>
-                        </svg>
-                    </button>
+                    <div class="user-widget-actions">
+                        <button class="user-logout-btn" @click="$store.user.openSettings()" title="User settings" aria-label="User settings">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
+                                <circle cx="12" cy="12" r="3"/>
+                                <path d="M19.4 15a1.7 1.7 0 00.34 1.88l.06.06-2.83 2.83-.06-.06A1.7 1.7 0 0015 19.4a1.7 1.7 0 00-1 .6 1.7 1.7 0 00-.4 1.1V21h-4v-.1A1.7 1.7 0 009 19.4a1.7 1.7 0 00-1.88.34l-.06.06-2.83-2.83.06-.06A1.7 1.7 0 004.6 15a1.7 1.7 0 00-.6-1 1.7 1.7 0 00-1.1-.4H3v-4h.1A1.7 1.7 0 004.6 9a1.7 1.7 0 00-.34-1.88l-.06-.06 2.83-2.83.06.06A1.7 1.7 0 009 4.6a1.7 1.7 0 001-.6 1.7 1.7 0 00.4-1.1V3h4v.1A1.7 1.7 0 0015 4.6a1.7 1.7 0 001.88-.34l.06-.06 2.83 2.83-.06.06A1.7 1.7 0 0019.4 9a1.7 1.7 0 00.6 1 1.7 1.7 0 001.1.4h.1v4h-.1a1.7 1.7 0 00-1.7.6z"/>
+                            </svg>
+                        </button>
+                        <button class="user-logout-btn" @click="$store.user.logout()" title="{{ t.player_log_out }}">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                <path d="M9 21H5a2 2 0 01-2-2V5a2 2 0 012-2h4"/>
+                                <polyline points="16 17 21 12 16 7"/>
+                                <line x1="21" y1="12" x2="9" y2="12"/>
+                            </svg>
+                        </button>
+                    </div>
                 </div>
                 <div class="user-stats">
                     <button class="user-stat" @click="$store.history.open()">
@@ -38,19 +46,6 @@
                         <span class="user-stat-label">{{ t.player_listened }}</span>
                     </div>
                 </div>
-                <button class="lastfm-profile-action"
-                        :class="$store.user.lastfmClass()"
-                        :disabled="$store.user.lastfmBusy || !$store.user.lastfm?.configured"
-                        @click="$store.user.handleLastfm()"
-                        :title="$store.user.lastfmLabel()"
-                        :aria-label="$store.user.lastfmLabel()">
-                    <span class="lastfm-dot"></span>
-                    <span class="lastfm-profile-text">
-                        <span class="lastfm-profile-brand">{{ t.player_lastfm_profile }}</span>
-                        <span class="lastfm-profile-separator">·</span>
-                        <span class="lastfm-profile-status" x-text="$store.user.lastfmStatusLabel()"></span>
-                    </span>
-                </button>
             </div>
             <div class="sidebar-header">
                 <h2>{{ t.player_library }}</h2>
@@ -363,23 +358,21 @@
                             <span class="user-stat-label">{{ t.player_listened }}</span>
                         </div>
                     </div>
-                    <button class="lastfm-profile-action"
-                            :class="$store.user.lastfmClass()"
-                            :disabled="$store.user.lastfmBusy || !$store.user.lastfm?.configured"
-                            @click="$store.user.handleLastfm()"
-                            :title="$store.user.lastfmLabel()"
-                            :aria-label="$store.user.lastfmLabel()">
-                        <span class="lastfm-dot"></span>
-                        <span class="lastfm-profile-text">
-                            <span class="lastfm-profile-brand">{{ t.player_lastfm_profile }}</span>
-                            <span class="lastfm-profile-separator">·</span>
-                            <span class="lastfm-profile-status" x-text="$store.user.lastfmStatusLabel()"></span>
-                        </span>
-                    </button>
-                    <button class="modal-btn modal-btn-primary mobile-account-logout"
-                            @click="$store.user.logout()">
-                        {{ t.player_log_out }}
-                    </button>
+                    <div class="mobile-account-actions">
+                        <button class="user-logout-btn"
+                                @click="$store.user.menuOpen = false; $store.user.openSettings()"
+                                title="User settings"
+                                aria-label="User settings">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
+                                <circle cx="12" cy="12" r="3"/>
+                                <path d="M19.4 15a1.7 1.7 0 00.34 1.88l.06.06-2.83 2.83-.06-.06A1.7 1.7 0 0015 19.4a1.7 1.7 0 00-1 .6 1.7 1.7 0 00-.4 1.1V21h-4v-.1A1.7 1.7 0 009 19.4a1.7 1.7 0 00-1.88.34l-.06.06-2.83-2.83.06-.06A1.7 1.7 0 004.6 15a1.7 1.7 0 00-.6-1 1.7 1.7 0 00-1.1-.4H3v-4h.1A1.7 1.7 0 004.6 9a1.7 1.7 0 00-.34-1.88l-.06-.06 2.83-2.83.06.06A1.7 1.7 0 009 4.6a1.7 1.7 0 001-.6 1.7 1.7 0 00.4-1.1V3h4v.1A1.7 1.7 0 0015 4.6a1.7 1.7 0 001.88-.34l.06-.06 2.83 2.83-.06.06A1.7 1.7 0 0019.4 9a1.7 1.7 0 00.6 1 1.7 1.7 0 001.1.4h.1v4h-.1a1.7 1.7 0 00-1.7.6z"/>
+                            </svg>
+                        </button>
+                        <button class="modal-btn modal-btn-primary mobile-account-logout"
+                                @click="$store.user.logout()">
+                            {{ t.player_log_out }}
+                        </button>
+                    </div>
                 </div>
             </div>
 
