feat(settings): export / import your data (#114 )

Settings -> General -> "Your data": Export writes one JSON file of the account's Lotus data (synced settings, bookmarks, private notes, room names and sections, reminders, status presets, thread notification settings, timed mutes, soundboard (clips stay on the server), emoji packs, avatar decoration, and this device's settings). Not messages or encryption keys: they have their own exports, and keys are secret. Import merges: new items are added; things that differ are listed per category and kept unless the user picks "Use the file's". Only our own account-data types are read from a file. Files from a newer Lotus Chat are refused with a plain message; the version stamp leaves room to migrate older ones. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
2026-10-25 01:08:28 -04:00
11 changed files with 690 additions and 294 deletions
@@ -1,98 +0,0 @@
-import { test, expect, Page } from '@playwright/test';
-import { HS, PASSWORD, api, ensureUser, hsReachable, loginUI, uniq } from './localHs';
-
-// [Gitea #113] Sessions unused for 90+ days: a nudge (after the device-security
-// one), and Review opens Settings → Devices with them ticked for sign-out.
-// Synapse won't backdate last-seen, so the session list is served with one
-// real extra session made 120 days old.
-const DAY = 86_400_000;
-
-const strip = (page: Page, text: RegExp) => page.getByRole('status').filter({ hasText: text });
-
-async function pastGrace(page: Page) {
-  await page.evaluate(() => {
-    const { deviceId } = JSON.parse(localStorage.getItem('cinny_session_v1') ?? '{}');
-    localStorage.setItem(
-      `lotus-security-nudge-${deviceId}`,
-      JSON.stringify({ firstSeen: Date.now() - 2 * 86_400_000, dismissals: {} }),
-    );
-  });
-  await page.reload();
-}
-
-async function settled(page: Page) {
-  await page
-    .getByText('Connecting...')
-    .first()
-    .waitFor({ timeout: 30_000 })
-    .catch(() => undefined);
-  await page.getByText('Connecting...').first().waitFor({ state: 'detached', timeout: 90_000 });
-}
-
-test.describe('stale sessions (#113)', () => {
-  test.beforeAll(async () => {
-    test.skip(!(await hsReachable()), 'local homeserver not running');
-  });
-
-  test('nudge after the security one, Review ticks the old session, sign-out works', async ({
-    page,
-  }) => {
-    test.setTimeout(180_000);
-    const user = await ensureUser(uniq('ss'));
-    // Two extra sessions: one we'll make look 4 months old, one recent.
-    const login = (device: string) =>
-      api<{ device_id: string }>('POST', '/_matrix/client/v3/login', undefined, {
-        type: 'm.login.password',
-        identifier: { type: 'm.id.user', user: user.localpart },
-        password: PASSWORD,
-        device_id: device,
-        initial_device_display_name: device,
-      });
-    await login('OLDLAPTOP');
-    await login('RECENTPHONE');
-    await page.route(/\/_matrix\/client\/v3\/devices(\?.*)?$/, async (route) => {
-      const res = await route.fetch();
-      const body = await res.json();
-      for (const d of body.devices ?? []) {
-        if (d.device_id === 'OLDLAPTOP') d.last_seen_ts = Date.now() - 120 * DAY;
-        else d.last_seen_ts = Date.now() - DAY;
-      }
-      await route.fulfill({ response: res, json: body });
-    });
-
-    await loginUI(page, user);
-    await pastGrace(page);
-    await settled(page);
-
-    // A fresh account has no key backup: that nudge comes first.
-    const security = strip(page, /encryption keys/);
-    await expect(security).toBeVisible({ timeout: 30_000 });
-    await security.getByRole('button', { name: 'Not now' }).click();
-
-    const stale = strip(page, /a session you haven't used in 3 months/);
-    await expect(stale).toBeVisible({ timeout: 30_000 });
-    await stale.getByRole('button', { name: 'Review' }).click();
-
-    const dialog = page.getByRole('dialog').first();
-    await expect(dialog.getByText('Inactive for 3+ months')).toHaveCount(1);
-    await expect(dialog.getByText(/Logout from selected devices\. \(1 selected\)/)).toBeVisible();
-
-    // The sticky "Logout from selected devices" bar comes last.