@@ -505,6 +498,139 @@
                                     </template>
                                 </div>
                             </template>
+                            <div class="search-section federation-search-section">
+                                <h2 class="search-section-title">
+                                    Federation
+                                    <span class="federation-live-badge"
+                                          x-show="$store.library.federationSearch.loading"
+                                          x-cloak>LIVE</span>
+                                </h2>
+                                <template x-if="$store.library.federationSearch.error">
+                                    <div class="federation-search-status error"
+                                         x-text="$store.library.federationSearch.error"></div>
+                                </template>
+                                <template x-if="$store.library.federationSearch.loading && $store.library.federationSearch.tracks.length === 0">
+                                    <div class="federation-search-status">Searching peers…</div>
+                                </template>
+                                <div class="search-artists-row"
+                                     x-show="$store.library.federationSearch.artists.length > 0"
+                                     x-cloak>
+                                    <template x-for="artist in $store.library.federationSearch.artists"
+                                              :key="artist.key.normalized_name">
+                                        <div class="search-artist-card federation-entity-card"
+                                             @click="$store.library.openFederatedArtist(artist)">
+                                            <div class="search-artist-img">
+                                                <img x-show="$store.library.federationArtistImage(artist)"
+                                                     :src="$store.library.federationArtistImage(artist)"
+                                                     :alt="artist.name"
+                                                     loading="lazy"
+                                                     @error="$event.currentTarget.style.display = 'none'">
+                                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
+                                                    <circle cx="12" cy="8" r="4"/><path d="M20 21a8 8 0 10-16 0"/>
+                                                </svg>
+                                            </div>
+                                            <div class="search-artist-name" x-text="artist.name"></div>
+                                            <div class="federation-source-count"
+                                                 x-text="`${artist.peers.length} peer${artist.peers.length === 1 ? '' : 's'}`"></div>
+                                        </div>
+                                    </template>
+                                </div>
+                                <div class="search-releases-row"
+                                     x-show="$store.library.federationSearch.releases.length > 0"
+                                     x-cloak>
+                                    <template x-for="release in $store.library.federationSearch.releases"
+                                              :key="JSON.stringify(release.key)">
+                                        <div class="search-release-card federation-entity-card">
+                                            <div class="search-release-cover">
+                                                <img x-show="release.cover_url"
+                                                     :src="release.cover_url"
+                                                     :alt="release.title"
+                                                     loading="lazy">
+                                                <svg x-show="!release.cover_url"
+                                                     viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
+                                                    <rect x="3" y="3" width="18" height="18" rx="2"/><circle cx="12" cy="12" r="4"/>
+                                                </svg>
+                                            </div>
+                                            <div class="card-title" x-text="release.title"></div>
+                                            <div class="card-subtitle"
+                                                 x-text="[release.year, ...(release.artists || [])].filter(Boolean).join(' · ')"></div>
+                                        </div>
+                                    </template>
+                                </div>
+                                <template x-for="(track, idx) in $store.library.federationSearch.tracks"
+                                          :key="track.key.content_id">
+                                    <div class="track-row federation-track-row"
+                                         @dblclick="$store.library.playFederatedTrack(track)">
+                                        <span class="track-num federation-track-status">
+                                            <template x-if="!$store.library.federationDownload(track.key.content_id) && !$store.library.isTrackLocal(track)">
+                                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
+                                                    <circle cx="12" cy="12" r="3"/>
+                                                    <path d="M5.6 8.5a7.5 7.5 0 000 7M18.4 8.5a7.5 7.5 0 010 7"/>
+                                                    <path d="M2.8 5.8a11 11 0 000 12.4M21.2 5.8a11 11 0 010 12.4"/>
+                                                </svg>
+                                            </template>
+                                            <template x-if="$store.library.federationDownload(track.key.content_id)">
+                                                <span class="federation-download-progress"
+                                                      :class="{ indeterminate: !$store.library.federationDownload(track.key.content_id).total }">
+                                                    <svg viewBox="0 0 20 20" aria-hidden="true">
+                                                        <circle class="progress-track" cx="10" cy="10" r="8"/>
+                                                        <circle class="progress-value" cx="10" cy="10" r="8"
+                                                                :style="`stroke-dashoffset: ${50.27 * (1 - $store.library.federationDownload(track.key.content_id).percent / 100)}`"/>
+                                                    </svg>
+                                                    <span class="progress-percent"
+                                                          x-show="$store.library.federationDownload(track.key.content_id).total"
+                                                          x-text="Math.round($store.library.federationDownload(track.key.content_id).percent)"></span>
+                                                    <span class="federation-download-tooltip"
+                                                          x-text="$store.library.federationDownloadTooltip(track.key.content_id)"></span>
+                                                </span>
+                                            </template>
+                                        </span>
+                                        <div class="track-info">
+                                            <div class="track-title" x-text="track.metadata.title"></div>
+                                            <div class="track-artists-inline"
+                                                 x-text="$store.library.federationArtistLine(track)"></div>
+                                        </div>
+                                        <span class="federation-source-count"
+                                              x-text="`${track.availability.federation.length} peer${track.availability.federation.length === 1 ? '' : 's'}`"></span>
+                                        <span class="track-actions">
+                                            <button class="track-action-btn info-btn"
+                                                    @click.stop="$store.library.openFederationTrackInfo(track)"
+                                                    title="{{ t.player_track_info }}">
+                                                <span class="info-letter">i</span>
+                                            </button>
+                                            <button class="like-btn"
+                                                    :class="{ liked: $store.library.federationIsLiked(track) }"
+                                                    @click.stop="$store.library.toggleFederationLike(track)"
+                                                    title="{{ t.player_like }}">
+                                                <svg viewBox="0 0 24 24"
+                                                     :fill="$store.library.federationIsLiked(track) ? 'currentColor' : 'none'"
+                                                     stroke="currentColor" stroke-width="2">
+                                                    <path d="M20.84 4.61a5.5 5.5 0 00-7.78 0L12 5.67l-1.06-1.06a5.5 5.5 0 00-7.78 7.78L12 21.23l8.84-8.84a5.5 5.5 0 000-7.78z"/>
+                                                </svg>
+                                            </button>
+                                            <button class="track-action-btn queue-insert-btn queue-next-btn"
+                                                    @click.stop="$store.library.enqueueFederatedTrack(track, true)"
+                                                    title="{{ t.player_play_next }}">
+                                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 6h10M5 12h7M5 18h10"/><path d="M17 9l4 3-4 3" fill="currentColor" stroke="none"/></svg>
+                                            </button>
+                                            <button class="track-action-btn queue-insert-btn queue-end-btn"
+                                                    @click.stop="$store.library.enqueueFederatedTrack(track, false)"
+                                                    title="{{ t.player_add_to_queue }}">
+                                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 6h14M5 12h14M5 18h7"/><path d="M17 15l4 3-4 3" fill="currentColor" stroke="none"/></svg>
+                                            </button>
+                                            <button class="track-action-btn playlist-add-btn"
+                                                    @click.stop="$store.playlists.showFederationPicker(track)"
+                                                    title="{{ t.player_add_to_playlist }}">
+                                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                                    <path d="M8 6h13M8 12h13M8 18h13M3 6h.01M3 12h.01M3 18h.01"/>
+                                                </svg>
+                                            </button>
+                                        </span>
+                                        <span class="track-duration"
+                                              x-text="formatTime(track.metadata.duration_seconds)"></span>
+                                    </div>
+                                </template>
+                            </div>
                         </div>
                     </template>
                 </div>
@@ -580,7 +706,9 @@
                     <div class="artist-header">
                         <div class="artist-img">
                             <template x-if="$store.library.currentArtist.image_url">
-                                <img :src="$store.library.currentArtist.image_url" :alt="$store.library.currentArtist.name">
+                                <img :src="$store.library.currentArtist.image_url"
+                                     :alt="$store.library.currentArtist.name"
+                                     @error="$store.library.currentArtist.image_url = null">
                             </template>
                             <template x-if="!$store.library.currentArtist.image_url">