-    await dialog.getByRole('button', { name: 'Logout', exact: true }).last().click();
-    await page.locator('input[name="passwordInput"]').fill(PASSWORD);
-    await page.getByRole('button', { name: 'Continue' }).click();
-    await expect(dialog.getByText(/Logout from selected devices/)).toHaveCount(0, {
-      timeout: 30_000,
-    });
-
-    const { devices } = await api<{ devices: { device_id: string }[] }>(
-      'GET',
-      '/_matrix/client/v3/devices',
-      user.token,
-    );
-    const ids = devices.map((d) => d.device_id);
-    expect(ids).not.toContain('OLDLAPTOP');
-    expect(ids).toContain('RECENTPHONE');
-    expect(HS).toBeTruthy();
-  });
-});
@@ -0,0 +1,98 @@
+import fs from 'node:fs';
+import { test, expect } from '@playwright/test';
+import { api, ensureUser, hsReachable, loginUI, uniq } from './localHs';
+
+// [Gitea #114] Export / import "your data": a round trip through the file, the
+// merge summary, and the keep-mine / use-the-file's choice.
+const enc = encodeURIComponent;
+
+test.describe('your data (#114)', () => {
+  test.beforeAll(async () => {
+    test.skip(!(await hsReachable()), 'local homeserver not running');
+  });
+
+  test('export, change things, import merges with the chosen conflict rule', async ({ page }) => {
+    test.setTimeout(150_000);
+    const user = await ensureUser(uniq('yd'));
+    const put = (type: string, content: unknown) =>
+      api(
+        'PUT',
+        `/_matrix/client/v3/user/${enc(user.userId)}/account_data/${type}`,
+        user.token,
+        content,
+      );
+    const get = (type: string) =>
+      api<Record<string, unknown>>(
+        'GET',
+        `/_matrix/client/v3/user/${enc(user.userId)}/account_data/${type}`,
+        user.token,
+      );
+    const bm = (eventId: string) => ({ roomId: '!r:localhost', eventId, savedAt: 1 });
+    await put('io.lotus.bookmarks', { bookmarks: [bm('$one'), bm('$two')] });
+    await put('io.lotus.user_notes', { '@friend:localhost': 'met at the LAN party' });
+
+    await loginUI(page, user);
+    await page
+      .getByText('Connecting...')
+      .first()
+      .waitFor({ state: 'detached', timeout: 90_000 })
+      .catch(() => undefined);
+    const openGeneral = async () => {
+      await page.getByRole('button', { name: 'User Settings' }).click();
+      await page.getByRole('dialog').getByText('General', { exact: true }).first().click();
+      await page
+        .getByRole('dialog')
+        .getByText('Your data', { exact: true })
+        .scrollIntoViewIfNeeded();
+    };
+    await openGeneral();
+
+    // Export.
+    const [download] = await Promise.all([
+      page.waitForEvent('download'),
+      page.getByRole('dialog').getByRole('button', { name: 'Export', exact: true }).click(),
+    ]);
+    const path = await download.path();
+    const file = JSON.parse(fs.readFileSync(path!, 'utf8'));
+    expect(file.format).toBe('lotus-chat-data');
+    expect(file.accountData['io.lotus.bookmarks'].bookmarks).toHaveLength(2);
+    expect(file.local.settings).toBeTruthy();
+
+    // Lose a bookmark, change the note.
+    await put('io.lotus.bookmarks', { bookmarks: [bm('$one')] });
+    await put('io.lotus.user_notes', { '@friend:localhost': 'changed my mind' });
+    await page.waitForTimeout(3000); // let sync deliver the new account data
+
+    const importFile = async () => {
+      await page
+        .locator('input[type="file"][aria-label="Lotus Chat data file"]')
+        .setInputFiles(path!);
+      await expect(page.getByRole('region', { name: 'Import summary' })).toBeVisible();
+    };
+    await importFile();
+    const summary = page.getByRole('region', { name: 'Import summary' });
+    await expect(summary).toContainText('Bookmarks: 1 new');
+    await expect(summary).toContainText('Private notes about people: 1 differ');
+
+    // Keep mine: the bookmark comes back, the note stays as it is now.
+    await summary.getByRole('button', { name: 'Import', exact: true }).click();
+    await expect(page.getByText('Imported.')).toBeVisible({ timeout: 20_000 });
+    expect(((await get('io.lotus.bookmarks')).bookmarks as unknown[]).length).toBe(2);
+    expect((await get('io.lotus.user_notes'))['@friend:localhost']).toBe('changed my mind');
+
+    // Again, using the file's: the note goes back.
+    await page.waitForTimeout(2000);
+    await importFile();
+    await summary.getByText("Use the file's").click();
+    await summary.getByRole('button', { name: 'Import', exact: true }).click();
+    await expect(page.getByText('Imported.')).toBeVisible({ timeout: 20_000 });
+    expect((await get('io.lotus.user_notes'))['@friend:localhost']).toBe('met at the LAN party');
+
+    // Wrong files are refused with a plain message.
+    fs.writeFileSync(`${path}.bad`, '{"format":"something-else"}');
+    await page
+      .locator('input[type="file"][aria-label="Lotus Chat data file"]')
+      .setInputFiles(`${path}.bad`);
+    await expect(page.getByText("This isn't a Lotus Chat data file.")).toBeVisible();
+  });
+});
@@ -23,11 +23,8 @@ import {
  nudgeFor,
  NudgeRecord,
  parseNudgeRecord,
-  pickNudge,
-  staleSessions,
-  staleSessionsText,
+  shouldShowNudge,
 } from '../../utils/securityNudge';
-import { preselectSignOutAtom } from '../../state/staleSessions';
 import { StatusStrip } from '../server-status/ServerStatusBanner';

 /** This device's backup connection: undefined until known, then true/false. */
@@ -43,35 +40,6 @@ const useBackupActive = (crypto: CryptoApi): boolean | undefined => {
  return active;
 };

-/**
- * [Gitea #113] Ids of this account's sessions unused for 90+ days. Fetched
- * once sync has settled, then hourly; [] until known or on error.
- */
-const useStaleSessionIds = (enabled: boolean): string[] => {
-  const mx = useMatrixClient();
-  const alive = useAlive();
-  const [ids, setIds] = useState<string[]>([]);
-  useEffect(() => {
-    if (!enabled) return undefined;
-    const load = () =>
-      mx
-        .getDevices()
-        .then(({ devices }) => {
-          if (alive())
-            setIds(
-              staleSessions(devices, mx.getDeviceId() ?? undefined, Date.now()).map(
-                (d) => d.device_id,
-              ),
-            );
-        })
-        .catch(() => undefined);
-    load();
-    const t = window.setInterval(load, 60 * 60 * 1000);
-    return () => window.clearInterval(t);
-  }, [mx, enabled, alive]);
-  return ids;
-};
-
 const readRecord = (key: string): NudgeRecord => {
  let raw: string | null = null;
  try {
@@ -116,15 +84,12 @@ function SecurityBannerFor({ crypto }: { crypto: CryptoApi }) {
  let deviceVerified: boolean | undefined;
  if (status === VerificationStatus.Verified) deviceVerified = true;
  else if (status === VerificationStatus.Unverified) deviceVerified = false;
-  const securityKind = nudgeFor({
+  const kind = nudgeFor({
    crossSigning,
    deviceVerified,
    backupOnServer: backupInfo === undefined ? undefined : backupInfo !== null,
    backupActive,
  });
-  const staleIds = useStaleSessionIds(settled);
-  const setPreselect = useSetAtom(preselectSignOutAtom);
-  const kind = pickNudge(securityKind, staleIds.length, record, Date.now());

  // One strip at a time: outages, maintenance and a lost connection win.
  // [Gitea #307] Pass what the user dismissed: a dismissed announcement isn't
@@ -132,12 +97,10 @@ function SecurityBannerFor({ crypto }: { crypto: CryptoApi }) {
  const otherStrip =
    syncLost ||
    !!pickBanner(serverStatus, { syncLost, where: 'client', dismissed: new Set(statusDismissed) });
-  if (!settled || !deviceId || !kind || otherStrip) return null;
+  if (!settled || !deviceId || !kind || otherStrip || !shouldShowNudge(kind, record, Date.now()))
+    return null;

-  const copy =
-    kind === 'stale-sessions'
-      ? { ...NUDGE_COPY[kind], text: staleSessionsText(staleIds.length) }
-      : NUDGE_COPY[kind];
+  const copy = NUDGE_COPY[kind];
  const dismiss = () => {
    const next = dismissNudge(kind, record, Date.now());
    try {
@@ -150,15 +113,8 @@ function SecurityBannerFor({ crypto }: { crypto: CryptoApi }) {
  return (
    <StatusStrip
      banner={{ key: kind, tone: 'Primary', text: copy.text, dismissable: true }}
-      action={{
-        label: copy.action,
-        onClick: () => {
-          // Review: the Devices page opens with these ticked for sign-out.