                                 <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><circle cx="12" cy="8" r="4"/><path d="M20 21a8 8 0 10-16 0"/></svg>
@@ -589,15 +717,18 @@
                         <div>
                             <div class="artist-name" x-text="$store.library.currentArtist.name"></div>
                             <div class="artist-stats">
-                                <span x-text="$store.library.currentArtist.releases.length + ' {{ t.player_releases_count }}'"></span>
+                                <span x-text="($store.library.currentArtist.releases.length + $store.library.artistFederation.releases.length) + ' {{ t.player_releases_count }}'"></span>
                                 <span>•</span>
-                                <span x-text="$store.library.currentArtist.total_track_count + ' {{ t.player_tracks_count }}'"></span>
+                                <span x-text="($store.library.currentArtist.total_track_count + $store.library.artistFederation.tracks.length) + ' {{ t.player_tracks_count }}'"></span>
                                 <span>•</span>
                                 <span x-text="$store.library.currentArtist.total_play_count + ' {{ t.player_plays_count }}'"></span>
+                                <span class="federation-live-badge"
+                                      x-show="$store.library.artistFederation.loading"
+                                      x-cloak>FEDERATION LIVE</span>
                             </div>
                             <div class="release-actions artist-actions">
                                 <button class="release-action-btn primary artist-listen-action"
-                                        :disabled="!($store.library.currentArtist.top_tracks && $store.library.currentArtist.top_tracks.length)"
+                                        :disabled="!($store.library.currentArtist.top_tracks?.length || $store.library.artistFederation.tracks.length)"
                                         @click="$store.library.playArtistTopTracks()"
                                         title="{{ t.player_listen_artist }}">
                                     <svg viewBox="0 0 24 24" fill="currentColor" stroke="none">
@@ -606,6 +737,7 @@
                                     <span>{{ t.player_listen }}</span>
                                 </button>
                                 <button class="release-action-btn secondary artist-follow-action"
+                                        x-show="$store.library.currentArtist.id"
                                         :class="{ followed: $store.follows.has($store.library.currentArtist.id) }"
                                         @click="$store.follows.toggle($store.library.currentArtist.id)"
                                         :title="$store.follows.has($store.library.currentArtist.id) ? '{{ t.player_unfollow_artist }}' : '{{ t.player_follow_artist }}'">
@@ -705,7 +837,8 @@
                                     <div class="card" @click="$store.library.openRelease(release.id)">
                                         <div class="card-img">
                                             <template x-if="release.cover_url">
-                                                <img :src="release.cover_url" :alt="release.title" loading="lazy">
+                                                <img :src="release.cover_url" :alt="release.title"
+                                                     loading="lazy" @error="release.cover_url = null">
                                             </template>
                                             <template x-if="!release.cover_url">
                                                 <span class="placeholder-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><rect x="3" y="3" width="18" height="18" rx="2"/><circle cx="12" cy="12" r="4"/></svg></span>
@@ -730,6 +863,120 @@
                             </div>
                         </section>
                     </template>
+                    <template x-if="$store.library.artistFederation.releases.length > 0">
+                        <section class="artist-release-group federation-artist-section">
+                            <h2 class="artist-release-group-title">Federation</h2>
+                            <div class="card-grid">
+                                <template x-for="release in $store.library.artistFederation.releases"
+                                          :key="release.key">
+                                    <div class="card federation-release-card"
+                                         @click="$store.library.openFederatedRelease(release)">
+                                        <div class="card-img">
+                                            <template x-if="release.cover_url">
+                                                <img :src="release.cover_url" :alt="release.title"
+                                                     loading="lazy" @error="release.cover_url = null">
+                                            </template>
+                                            <template x-if="!release.cover_url">
+                                                <span class="placeholder-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><rect x="3" y="3" width="18" height="18" rx="2"/><circle cx="12" cy="12" r="4"/></svg></span>
+                                            </template>
+                                            <button class="card-play-btn"
+                                                    :disabled="!release.tracks.length"
+                                                    @click.stop="$store.library.playFederatedRelease(release)">
+                                                <svg viewBox="0 0 24 24"><path d="M8 5v14l11-7z"/></svg>
+                                            </button>
+                                        </div>
+                                        <div class="card-title" x-text="release.title"></div>
+                                        <div class="card-subtitle">
+                                            <span x-text="release.year || ''"></span>
+                                            <span x-text="release.tracks.length + ' {{ t.player_tracks_count }}'"></span>
+                                            <span class="federation-source-count"
+                                                  x-text="release.owners.length + ' peer' + (release.owners.length === 1 ? '' : 's')"></span>
+                                        </div>
+                                    </div>
+                                </template>
+                            </div>
+                        </section>
+                    </template>
+                    <template x-if="$store.library.artistFederation.tracks.length > 0">
+                        <section class="artist-release-group federation-artist-section">
+                            <h2 class="artist-release-group-title">Federation tracks</h2>
+                            <template x-for="(track, idx) in $store.library.artistFederation.tracks"
+                                      :key="track.key.content_id">
+                                <div class="track-row federation-track-row"
+                                     @dblclick="$store.library.playFederatedTrack(track)">
+                                    <span class="track-num federation-track-status">
+                                        <template x-if="!$store.library.federationDownload(track.key.content_id) && !$store.library.isTrackLocal(track)">
+                                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
+                                                <circle cx="12" cy="12" r="3"/>
+                                                <path d="M5.6 8.5a7.5 7.5 0 000 7M18.4 8.5a7.5 7.5 0 010 7"/>
+                                            </svg>
+                                        </template>
+                                        <template x-if="$store.library.federationDownload(track.key.content_id)">
+                                            <span class="federation-download-progress"
+                                                  :class="{ indeterminate: !$store.library.federationDownload(track.key.content_id).total }">
+                                                <svg viewBox="0 0 20 20">
+                                                    <circle class="progress-track" cx="10" cy="10" r="8"/>
+                                                    <circle class="progress-value" cx="10" cy="10" r="8"
+                                                            :style="`stroke-dashoffset: ${50.27 * (1 - $store.library.federationDownload(track.key.content_id).percent / 100)}`"/>
+                                                </svg>
+                                                <span class="progress-percent"
+                                                      x-show="$store.library.federationDownload(track.key.content_id).total"
+                                                      x-text="Math.round($store.library.federationDownload(track.key.content_id).percent)"></span>
+                                                <span class="federation-download-tooltip"
+                                                      x-text="$store.library.federationDownloadTooltip(track.key.content_id)"></span>
+                                            </span>
+                                        </template>
+                                    </span>
+                                    <div class="track-info">
+                                        <div class="track-title" x-text="track.metadata.title"></div>
+                                        <div class="track-artists-inline"
+                                             x-text="[track.metadata.release?.title, $store.library.federationArtistLine(track)].filter(Boolean).join(' · ')"></div>
+                                    </div>
+                                    <span></span>
+                                    <span class="track-actions">
+                                        <button class="track-action-btn info-btn"
+                                                @click.stop="$store.library.openFederationTrackInfo(track)"
+                                                title="{{ t.player_track_info }}">
+                                            <span class="info-letter">i</span>
+                                        </button>
+                                        <button class="like-btn"
+                                                :class="{ liked: $store.library.federationIsLiked(track) }"
+                                                @click.stop="$store.library.toggleFederationLike(track)"
+                                                title="{{ t.player_like }}">
+                                            <svg viewBox="0 0 24 24"
+                                                 :fill="$store.library.federationIsLiked(track) ? 'currentColor' : 'none'"
+                                                 stroke="currentColor" stroke-width="2">
+                                                <path d="M20.84 4.61a5.5 5.5 0 00-7.78 0L12 5.67l-1.06-1.06a5.5 5.5 0 00-7.78 7.78L12 21.23l8.84-8.84a5.5 5.5 0 000-7.78z"/>
+                                            </svg>
+                                        </button>
+                                        <button class="track-action-btn queue-insert-btn queue-next-btn"
+                                                @click.stop="$store.library.enqueueFederatedTrack(track, true)"
+                                                title="{{ t.player_play_next }}">
+                                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 6h10M5 12h7M5 18h10"/><path d="M17 9l4 3-4 3" fill="currentColor" stroke="none"/></svg>
+                                        </button>
+                                        <button class="track-action-btn queue-insert-btn queue-end-btn"
+                                                @click.stop="$store.library.enqueueFederatedTrack(track, false)"
+                                                title="{{ t.player_add_to_queue }}">
+                                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 6h14M5 12h14M5 18h7"/><path d="M17 15l4 3-4 3" fill="currentColor" stroke="none"/></svg>
+                                        </button>