-          if (kind === 'stale-sessions') setPreselect(staleIds);
-          requestSettings('devices');
-        },
-      }}
-      icon={kind === 'stale-sessions' ? Icons.Category : Icons.ShieldUser}
+      icon={Icons.ShieldUser}
+      action={{ label: copy.action, onClick: () => requestSettings('devices') }}
      dismissLabel="Not now"
      onDismiss={dismiss}
    />
@@ -1,5 +1,4 @@
-import React, { useCallback, useEffect, useState } from 'react';
-import { useAtom } from 'jotai';
+import React, { useCallback, useState } from 'react';
 import { Box, Button, config, Menu, Spinner, Text } from 'folds';
 import { AuthDict, IMyDevice, MatrixError } from 'matrix-js-sdk';
 import { SequenceCard } from '../../../components/sequence-card';
@@ -16,8 +15,6 @@ import { useAuthMetadata } from '../../../hooks/useAuthMetadata';
 import { withSearchParam } from '../../../pages/pathUtils';
 import { useAccountManagementActions } from '../../../hooks/useAccountManagement';
 import { SettingTile } from '../../../components/setting-tile';
-import { preselectSignOutAtom } from '../../../state/staleSessions';
-import { staleSessions } from '../../../utils/securityNudge';

 type OtherDevicesProps = {
  devices: IMyDevice[];
@@ -32,23 +29,6 @@ export function OtherDevices({ devices, refreshDeviceList, showVerification }: O

  const [deleted, setDeleted] = useState<Set<string>>(new Set());

-  // [Gitea #113] The stale-sessions nudge's Review: tick those sessions for
-  // sign-out (one confirm below). OIDC accounts sign out on the provider's
-  // dashboard instead, so nothing is ticked there.
-  const [preselect, setPreselect] = useAtom(preselectSignOutAtom);
-  useEffect(() => {
-    if (preselect.length === 0) return;
-    if (!authMetadata) {
-      const present = new Set(devices.map((d) => d.device_id));
-      setDeleted(new Set(preselect.filter((id) => present.has(id))));
-    }
-    setPreselect([]);
-  }, [preselect, setPreselect, devices, authMetadata]);
-
-  const staleIds = new Set(
-    staleSessions(devices, mx.getDeviceId() ?? undefined, Date.now()).map((d) => d.device_id),
-  );
-
  const handleDashboardOIDC = useCallback(() => {
    const authUrl = authMetadata?.account_management_uri ?? authMetadata?.issuer;
    if (!authUrl) return;
@@ -152,20 +132,8 @@ export function OtherDevices({ devices, refreshDeviceList, showVerification }: O
            />
          </SequenceCard>
        )}
-        {staleIds.size > 0 && (
-          <Text size="T200" priority="300">
-            {staleIds.size === 1
-              ? "1 session hasn't been used in 3 months or more (marked Inactive)."
-              : `${staleIds.size} sessions haven't been used in 3 months or more (marked Inactive).`}{' '}
-            Sign out the ones you no longer use.
-          </Text>
-        )}
-        {[...devices]
-          // [Gitea #113] Inactive (90+ days) sessions first, then most recent.
+        {devices
          .sort((d1, d2) => {
-            const s1 = staleIds.has(d1.device_id) ? 0 : 1;
-            const s2 = staleIds.has(d2.device_id) ? 0 : 1;
-            if (s1 !== s2) return s1 - s2;
            if (!d1.last_seen_ts || !d2.last_seen_ts) return 0;
            return d1.last_seen_ts < d2.last_seen_ts ? 1 : -1;
          })
@@ -177,11 +145,6 @@ export function OtherDevices({ devices, refreshDeviceList, showVerification }: O
              direction="Column"
              gap="400"
            >
-              {staleIds.has(device.device_id) && (
-                <Text size="L400" style={{ color: 'inherit' }}>
-                  Inactive for 3+ months
-                </Text>
-              )}
              <DeviceTile
                device={device}
                deleted={deleted.has(device.device_id)}
@@ -61,6 +61,7 @@ import {
 } from '../../../utils/lotusDenoiseUtils';
 import { useSetting } from '../../../state/hooks/settings';
 import { useSettingsSyncActions } from '../../../hooks/useSettingsSync';
+import { YourDataSection } from './YourData';
 import {
  CallAudioBitrate,
  ChatBackground,
@@ -3007,6 +3008,7 @@ export function General({ requestClose }: GeneralProps) {
              <Privacy />
              <StorageUsage />
              <SettingsSyncSection />
+              <YourDataSection />
              <Calls />
              <DesktopSettings />
              <AppUpdates />
@@ -0,0 +1,285 @@
+import React, { useCallback, useRef, useState } from 'react';
+import { useAtom } from 'jotai';
+import { Method } from 'matrix-js-sdk';
+import { Box, Button, Text, color } from 'folds';
+import { SequenceCard } from '../../../components/sequence-card';
+import { SequenceCardStyle } from '../styles.css';
+import { SettingTile } from '../../../components/setting-tile';
+import { useMatrixClient } from '../../../hooks/useMatrixClient';
+import { Settings, settingsAtom } from '../../../state/settings';
+import {
+  buildExport,
+  EXPORT_ACCOUNT_DATA,
+  ExportFile,
+  ImportPlanItem,
+  mergeData,
+  parseExport,
+  planImport,
+} from '../../../utils/dataExport';
+import { invalidateDecorationCache } from '../../../hooks/useAvatarDecoration';
+
+const DECORATION_FIELD = 'io.lotus.avatar_decoration';
+
+type Current = {
+  accountData: Record<string, unknown>;
+  decoration: string | null;
+  localSettings: Record<string, unknown> | null;
+};
+
+/**
+ * [Gitea #114] "Your data": export the account's Lotus data (settings,
+ * bookmarks, notes, sections, ...) to a file and import it here or on another
+ * account. Import merges: new things are added; for things that differ the
+ * user picks "keep mine" (default) or "use the file's". Message history and
+ * encryption keys have their own exports.
+ */
+export function YourDataSection() {
+  const mx = useMatrixClient();
+  const userId = mx.getSafeUserId();
+  const [settings, setSettings] = useAtom(settingsAtom);
+  const fileInput = useRef<HTMLInputElement>(null);
+  const [pending, setPending] = useState<{ file: ExportFile; plan: ImportPlanItem[] }>();
+  const [preferFile, setPreferFile] = useState(false);
+  const [message, setMessage] = useState<{ tone: 'ok' | 'error'; text: string }>();
+  const [busy, setBusy] = useState(false);
+
+  const readCurrent = useCallback(async (): Promise<Current> => {
+    const accountData: Record<string, unknown> = {};
+    EXPORT_ACCOUNT_DATA.forEach(({ type }) => {
+      const c = mx.getAccountData(type as never)?.getContent();
+      if (c && Object.keys(c).length > 0) accountData[type] = c;
+    });
+    let decoration: string | null = null;
+    try {
+      const profile = await mx.http.authedRequest<Record<string, unknown>>(
+        Method.Get,
+        `/profile/${encodeURIComponent(userId)}`,
+      );
+      const v = profile[DECORATION_FIELD];
+      decoration = typeof v === 'string' && v ? v : null;
+    } catch {
+      /* no decoration */
+    }
+    return {
+      accountData,
+      decoration,
+      localSettings: settings as unknown as Record<string, unknown>,
+    };
+  }, [mx, userId, settings]);
+
+  const exportData = async () => {
+    setBusy(true);
+    setMessage(undefined);
+    try {
+      const cur = await readCurrent();
+      const file = buildExport({ userId, ...cur });
+      const blob = new Blob([JSON.stringify(file, null, 2)], { type: 'application/json' });
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement('a');
+      a.href = url;