+                                        <button class="track-action-btn playlist-add-btn"
+                                                @click.stop="$store.playlists.showFederationPicker(track)"
+                                                title="{{ t.player_add_to_playlist }}">
+                                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                                <path d="M8 6h13M8 12h13M8 18h13M3 6h.01M3 12h.01M3 18h.01"/>
+                                            </svg>
+                                        </button>
+                                    </span>
+                                    <span class="track-duration"
+                                          x-text="formatTime(track.metadata.duration_seconds)"></span>
+                                </div>
+                            </template>
+                        </section>
+                    </template>
+                    <template x-if="$store.library.artistFederation.error">
+                        <div class="federation-search-status error"
+                             x-text="$store.library.artistFederation.error"></div>
+                    </template>
                     <template x-if="$store.library.currentArtist.featured_tracks && $store.library.currentArtist.featured_tracks.length > 0">
                         <section class="artist-release-group">
                             <h2 class="artist-release-group-title">{{ t.player_appears_on }}</h2>
@@ -817,7 +1064,8 @@
                            x-text="$store.library.artistFilter === 'uploads' ? '{{ t.player_my_uploads }}' : '{{ t.player_global_library }}'"></a>
                         <span>/</span>
                         <template x-if="$store.library.currentRelease.artists.length > 0">
-                            <a @click="$store.library.openArtist($store.library.currentRelease.artists[0].id)" x-text="$store.library.currentRelease.artists[0].name"></a>
+                            <a @click="$store.library.currentRelease.artists[0].id ? $store.library.openArtist($store.library.currentRelease.artists[0].id) : $store.library.openFederatedArtist($store.library.currentRelease.artists[0].name)"
+                               x-text="$store.library.currentRelease.artists[0].name"></a>
                         </template>
                         <span>/</span>
                         <span x-text="$store.library.currentRelease.title"></span>
@@ -832,21 +1080,28 @@
                             </template>
                         </div>
                         <div class="release-meta">
-                            <div class="release-type" x-text="$store.library.currentRelease.release_type"></div>
+                            <div class="release-type">
+                                <span x-text="$store.library.currentRelease.release_type"></span>
+                                <span class="federation-live-badge"
+                                      x-show="$store.library.releaseFederationLoading"
+                                      x-cloak>FEDERATION LIVE</span>
+                            </div>
                             <div class="release-title-row">
                                 <div class="release-title" x-text="$store.library.currentRelease.title"></div>
                                 <button class="like-btn like-btn-lg release-title-like"
-                                        :class="{ liked: $store.likes.isReleaseLiked($store.library.currentRelease) }"
-                                        @click.stop="$store.likes.toggleRelease($store.library.currentRelease.id)"
+                                        :class="{ liked: $store.library.isMixedReleaseLiked($store.library.currentRelease) }"
+                                        @click.stop="$store.library.toggleMixedReleaseLike($store.library.currentRelease)"
                                         title="{{ t.player_like }}">
-                                    <svg viewBox="0 0 24 24" :fill="$store.likes.isReleaseLiked($store.library.currentRelease) ? 'currentColor' : 'none'" stroke="currentColor" stroke-width="2"><path d="M20.84 4.61a5.5 5.5 0 00-7.78 0L12 5.67l-1.06-1.06a5.5 5.5 0 00-7.78 7.78L12 21.23l8.84-8.84a5.5 5.5 0 000-7.78z"/></svg>
+                                    <svg viewBox="0 0 24 24" :fill="$store.library.isMixedReleaseLiked($store.library.currentRelease) ? 'currentColor' : 'none'" stroke="currentColor" stroke-width="2"><path d="M20.84 4.61a5.5 5.5 0 00-7.78 0L12 5.67l-1.06-1.06a5.5 5.5 0 00-7.78 7.78L12 21.23l8.84-8.84a5.5 5.5 0 000-7.78z"/></svg>
                                 </button>
                             </div>
                             <div class="release-artists">
                                 <template x-for="(artist, artistIdx) in $store.library.currentRelease.artists" :key="artist.id">
                                     <span>
                                         <template x-if="artistIdx > 0"><span>, </span></template>
-                                        <a class="artist-link" @click="$store.library.openArtist(artist.id)" x-text="artist.name"></a>
+                                        <a class="artist-link"
+                                           @click="artist.id ? $store.library.openArtist(artist.id) : $store.library.openFederatedArtist(artist.name)"
+                                           x-text="artist.name"></a>
                                     </span>
                                 </template>
                             </div>
@@ -861,6 +1116,7 @@
                                         {{ t.player_info }}
                                     </button>
                                     <button class="release-action-btn secondary release-share-btn"
+                                            x-show="!$store.library.currentRelease.federated"
                                             @click.stop="$store.sharing.copyRelease($store.library.currentRelease, $event.currentTarget)"
                                             title="{{ t.player_share }}"
                                             aria-label="{{ t.player_share }}">
@@ -897,15 +1153,46 @@
                         <div class="track-row"
                              :data-shared-track-id="track.id"
                              :class="{ playing: $store.player.currentTrack && $store.player.currentTrack.id === track.id, 'shared-target': $store.sharing.isSharedTrack(track) }"
-                             @dblclick="$store.queue.playRelease([track], 0)">
-                            <span class="track-num" x-text="track.track_number || (idx + 1)"></span>
+                             @dblclick="$store.queue.playRelease($store.library.currentRelease.tracks, idx)">
+                            <span class="track-num federation-track-status">
+                                <template x-if="!track.federation_pending">
+                                    <span x-text="track.track_number || (idx + 1)"></span>
+                                </template>
+                                <template x-if="track.federation_pending && !$store.library.federationDownload(track.content_id) && !$store.library.isTrackLocal(track._federationTrack)">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
+                                        <circle cx="12" cy="12" r="3"/>
+                                        <path d="M5.6 8.5a7.5 7.5 0 000 7M18.4 8.5a7.5 7.5 0 010 7"/>
+                                        <path d="M2.8 5.8a11 11 0 000 12.4M21.2 5.8a11 11 0 010 12.4"/>
+                                    </svg>
+                                </template>
+                                <template x-if="track.federation_pending && !$store.library.federationDownload(track.content_id) && $store.library.isTrackLocal(track._federationTrack)">
+                                    <span x-text="track.track_number || (idx + 1)"></span>
+                                </template>
+                                <template x-if="track.federation_pending && $store.library.federationDownload(track.content_id)">
+                                    <span class="federation-download-progress"
+                                          :class="{ indeterminate: !$store.library.federationDownload(track.content_id).total }">
+                                        <svg viewBox="0 0 20 20">
+                                            <circle class="progress-track" cx="10" cy="10" r="8"/>
+                                            <circle class="progress-value" cx="10" cy="10" r="8"
+                                                    :style="`stroke-dashoffset: ${50.27 * (1 - $store.library.federationDownload(track.content_id).percent / 100)}`"/>
+                                        </svg>
+                                        <span class="progress-percent"
+                                              x-show="$store.library.federationDownload(track.content_id).total"
+                                              x-text="Math.round($store.library.federationDownload(track.content_id).percent)"></span>
+                                        <span class="federation-download-tooltip"
+                                              x-text="$store.library.federationDownloadTooltip(track.content_id)"></span>
+                                    </span>
+                                </template>
+                            </span>
                             <div class="track-info">
                                 <div class="track-title" x-text="track.title"></div>
                                 <div class="track-artists-inline">
                                     <template x-for="(artist, artistIdx) in $store.library.trackArtistLinks(track)" :key="artist.label + '-' + artist.id + '-' + artistIdx">
                                         <span>
                                             <template x-if="artistIdx > 0"><span>, </span></template>
-                                            <a class="artist-link" @click.stop="$store.library.openArtist(artist.id)" x-text="artist.label"></a>
+                                            <a class="artist-link"
+                                               @click.stop="artist.id ? $store.library.openArtist(artist.id) : $store.library.openFederatedArtist(artist.label.replace(/^ft\\.\\s*/, ''))"
+                                               x-text="artist.label"></a>
                                         </span>
                                     </template>
                                 </div>
@@ -915,14 +1202,19 @@
                                 <button class="track-action-btn info-btn popularity-info-btn"
                                         :class="{ 'has-popularity': $store.library.hasPopularity(track), 'no-popularity': !$store.library.hasPopularity(track) }"
                                         :style="$store.library.popularityStyle(track)"
-                                        @click.stop="$store.library.openTrackInfo(track)"
+                                        @click.stop="track.federation_pending ? $store.library.openFederationTrackInfo(track._federationTrack) : $store.library.openTrackInfo(track)"
                                         :title="$store.library.trackInfoTitle(track)"
                                         aria-label="{{ t.player_track_info }}">
                                     <span x-show="$store.library.hasPopularity(track)" x-text="$store.library.popularityLabel(track)"></span>
                                     <span x-show="!$store.library.hasPopularity(track)" class="info-letter">i</span>
                                 </button>
-                                <button class="like-btn" :class="{ liked: $store.likes.has(track.id) }" @click.stop="$store.likes.toggle(track.id)" title="{{ t.player_like }}">
-                                    <svg viewBox="0 0 24 24" :fill="$store.likes.has(track.id) ? 'currentColor' : 'none'" stroke="currentColor" stroke-width="2"><path d="M20.84 4.61a5.5 5.5 0 00-7.78 0L12 5.67l-1.06-1.06a5.5 5.5 0 00-7.78 7.78L12 21.23l8.84-8.84a5.5 5.5 0 000-7.78z"/></svg>
+                                <button class="like-btn"
+                                        :class="{ liked: track.federation_pending ? $store.library.federationIsLiked(track._federationTrack) : $store.likes.has(track.id) }"
+                                        @click.stop="track.federation_pending ? $store.library.toggleFederationLike(track._federationTrack) : $store.likes.toggle(track.id)"