+      a.download = `lotus-chat-data-${userId.replace(/[^a-z0-9]+/gi, '-')}-${file.exportedAt.slice(0, 10)}.json`;
+      a.click();
+      URL.revokeObjectURL(url);
+      setMessage({ tone: 'ok', text: 'Exported. Keep the file somewhere safe.' });
+    } catch {
+      setMessage({ tone: 'error', text: "Couldn't export your data. Please try again." });
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const chooseFile = async (f: File | undefined) => {
+    if (!f) return;
+    setMessage(undefined);
+    const parsed = parseExport(await f.text());
+    if (!parsed.ok) {
+      setMessage({ tone: 'error', text: parsed.error });
+      return;
+    }
+    const plan = planImport(parsed.file, await readCurrent());
+    setPreferFile(false);
+    setPending({ file: parsed.file, plan });
+  };
+
+  const applyImport = async () => {
+    if (!pending) return;
+    setBusy(true);
+    try {
+      const cur = await readCurrent();
+      const { file } = pending;
+      await Object.entries(file.accountData).reduce<Promise<void>>(
+        async (prev, [type, incoming]) => {
+          await prev;
+          const r = mergeData(cur.accountData[type], incoming, preferFile);
+          if (r.added > 0 || (preferFile && r.conflicts > 0)) {
+            await mx.setAccountData(type as never, r.value as never);
+          }
+        },
+        Promise.resolve(),
+      );
+      const deco = file.profile.decoration;
+      if (deco && deco !== cur.decoration && (!cur.decoration || preferFile)) {
+        await mx.http.authedRequest(
+          Method.Put,
+          `/profile/${encodeURIComponent(userId)}/${DECORATION_FIELD}`,
+          undefined,
+          { [DECORATION_FIELD]: deco },
+        );
+        invalidateDecorationCache(userId);
+      }
+      if (file.local.settings) {
+        const r = mergeData(cur.localSettings ?? {}, file.local.settings, preferFile);
+        setSettings({ ...settings, ...(r.value as Partial<Settings>) });
+      }
+      setPending(undefined);
+      setMessage({ tone: 'ok', text: 'Imported.' });
+    } catch {
+      setMessage({ tone: 'error', text: "Couldn't finish the import. Nothing else was changed." });
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const totals = pending?.plan.reduce(
+    (t, p) => ({ added: t.added + p.added, conflicts: t.conflicts + p.conflicts }),
+    { added: 0, conflicts: 0 },
+  );
+
+  return (
+    <Box direction="Column" gap="100">
+      <Text size="L400">Your data</Text>
+      <SequenceCard
+        className={SequenceCardStyle}
+        variant="SurfaceVariant"
+        direction="Column"
+        gap="400"
+      >
+        <SettingTile
+          title="Export your data"
+          description="Settings, bookmarks, private notes, room sections and names, reminders, status presets, soundboard and emoji, as one file. Not your messages or encryption keys (they have their own exports)."
+          after={
+            <Button
+              size="300"
+              variant="Secondary"
+              fill="Soft"
+              radii="300"
+              outlined
+              disabled={busy}
+              onClick={exportData}
+            >
+              <Text size="B300">Export</Text>
+            </Button>
+          }
+        />
+        <SettingTile
+          title="Import data"
+          description="Load a Lotus Chat data file into this account. New items are added; you choose what happens to things that differ."
+          after={
+            <Button
+              size="300"
+              variant="Secondary"
+              fill="Soft"
+              radii="300"
+              outlined
+              disabled={busy}
+              onClick={() => fileInput.current?.click()}
+            >
+              <Text size="B300">Import…</Text>
+            </Button>
+          }
+        />
+        <input
+          ref={fileInput}
+          type="file"
+          accept="application/json,.json"
+          hidden
+          aria-label="Lotus Chat data file"
+          onChange={(e) => {
+            chooseFile(e.target.files?.[0]).catch(() => undefined);
+            e.target.value = '';
+          }}
+        />
+        {pending && totals && (
+          <Box direction="Column" gap="200" role="region" aria-label="Import summary">
+            {pending.file.userId && pending.file.userId !== userId && (
+              <Text size="T200">
+                This file is from <b>{pending.file.userId}</b>.
+              </Text>
+            )}
+            {pending.plan.map((p) => (
+              <Text key={p.key} size="T200">
+                {p.label}:{' '}
+                {p.added === 0 && p.conflicts === 0
+                  ? 'already up to date'
+                  : [p.added > 0 && `${p.added} new`, p.conflicts > 0 && `${p.conflicts} differ`]
+                      .filter(Boolean)
+                      .join(', ')}
+              </Text>
+            ))}
+            {totals.conflicts > 0 && (
+              <Box direction="Column" gap="100" role="radiogroup" aria-label="Things that differ">
+                <Text size="T200">
+                  <b>{totals.conflicts}</b>{' '}
+                  {totals.conflicts === 1 ? 'thing differs' : 'things differ'} from what&apos;s
+                  here:
+                </Text>
+                <label>
+                  <input
+                    type="radio"
+                    name="your-data-conflicts"
+                    checked={!preferFile}
+                    onChange={() => setPreferFile(false)}
+                  />{' '}
+                  <Text as="span" size="T200">
+                    Keep mine
+                  </Text>
+                </label>
+                <label>
+                  <input
+                    type="radio"
+                    name="your-data-conflicts"
+                    checked={preferFile}
+                    onChange={() => setPreferFile(true)}
+                  />{' '}
+                  <Text as="span" size="T200">
+                    Use the file&apos;s
+                  </Text>
+                </label>
+              </Box>
+            )}
+            <Box gap="200">
+              <Button
+                size="300"
+                variant="Primary"
+                radii="300"
+                disabled={busy || (totals.added === 0 && !(preferFile && totals.conflicts > 0))}
+                onClick={applyImport}
+              >
+                <Text size="B300">Import</Text>
+              </Button>
+              <Button
+                size="300"
+                variant="Secondary"
+                fill="Soft"
+                radii="300"
+                disabled={busy}
+                onClick={() => setPending(undefined)}
+              >
+                <Text size="B300">Cancel</Text>
+              </Button>
+            </Box>
+          </Box>
+        )}
+        {message && (
+          <Text
+            size="T200"
+            role="status"
+            style={{ color: message.tone === 'error' ? color.Critical.Main : undefined }}
+          >
+            {message.text}
+          </Text>
+        )}
+      </SequenceCard>
+    </Box>
+  );
+}
@@ -1,7 +0,0 @@
-import { atom } from 'jotai';
-
-/**
- * [Gitea #113] Session ids the stale-sessions nudge's Review asked Settings →
- * Devices to tick for sign-out. Consumed (and cleared) by OtherDevices.
- */
-export const preselectSignOutAtom = atom<string[]>([]);
@@ -0,0 +1,76 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { buildExport, mergeData, parseExport, planImport } from './dataExport';
+
+const file = buildExport({
+  userId: '@a:hs',
+  accountData: {
+    'io.lotus.bookmarks': { bookmarks: [{ id: 'b1', note: 'x' }] },
+    'io.lotus.user_notes': { notes: { '@b:hs': 'met at LAN party' } },
+    'm.direct': { secret: true },
+    'io.lotus.settings': { theme: 'dark', fontSize: 16 },
+  },
+  decoration: 'halo',
+  localSettings: { callNoiseSuppression: 'ml' },
+  now: new Date('2026-10-25T00:00:00Z'),
+});
+
+test('[#114] export keeps only our own types', () => {
+  assert.equal(file.format, 'lotus-chat-data');
+  assert.equal(file.version, 1);
+  assert.deepEqual(Object.keys(file.accountData).sort(), [
+    'io.lotus.bookmarks',
+    'io.lotus.settings',
+    'io.lotus.user_notes',
+  ]);
+  assert.equal(file.profile.decoration, 'halo');
+});
+
+test('[#114] parse: round trip, wrong files, newer versions, foreign types', () => {
+  const r = parseExport(JSON.stringify(file));
+  assert.ok(r.ok);
+  assert.equal(parseExport('nope').ok, false);
+  assert.equal(parseExport('{"format":"other"}').ok, false);
+  const newer = parseExport(JSON.stringify({ ...file, version: 2 }));
+  assert.ok(!newer.ok && /newer Lotus Chat/.test(newer.error));
+  const sneaky = parseExport(
+    JSON.stringify({ ...file, accountData: { 'm.push_rules': {}, 'io.lotus.bookmarks': {} } }),
+  );
+  assert.ok(sneaky.ok);
+  assert.deepEqual(Object.keys(sneaky.file.accountData), ['io.lotus.bookmarks']);
+});
+
+test('[#114] merge: lists by id, maps by key, conflicts kept unless preferred', () => {