+                                        title="{{ t.player_like }}">
+                                    <svg viewBox="0 0 24 24"
+                                         :fill="track.federation_pending ? ($store.library.federationIsLiked(track._federationTrack) ? 'currentColor' : 'none') : ($store.likes.has(track.id) ? 'currentColor' : 'none')"
+                                         stroke="currentColor" stroke-width="2"><path d="M20.84 4.61a5.5 5.5 0 00-7.78 0L12 5.67l-1.06-1.06a5.5 5.5 0 00-7.78 7.78L12 21.23l8.84-8.84a5.5 5.5 0 000-7.78z"/></svg>
                                 </button>
                                 <button class="track-action-btn queue-insert-btn queue-next-btn" @click.stop="$store.queue.addNextInQueue([track])" title="{{ t.player_play_next }}">
                                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 6h10M5 12h7M5 18h10"/><path d="M17 9l4 3-4 3" fill="currentColor" stroke="none"/></svg>
@@ -930,10 +1222,14 @@
                                 <button class="track-action-btn queue-insert-btn queue-end-btn" @click.stop="$store.queue.addToEnd([track])" title="{{ t.player_add_to_queue }}">
                                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 6h14M5 12h14M5 18h7"/><path d="M17 15l4 3-4 3" fill="currentColor" stroke="none"/></svg>
                                 </button>
-                                <button class="track-action-btn track-share-btn" @click.stop="$store.sharing.copyTrack(track, $event.currentTarget)" title="{{ t.player_share_track }}" aria-label="{{ t.player_share_track }}">
+                                <button class="track-action-btn track-share-btn"
+                                        x-show="!track.federation_pending"
+                                        @click.stop="$store.sharing.copyTrack(track, $event.currentTarget)" title="{{ t.player_share_track }}" aria-label="{{ t.player_share_track }}">
                                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="18" cy="5" r="3"/><circle cx="6" cy="12" r="3"/><circle cx="18" cy="19" r="3"/><path d="M8.6 10.6l6.8-3.9M8.6 13.4l6.8 3.9"/></svg>
                                 </button>
-                                <button class="track-action-btn playlist-add-btn" @click.stop="$store.playlists.showPicker([track.id])" title="{{ t.player_add_to_playlist }}">
+                                <button class="track-action-btn playlist-add-btn"
+                                        @click.stop="track.federation_pending ? $store.playlists.showFederationPicker(track._federationTrack) : $store.playlists.showPicker([track.id])"
+                                        title="{{ t.player_add_to_playlist }}">
                                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M8 6h13M8 12h13M8 18h13M3 6h.01M3 12h.01M3 18h.01"/></svg>
                                 </button>
                             </div>
@@ -951,7 +1247,23 @@
                         <span>/</span>
                         <span x-text="$store.playlists.displayTitle($store.library.currentPlaylist)"></span>
                     </div>
-                    <h1 class="section-title" x-text="$store.playlists.displayTitle($store.library.currentPlaylist)"></h1>
+                    <div class="playlist-detail-heading">
+                        <h1 class="section-title" x-text="$store.playlists.displayTitle($store.library.currentPlaylist)"></h1>
+                        <button class="release-action-btn secondary playlist-edit-toggle"
+                                x-show="$store.playlists.canEditCurrent()"
+                                x-cloak
+                                @click="$store.playlists.toggleEditCurrent()"
+                                :title="$store.playlists.isEditingCurrent() ? '{{ t.player_done }}' : '{{ t.player_edit }}'">
+                            <svg x-show="!$store.playlists.isEditingCurrent()" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                <path d="M11 4H4a2 2 0 00-2 2v14a2 2 0 002 2h14a2 2 0 002-2v-7"/>
+                                <path d="M18.5 2.5a2.12 2.12 0 013 3L12 15l-4 1 1-4 9.5-9.5z"/>
+                            </svg>
+                            <svg x-show="$store.playlists.isEditingCurrent()" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                <path d="M20 6L9 17l-5-5"/>
+                            </svg>
+                            <span x-text="$store.playlists.isEditingCurrent() ? '{{ t.player_done }}' : '{{ t.player_edit }}'"></span>
+                        </button>
+                    </div>
                     <div class="playlist-detail-meta"
                          x-show="$store.library.currentPlaylist.owner_name || $store.library.currentPlaylist.is_public">
                         <span x-show="$store.library.currentPlaylist.owner_name"
@@ -963,27 +1275,89 @@
                     <template x-if="$store.library.currentPlaylist.description">
                         <p style="color:var(--text-subdued);margin-bottom:16px" x-text="$store.library.currentPlaylist.description"></p>
                     </template>
-                    <div class="track-list-header">
+                    <div class="track-list-header playlist-track-list-header"
+                         :class="{ editing: $store.playlists.isEditingCurrent() }">
+                        <span class="playlist-edit-cell"
+                              x-show="$store.playlists.isEditingCurrent()"
+                              x-cloak></span>
                         <span>#</span>
                         <span>{{ t.player_title }}</span>
                         <span></span>
                         <span></span>
                         <span style="text-align:right">{{ t.player_duration }}</span>
                     </div>
-                    <template x-for="(track, idx) in $store.library.currentPlaylist.tracks" :key="track.id">
-                        <div class="track-row"
-                             :class="{ playing: $store.player.currentTrack && $store.player.currentTrack.id === track.id }"
-                             @dblclick="$store.queue.playRelease($store.library.currentPlaylist.tracks, idx)">
-                            <span class="track-num" x-text="idx + 1"></span>
-                            <div class="track-info">
-                                <div class="track-title" x-text="track.title"></div>
-                                <div class="track-artists-inline">
-                                    <template x-for="(artist, artistIdx) in $store.library.trackArtistLinks(track)" :key="artist.label + '-' + artist.id + '-' + artistIdx">
-                                        <span>
-                                            <template x-if="artistIdx > 0"><span>, </span></template>
-                                            <a class="artist-link" @click.stop="$store.library.openArtist(artist.id)" x-text="artist.label"></a>
-                                        </span>
-                                    </template>
+                    <template x-for="(track, idx) in $store.library.currentPlaylist.tracks" :key="track.playlist_track_id || (track.id + '-' + idx)">
+                        <div class="track-row playlist-track-row"
+                             :data-playlist-index="idx"
+                             :class="{ playing: $store.player.currentTrack && $store.player.currentTrack.id === track.id, editing: $store.playlists.isEditingCurrent(), dragging: $store.playlists._dragIdx === idx }"
+                             :draggable="$store.playlists.isEditingCurrent() && !!track.playlist_track_id"
+                             @dblclick="if (!$store.playlists.isEditingCurrent()) $store.queue.playRelease($store.library.currentPlaylist.tracks, idx)"
+                             @dragstart="if (!$store.playlists.startDrag($event, idx)) $event.preventDefault()"
+                             @dragend="$store.playlists.endDrag()"
+                             @dragover.prevent="$store.playlists.dragOver($event, idx)"
+                             @dragleave="$event.currentTarget.classList.remove('drag-over')"
+                             @drop.prevent="$event.currentTarget.classList.remove('drag-over'); $store.playlists.dropOn(idx)">
+                            <button class="playlist-track-remove"
+                                    x-show="$store.playlists.isEditingCurrent()"
+                                    x-cloak
+                                    @click.stop="$store.playlists.removeCurrentTrack(track, idx)"
+                                    title="{{ t.player_remove }}"
+                                    aria-label="{{ t.player_remove }}">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                    <line x1="18" y1="6" x2="6" y2="18"/>
+                                    <line x1="6" y1="6" x2="18" y2="18"/>
+                                </svg>
+                            </button>
+                            <span class="track-num federation-track-status">
+                                <template x-if="!track.federation_pending || $store.library.isTrackLocal(track._federationTrack)">
+                                    <span x-text="idx + 1"></span>
+                                </template>
+                                <template x-if="track.federation_pending && !$store.library.federationDownload(track.content_id) && !$store.library.isTrackLocal(track._federationTrack)">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
+                                        <circle cx="12" cy="12" r="3"/>
+                                        <path d="M5.6 8.5a7.5 7.5 0 000 7M18.4 8.5a7.5 7.5 0 010 7"/>
+                                        <path d="M2.8 5.8a11 11 0 000 12.4M21.2 5.8a11 11 0 010 12.4"/>
+                                    </svg>
+                                </template>
+                                <template x-if="track.federation_pending && $store.library.federationDownload(track.content_id)">
+                                    <span class="federation-download-progress"
+                                          :class="{ indeterminate: !$store.library.federationDownload(track.content_id).total }">
+                                        <svg viewBox="0 0 20 20">
+                                            <circle class="progress-track" cx="10" cy="10" r="8"/>
+                                            <circle class="progress-value" cx="10" cy="10" r="8"
+                                                    :style="`stroke-dashoffset: ${50.27 * (1 - $store.library.federationDownload(track.content_id).percent / 100)}`"/>
+                                        </svg>
+                                        <span class="progress-percent"
+                                              x-show="$store.library.federationDownload(track.content_id).total"
+                                              x-text="Math.round($store.library.federationDownload(track.content_id).percent)"></span>
+                                        <span class="federation-download-tooltip"
+                                              x-text="$store.library.federationDownloadTooltip(track.content_id)"></span>
+                                    </span>
+                                </template>
+                            </span>
+                            <div class="track-info playlist-track-info">
+                                <button class="playlist-drag-handle"
+                                        x-show="$store.playlists.isEditingCurrent() && !!track.playlist_track_id"
+                                        x-cloak
+                                        @mousedown.stop
+                                        @click.stop
+                                        @pointerdown.stop="$store.playlists.startPointerReorder($event, idx)"
+                                        title="{{ t.player_edit }}"
+                                        aria-label="{{ t.player_edit }}">
+                                    <svg viewBox="0 0 24 24" fill="currentColor"><circle cx="9" cy="6" r="1.5"/><circle cx="15" cy="6" r="1.5"/><circle cx="9" cy="12" r="1.5"/><circle cx="15" cy="12" r="1.5"/><circle cx="9" cy="18" r="1.5"/><circle cx="15" cy="18" r="1.5"/></svg>
+                                </button>
+                                <div class="playlist-track-copy">
+                                    <div class="track-title" x-text="track.title"></div>
+                                    <div class="track-artists-inline">
+                                        <template x-for="(artist, artistIdx) in $store.library.trackArtistLinks(track)" :key="artist.label + '-' + artist.id + '-' + artistIdx">
+                                            <span>
+                                                <template x-if="artistIdx > 0"><span>, </span></template>
+                                                <a class="artist-link"
+                                                   @click.stop="artist.id ? $store.library.openArtist(artist.id) : $store.library.openFederatedArtist(artist.label.replace(/^ft\\.\\s*/, ''))"
+                                                   x-text="artist.label"></a>
+                                            </span>
+                                        </template>
+                                    </div>
                                 </div>
                             </div>
                             <span></span>
@@ -991,14 +1365,19 @@
                                 <button class="track-action-btn info-btn popularity-info-btn"
                                         :class="{ 'has-popularity': $store.library.hasPopularity(track), 'no-popularity': !$store.library.hasPopularity(track) }"
                                         :style="$store.library.popularityStyle(track)"
-                                        @click.stop="$store.library.openTrackInfo(track)"
+                                        @click.stop="track.federation_pending ? $store.library.openFederationTrackInfo(track._federationTrack) : $store.library.openTrackInfo(track)"
                                         :title="$store.library.trackInfoTitle(track)"
                                         aria-label="{{ t.player_track_info }}">
                                     <span x-show="$store.library.hasPopularity(track)" x-text="$store.library.popularityLabel(track)"></span>
                                     <span x-show="!$store.library.hasPopularity(track)" class="info-letter">i</span>
                                 </button>
-                                <button class="like-btn" :class="{ liked: $store.likes.has(track.id) }" @click.stop="$store.likes.toggle(track.id)" title="{{ t.player_like }}">
-                                    <svg viewBox="0 0 24 24" :fill="$store.likes.has(track.id) ? 'currentColor' : 'none'" stroke="currentColor" stroke-width="2"><path d="M20.84 4.61a5.5 5.5 0 00-7.78 0L12 5.67l-1.06-1.06a5.5 5.5 0 00-7.78 7.78L12 21.23l8.84-8.84a5.5 5.5 0 000-7.78z"/></svg>
+                                <button class="like-btn"
+                                        :class="{ liked: track.federation_pending ? $store.library.federationIsLiked(track._federationTrack) : $store.likes.has(track.id) }"
+                                        @click.stop="track.federation_pending ? $store.library.toggleFederationLike(track._federationTrack) : $store.likes.toggle(track.id)"
+                                        title="{{ t.player_like }}">
+                                    <svg viewBox="0 0 24 24"
+                                         :fill="track.federation_pending ? ($store.library.federationIsLiked(track._federationTrack) ? 'currentColor' : 'none') : ($store.likes.has(track.id) ? 'currentColor' : 'none')"
+                                         stroke="currentColor" stroke-width="2"><path d="M20.84 4.61a5.5 5.5 0 00-7.78 0L12 5.67l-1.06-1.06a5.5 5.5 0 00-7.78 7.78L12 21.23l8.84-8.84a5.5 5.5 0 000-7.78z"/></svg>
                                 </button>
                                 <button class="track-action-btn queue-insert-btn queue-next-btn" @click.stop="$store.queue.addNextInQueue([track])" title="{{ t.player_play_next }}">
                                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 6h10M5 12h7M5 18h10"/><path d="M17 9l4 3-4 3" fill="currentColor" stroke="none"/></svg>
@@ -1009,7 +1388,9 @@
                                 <button class="track-action-btn track-share-btn" @click.stop="$store.sharing.copyTrack(track, $event.currentTarget)" title="{{ t.player_share_track }}" aria-label="{{ t.player_share_track }}">
                                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="18" cy="5" r="3"/><circle cx="6" cy="12" r="3"/><circle cx="18" cy="19" r="3"/><path d="M8.6 10.6l6.8-3.9M8.6 13.4l6.8 3.9"/></svg>
                                 </button>
-                                <button class="track-action-btn playlist-add-btn" @click.stop="$store.playlists.showPicker([track.id])" title="{{ t.player_add_to_playlist }}">
+                                <button class="track-action-btn playlist-add-btn"
+                                        @click.stop="track.federation_pending ? $store.playlists.showFederationPicker(track._federationTrack) : $store.playlists.showPicker([track.id])"
+                                        title="{{ t.player_add_to_playlist }}">
                                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M8 6h13M8 12h13M8 18h13M3 6h.01M3 12h.01M3 18h.01"/></svg>
                                 </button>
                             </div>
@@ -1068,6 +1449,31 @@
                             <template x-if="!item.track.cover_url">
                                 <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M9 18V5l12-2v13"/><circle cx="6" cy="18" r="3"/><circle cx="18" cy="16" r="3"/></svg>
                             </template>
+                            <span class="queue-federation-status federation-track-status"
+                                  x-show="item.track.federation_pending"
+                                  x-cloak>
+                                <template x-if="!$store.library.federationDownload(item.track.content_id)">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
+                                        <circle cx="12" cy="12" r="3"/>
+                                        <path d="M5.6 8.5a7.5 7.5 0 000 7M18.4 8.5a7.5 7.5 0 010 7"/>
+                                    </svg>
+                                </template>
+                                <template x-if="$store.library.federationDownload(item.track.content_id)">
+                                    <span class="federation-download-progress"
+                                          :class="{ indeterminate: !$store.library.federationDownload(item.track.content_id).total }">
+                                        <svg viewBox="0 0 20 20">
+                                            <circle class="progress-track" cx="10" cy="10" r="8"/>
+                                            <circle class="progress-value" cx="10" cy="10" r="8"
+                                                    :style="`stroke-dashoffset: ${50.27 * (1 - $store.library.federationDownload(item.track.content_id).percent / 100)}`"/>
+                                        </svg>
+                                        <span class="progress-percent"
+                                              x-show="$store.library.federationDownload(item.track.content_id).total"
+                                              x-text="Math.round($store.library.federationDownload(item.track.content_id).percent)"></span>
+                                        <span class="federation-download-tooltip"
+                                              x-text="$store.library.federationDownloadTooltip(item.track.content_id)"></span>
+                                    </span>
+                                </template>
+                            </span>
                         </div>
                         <div class="queue-track-info">
                             <div class="queue-track-title" x-text="item.track.title"></div>
@@ -1075,7 +1481,9 @@
                                 <template x-for="(artist, artistIdx) in $store.library.trackArtistLinks(item.track)" :key="artist.label + '-' + artist.id + '-' + artistIdx">
                                     <span>
                                         <template x-if="artistIdx > 0"><span>, </span></template>
-                                        <a class="artist-link" @click.stop="$store.library.openArtist(artist.id)" x-text="artist.label"></a>
+                                        <a class="artist-link"
+                                           @click.stop="artist.id ? $store.library.openArtist(artist.id) : $store.library.openFederatedArtist(artist.label.replace(/^ft\\.\\s*/, ''))"
+                                           x-text="artist.label"></a>
                                     </span>
                                 </template>
                             </div>
@@ -1084,7 +1492,7 @@
                             <button class="queue-track-remove info-btn popularity-info-btn"
                                     :class="{ 'has-popularity': $store.library.hasPopularity(item.track), 'no-popularity': !$store.library.hasPopularity(item.track) }"
                                     :style="$store.library.popularityStyle(item.track)"
-                                    @click.stop="$store.library.openTrackInfo(item.track)"
+                                    @click.stop="item.track.federation_pending ? $store.library.openFederationTrackInfo(item.track._federationTrack) : $store.library.openTrackInfo(item.track)"
                                     :title="$store.library.trackInfoTitle(item.track)"
                                     aria-label="{{ t.player_track_info }}">
                                 <span x-show="$store.library.hasPopularity(item.track)" x-text="$store.library.popularityLabel(item.track)"></span>
@@ -1255,7 +1663,8 @@
                     </span>
                 </button>
                 <div class="device-popover" x-show="$store.devices.open" x-transition x-cloak>
-                    <template x-for="device in $store.devices.devices" :key="device.id">
+                    <div class="device-section-label">Web players</div>
+                    <template x-for="device in $store.devices.webDevices()" :key="device.id">
                         <button class="device-row"
                                 :class="{ active: device.is_active, 'current-device': device.is_current }"
                                 @click="$store.devices.select(device.id)">
@@ -1285,6 +1694,34 @@
                             </span>
                         </button>
                     </template>
+                    <template x-if="$store.devices.playbackFedDevices().length > 0">
+                        <div class="device-group-divider">
+                            <span>Trusted federation devices</span>
+                        </div>
+                    </template>
+                    <template x-for="device in $store.devices.playbackFedDevices()" :key="device.id">
+                        <button class="device-row federation-device-row"
+                                :class="{ active: device.is_active }"
+                                @click="$store.devices.select(device.id)">
+                            <span class="device-row-icon federation-device-icon">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
+                                    <circle cx="12" cy="12" r="3"/>
+                                    <path d="M5.6 8.5a7.5 7.5 0 000 7M18.4 8.5a7.5 7.5 0 010 7"/>
+                                    <path d="M2.8 5.8a11 11 0 000 12.4M21.2 5.8a11 11 0 010 12.4"/>
+                                </svg>
+                            </span>
+                            <span class="device-row-main">
+                                <span class="device-row-name" x-text="device.name"></span>
+                                <span class="device-row-current"
+                                      x-text="device.is_active ? 'Active federation device' : 'Available for playback transfer'"></span>
+                            </span>
+                            <span class="device-row-check" x-show="device.is_active">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4">
+                                    <polyline points="20 6 9 17 4 12"/>
+                                </svg>
+                            </span>
+                        </button>
+                    </template>
                     <template x-if="$store.devices.jams.length > 0">
                         <div class="device-section-label jam-section-label">Jams</div>
                     </template>

templates/player/styles.html

@@ -67,11 +67,17 @@ body {
 
 .user-widget-main {
     display: grid;
-    grid-template-columns: 36px minmax(0, 1fr) 32px;
+    grid-template-columns: 36px minmax(0, 1fr) auto;
     align-items: center;
     gap: 10px;
 }
 
+.user-widget-actions {
+    display: flex;
+    align-items: center;
+    gap: 2px;
+}
+
 .user-avatar {
     width: 36px;
     height: 36px;
@@ -489,6 +495,25 @@ button.user-stat:hover {
     font-size: 13px;
 }
 
+.playlist-detail-heading {
+    display: flex;
+    align-items: flex-start;
+    justify-content: space-between;
+    gap: 12px;
+    margin-bottom: 14px;
+}
+
+.playlist-detail-heading .section-title {
+    min-width: 0;
+    margin-bottom: 0;
+    overflow-wrap: anywhere;
+}
+
+.playlist-edit-toggle {
+    flex: 0 0 auto;
+    margin-top: 4px;
+}
+
 .breadcrumb {
     display: flex;
     align-items: center;
@@ -735,6 +760,93 @@ button.user-stat:hover {
 .track-row:hover { background: var(--bg-hover); }
 .track-row.playing { color: var(--accent); }
 .track-row.playing .track-num { color: var(--accent); }
+.playlist-track-list-header.editing,
+.playlist-track-row.editing {
+    grid-template-columns: 32px 40px minmax(0, 1fr) minmax(0, 1fr) 154px 60px;
+}
+
+.playlist-track-row.editing {
+    cursor: grab;
+}
+
+.playlist-track-row.editing:active {
+    cursor: grabbing;
+}
+
+.playlist-track-row.dragging {
+    opacity: 0.45;
+}
+
+.playlist-track-row.drag-over {
+    border-top: 2px solid var(--accent);
+    margin-top: -2px;
+}
+
+.playlist-track-remove {
+    width: 28px;
+    height: 28px;
+    border: 0;
+    border-radius: 4px;
+    background: transparent;
+    color: var(--text-subdued);
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 0;
+    transition: color 0.15s, background 0.15s;
+}
+
+.playlist-track-remove:hover {
+    color: var(--text-primary);
+    background: var(--bg-active);
+}
+
+.playlist-track-remove svg {
+    width: 16px;
+    height: 16px;
+}
+
+.playlist-track-info {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+}
+
+.playlist-track-copy {
+    min-width: 0;
+    overflow: hidden;
+}
+
+.playlist-drag-handle {
+    width: 24px;
+    height: 28px;
+    border: 0;
+    background: transparent;
+    color: var(--text-subdued);
+    cursor: grab;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    flex: 0 0 24px;
+    padding: 0;
+    touch-action: none;
+    user-select: none;
+}
+
+.playlist-drag-handle:active {
+    cursor: grabbing;
+}
+
+.playlist-drag-handle:hover {
+    color: var(--text-primary);
+}
+
+.playlist-drag-handle svg {
+    width: 14px;
+    height: 14px;
+}
+
 .track-row.shared-target {
     background: rgba(29, 185, 84, 0.12);
     box-shadow: inset 3px 0 0 var(--accent);
@@ -1251,20 +1363,50 @@ button.user-stat:hover {
 }
 
 .queue-track-cover {
+    position: relative;
     width: 40px;
     height: 40px;
     border-radius: 4px;
     background: var(--bg-elevated);
-    overflow: hidden;
+    overflow: visible;
     flex-shrink: 0;
     display: flex;
     align-items: center;
     justify-content: center;
 }
 
-.queue-track-cover img { width: 100%; height: 100%; object-fit: cover; }
+.queue-track-cover img { width: 100%; height: 100%; object-fit: cover; border-radius: inherit; }
 .queue-track-cover svg { width: 20px; height: 20px; color: var(--text-subdued); }
 
+.queue-track-cover .queue-federation-status {
+    position: absolute;
+    right: 2px;
+    bottom: 2px;
+    z-index: 3;
+    width: 18px;
+    min-width: 18px;
+    max-width: 18px;
+    height: 18px;
+    min-height: 18px;
+    max-height: 18px;
+    box-sizing: border-box;
+    flex: none;
+    border-radius: 50%;
+    background: var(--bg-elevated);
+    box-shadow: 0 0 0 1px var(--bg-secondary);
+}
+.queue-track-cover .queue-federation-status > svg {
+    width: 13px;
+    height: 13px;
+}
+.queue-track-cover .queue-federation-status .federation-download-progress,
+.queue-track-cover .queue-federation-status .federation-download-progress svg {
+    width: 18px !important;
+    min-width: 18px;
+    height: 18px !important;
+    min-height: 18px;
+}
+
 .queue-track-info { overflow: hidden; flex: 1; }
 .queue-track-title {
     font-size: 13px;
@@ -1750,9 +1892,9 @@ button.user-stat:hover {
     position: absolute;
     right: 0;
     bottom: 38px;
-    width: 260px;
+    width: 320px;
     max-width: calc(100vw - 24px);
-    max-height: min(320px, calc(100dvh - var(--player-bar-space) - 24px));
+    max-height: min(440px, calc(100dvh - var(--player-bar-space) - 24px));
     overflow-y: auto;
     padding: 6px;
     border: 1px solid var(--border-color);
@@ -1849,6 +1991,169 @@ button.user-stat:hover {
     text-transform: uppercase;
 }
 
+.device-group-divider {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    margin: 7px 8px 3px;
+    color: #b8d6ff;
+    font-size: 10px;
+    font-weight: 750;
+    text-transform: uppercase;
+}
+.device-group-divider::before,
+.device-group-divider::after {
+    content: "";
+    height: 1px;
+    flex: 1;
+    background: var(--border-color);
+}
+.device-group-divider span {
+    white-space: nowrap;
+}
+.federation-device-row {
+    color: #c9dcff;
+}
+.federation-device-icon {
+    color: #78a9ff;
+}
+
+.fed-section-label {
+    margin-top: 4px;
+    color: #b8d6ff;
+}
+
+.fed-device-panel {
+    margin: 2px 2px 6px;
+    padding: 8px;
+    border: 1px solid rgba(82,145,255,0.18);
+    border-radius: 6px;
+    background: rgba(82,145,255,0.045);
+    display: grid;
+    gap: 7px;
+}
+
+.fed-device-status,
+.fed-device-error,
+.fed-pairing-note {
+    color: var(--text-subdued);
+    font-size: 11px;
+    line-height: 1.35;
+}
+
+.fed-device-error {
+    color: #ffb2b2;
+}
+
+.fed-device-row {
+    min-height: 32px;
+    display: grid;
+    grid-template-columns: 9px minmax(0, 1fr) auto;
+    align-items: center;
+    gap: 8px;
+}
+
+.fed-device-dot {
+    width: 7px;
+    height: 7px;
+    border-radius: 999px;
+    background: #73d795;
+}
+
+.fed-device-dot.self {
+    background: #ffd166;
+}
+
+.fed-device-main {
+    min-width: 0;
+    display: grid;
+    gap: 1px;
+}
+
+.fed-device-name,
+.fed-pairing-title {
+    color: var(--text-primary);
+    font-size: 12px;
+    font-weight: 750;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.fed-device-meta,
+.fed-pairing-meta {
+    color: var(--text-subdued);
+    font-size: 11px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.fed-pairing-card {
+    padding: 7px;
+    border-radius: 5px;
+    background: rgba(255,255,255,0.04);
+    display: grid;
+    gap: 5px;
+}
+
+.fed-device-actions,
+.fed-connect-row {
+    display: flex;
+    gap: 6px;
+    min-width: 0;
+}
+
+.fed-connect-row .fed-device-input {
+    flex: 1;
+}
+
+.fed-action-btn,
+.fed-revoke-btn {
+    height: 28px;
+    border: 0;
+    border-radius: 4px;
+    background: rgba(255,255,255,0.08);
+    color: var(--text-secondary);
+    padding: 0 8px;
+    font-size: 12px;
+    font-weight: 700;
+    cursor: pointer;
+}
+
+.fed-action-btn:hover,
+.fed-revoke-btn:hover {
+    background: rgba(255,255,255,0.13);
+    color: var(--text-primary);
+}
+
+.fed-action-btn.primary {
+    background: rgba(82,145,255,0.16);
+    color: #c9dcff;
+}
+
+.fed-action-btn:disabled {
+    opacity: 0.45;
+    cursor: default;
+}
+
+.fed-revoke-btn {
+    background: rgba(255,96,96,0.1);
+    color: #ffb2b2;
+}
+
+.fed-device-input {
+    width: 100%;
+    min-width: 0;
+    height: 30px;
+    border: 1px solid rgba(82,145,255,0.2);
+    border-radius: 4px;
+    background: rgba(0,0,0,0.18);
+    color: var(--text-primary);
+    padding: 0 8px;
+    font-size: 12px;
+}
+
 .jam-section-label,
 .jam-row,
 .start-jam-row,
@@ -2194,11 +2499,18 @@ button.user-stat:hover {
 }
 
 .mobile-account-logout {
-    width: 100%;
-    margin-top: 12px;
+    flex: 1;
+    margin: 0;
     justify-content: center;
 }
 
+.mobile-account-actions {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    margin-top: 12px;
+}
+
 .torrent-import-btn {
     display: flex;
     align-items: center;
@@ -2390,6 +2702,105 @@ button.user-stat:hover {
 
 /* Search results */
 .search-section { margin-bottom: 24px; }
+.federation-search-section {
+    border-top: 1px solid var(--border);
+    padding-top: 18px;
+}
+.federation-live-badge {
+    margin-left: 8px;
+    color: var(--accent);
+    font-size: 10px;
+    letter-spacing: .12em;
+}
+.federation-search-status {
+    color: var(--text-muted);
+    padding: 12px 0;
+}
+.federation-search-status.error { color: var(--danger, #e66); }
+.federation-track-status {
+    position: relative;
+    z-index: 1;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+}
+.federation-track-status > svg {
+    width: 18px;
+    height: 18px;
+    color: var(--accent);
+}
+.federation-download-progress {
+    position: relative;
+    display: inline-flex;
+    width: 22px;
+    height: 22px;
+    align-items: center;
+    justify-content: center;
+}
+.federation-download-progress svg {
+    width: 22px !important;
+    height: 22px !important;
+    transform: rotate(-90deg);
+    overflow: hidden;
+}
+.federation-download-progress circle {
+    fill: none;
+    stroke-width: 2;
+}
+.federation-download-progress .progress-track {
+    stroke: color-mix(in srgb, var(--text-muted) 28%, transparent);
+}
+.federation-download-progress .progress-value {
+    stroke: var(--accent);
+    stroke-linecap: round;
+    stroke-dasharray: 50.27;
+    transition: stroke-dashoffset 160ms linear;
+}
+.federation-download-progress.indeterminate .progress-value {
+    stroke-dasharray: 12.57 37.70;
+    transform-box: fill-box;
+    transform-origin: center;
+    animation: federation-progress-spin .8s linear infinite;
+}
+.federation-download-progress .progress-percent {
+    position: absolute;
+    color: var(--text);
+    font-size: 7px;
+    font-weight: 700;
+    line-height: 1;
+}
+.federation-download-tooltip {
+    position: absolute;
+    z-index: 1000;
+    left: calc(100% + 10px);
+    top: 50%;
+    width: max-content;
+    max-width: 290px;
+    padding: 6px 8px;
+    border: 1px solid var(--border);
+    border-radius: 6px;
+    background: var(--bg-elevated);
+    box-shadow: 0 6px 18px rgba(0, 0, 0, .28);
+    color: var(--text);
+    font-size: 11px;
+    font-weight: 500;
+    line-height: 1.35;
+    opacity: 0;
+    pointer-events: none;
+    transform: translate(3px, -50%);
+    transition: opacity 120ms ease, transform 120ms ease;
+}
+.federation-download-progress:hover .federation-download-tooltip {
+    opacity: 1;
+    transform: translate(0, -50%);
+}
+@keyframes federation-progress-spin {
+    to { transform: rotate(360deg); }
+}
+.federation-source-count {
+    color: var(--text-muted);
+    font-size: 12px;
+}
 .search-section-title {
     font-size: 18px;
     font-weight: 700;
@@ -2433,7 +2844,7 @@ button.user-stat:hover {
     position: relative;
 }
 
-.search-artist-img img { width: 100%; height: 100%; object-fit: cover; }
+.search-artist-img img { position: absolute; inset: 0; width: 100%; height: 100%; object-fit: cover; }
 .search-artist-img svg { width: 32px; height: 32px; color: var(--text-subdued); }
 
 .search-artist-name {
@@ -3129,6 +3540,105 @@ button.user-stat:hover {
     max-width: 980px;
 }
 
+.user-settings-modal {
+    width: min(760px, calc(100vw - 32px));
+    max-width: 760px;
+    max-height: min(86dvh, 820px);
+    overflow-y: auto;
+}
+.user-settings-head,
+.user-settings-section-head {
+    display: flex;
+    align-items: flex-start;
+    justify-content: space-between;
+    gap: 16px;
+}
+.user-settings-head {
+    margin-bottom: 16px;
+}
+.user-settings-head h3,
+.user-settings-section h4 {
+    margin: 0;
+}
+.user-settings-head p,
+.user-settings-section p {
+    margin: 4px 0 0;
+    color: var(--text-subdued);
+    font-size: 12px;
+    line-height: 1.45;
+}
+.user-settings-section {
+    padding: 16px 0;
+    border-top: 1px solid var(--border-color);
+}
+.user-settings-devices {
+    display: grid;
+    gap: 12px;
+}
+.settings-device-group {
+    overflow: hidden;
+    border: 1px solid var(--border-color);
+    border-radius: 8px;
+    background: var(--bg-primary);
+}
+.settings-device-label {
+    padding: 8px 11px;
+    border-bottom: 1px solid var(--border-color);
+    color: var(--text-subdued);
+    font-size: 10px;
+    font-weight: 800;
+    text-transform: uppercase;
+}
+.settings-device-row {
+    min-height: 48px;
+    padding: 8px 11px;
+    display: grid;
+    grid-template-columns: 28px minmax(0, 1fr) auto;
+    align-items: center;
+    gap: 10px;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.055);
+}
+.settings-device-row:last-child {
+    border-bottom: 0;
+}
+.settings-device-row.federation {
+    background: rgba(82, 145, 255, 0.035);
+}
+.settings-primary-btn,
+.settings-secondary-btn {
+    min-height: 34px;
+    padding: 7px 12px;
+    border: 1px solid var(--border-color);
+    border-radius: 6px;
+    background: var(--bg-hover);
+    color: var(--text-primary);
+    cursor: pointer;
+    font-size: 12px;
+    font-weight: 750;
+    white-space: nowrap;
+}
+.settings-primary-btn {
+    border-color: rgba(82, 145, 255, 0.4);
+    background: rgba(82, 145, 255, 0.18);
+    color: #d5e4ff;
+}
+.settings-primary-btn:hover,
+.settings-secondary-btn:hover {
+    filter: brightness(1.12);
+}
+.settings-primary-btn:disabled,
+.settings-secondary-btn:disabled {
+    cursor: default;
+    opacity: .55;
+}
+.settings-pairing-actions {
+    display: grid;
+    gap: 8px;
+}
+.settings-pairing-actions > .settings-primary-btn {
+    justify-self: start;
+}
+
 .history-head {
     display: flex;
     align-items: flex-start;
@@ -4233,6 +4743,16 @@ button.user-stat:hover {
         justify-content: flex-end;
     }
 
+    .playlist-track-list-header.editing,
+    .playlist-track-row.editing {
+        grid-template-columns: 30px 32px minmax(0, 1fr) auto 54px;
+    }
+
+    .playlist-track-list-header.editing span:nth-child(4),
+    .playlist-track-row.editing > span:nth-child(4) {
+        display: none;
+    }
+
     .history-table-head,
     .history-row.track-row {
         grid-template-columns: 44px minmax(0, 1fr) auto;
@@ -5158,6 +5678,26 @@ button.user-stat:hover {
         padding: 10px 6px;
     }
 
+    .playlist-detail-heading {
+        align-items: center;
+        gap: 8px;
+        margin-bottom: 12px;
+    }
+
+    .playlist-edit-toggle {
+        padding: 8px 10px;
+        margin-top: 0;
+    }
+
+    .playlist-track-row.editing {
+        grid-template-columns: 30px minmax(0, 1fr) auto;
+    }
+
+    .playlist-track-row.editing .track-num,
+    .playlist-track-row.editing > span:nth-child(4) {
+        display: none;
+    }
+
     .track-row > span:nth-child(3),
     .track-duration {
         display: none;