+  const mine = { bookmarks: [{ id: 'b1', note: 'mine' }, { id: 'b2' }] };
+  const theirs = { bookmarks: [{ id: 'b1', note: 'theirs' }, { id: 'b3' }] };
+  const keep = mergeData(mine, theirs);
+  assert.equal(keep.added, 1);
+  assert.equal(keep.conflicts, 1);
+  assert.deepEqual(keep.value, {
+    bookmarks: [{ id: 'b1', note: 'mine' }, { id: 'b2' }, { id: 'b3' }],
+  });
+  const take = mergeData(mine, theirs, true);
+  assert.deepEqual((take.value as typeof mine).bookmarks[0], { id: 'b1', note: 'theirs' });
+
+  const notes = mergeData({ a: 1, b: 2 }, { b: 3, c: 4 });
+  assert.deepEqual(notes, { value: { a: 1, b: 2, c: 4 }, added: 1, conflicts: 1 });
+  assert.deepEqual(mergeData(undefined, { x: 1 }), { value: { x: 1 }, added: 1, conflicts: 0 });
+  assert.deepEqual(mergeData(['a'], ['a', 'b']).value, ['a', 'b']);
+});
+
+test('[#114] plan summarises per category', () => {
+  const plan = planImport(file, {
+    accountData: { 'io.lotus.settings': { theme: 'light' } },
+    decoration: null,
+    localSettings: { callNoiseSuppression: 'ml' },
+  });
+  const by = Object.fromEntries(plan.map((p) => [p.key, p]));
+  assert.deepEqual(
+    [by['io.lotus.settings'].added, by['io.lotus.settings'].conflicts],
+    [1, 1],
+    'fontSize new, theme differs',
+  );
+  assert.equal(by['io.lotus.bookmarks'].added, 1);
+  assert.equal(by['profile.decoration'].added, 1);
+  assert.deepEqual([by['local.settings'].added, by['local.settings'].conflicts], [0, 0]);
+});
@@ -0,0 +1,219 @@
+/**
+ * [Gitea #114] Export / import "your data": the Lotus-side personal data of
+ * an account (not message history, not encryption keys: those have their own
+ * exports, and keys are secret). One JSON file:
+ *
+ *   { format: 'lotus-chat-data', version: 1, exportedAt, userId,
+ *     accountData: { [type]: content }, profile: { decoration }, local: { settings } }
+ *
+ * Import MERGES: anything missing here is added; a value that differs is a
+ * conflict, kept as it is unless the user chooses the file's. Pure helpers.
+ */
+
+export const EXPORT_FORMAT = 'lotus-chat-data';
+export const EXPORT_VERSION = 1;
+
+/** The account-data types that are the user's own Lotus data, with labels. */
+export const EXPORT_ACCOUNT_DATA: { type: string; label: string }[] = [
+  { type: 'io.lotus.settings', label: 'Synced settings' },
+  { type: 'io.lotus.bookmarks', label: 'Bookmarks' },
+  { type: 'io.lotus.user_notes', label: 'Private notes about people' },
+  { type: 'io.lotus.room_names', label: 'Your names for rooms' },
+  { type: 'in.cinny.spaces', label: 'Room sections and sidebar' },
+  { type: 'io.lotus.reminders', label: 'Reminders' },
+  { type: 'io.lotus.status_presets', label: 'Status presets' },
+  { type: 'io.lotus.thread_notifications', label: 'Thread notification settings' },
+  { type: 'io.lotus.mute_timers', label: 'Timed mutes' },
+  { type: 'io.lotus.soundboard', label: 'Soundboard (clips stay on the server)' },
+  { type: 'io.lotus.soundboard_rooms', label: 'Soundboards enabled everywhere' },
+  { type: 'im.ponies.user_emotes', label: 'Your emoji and stickers' },
+  { type: 'im.ponies.emote_rooms', label: 'Emoji packs enabled everywhere' },
+];
+
+export type ExportFile = {
+  format: typeof EXPORT_FORMAT;
+  version: number;
+  exportedAt: string;
+  userId: string;
+  accountData: Record<string, unknown>;
+  profile: { decoration: string | null };
+  local: { settings: Record<string, unknown> | null };
+};
+
+export const buildExport = (input: {
+  userId: string;
+  accountData: Record<string, unknown>;
+  decoration: string | null;
+  localSettings: Record<string, unknown> | null;
+  now?: Date;
+}): ExportFile => {
+  const accountData: Record<string, unknown> = {};
+  EXPORT_ACCOUNT_DATA.forEach(({ type }) => {
+    const c = input.accountData[type];
+    if (c !== undefined && c !== null) accountData[type] = c;
+  });
+  return {
+    format: EXPORT_FORMAT,
+    version: EXPORT_VERSION,
+    exportedAt: (input.now ?? new Date()).toISOString(),
+    userId: input.userId,
+    accountData,
+    profile: { decoration: input.decoration },
+    local: { settings: input.localSettings },
+  };
+};
+
+const isObject = (v: unknown): v is Record<string, unknown> =>
+  !!v && typeof v === 'object' && !Array.isArray(v);
+
+export type ParseResult = { ok: true; file: ExportFile } | { ok: false; error: string };
+
+/** Validate an imported file; older versions would be migrated here. */
+export const parseExport = (text: string): ParseResult => {
+  let v: unknown;
+  try {
+    v = JSON.parse(text);
+  } catch {
+    return { ok: false, error: "This isn't a Lotus Chat data file (it isn't valid JSON)." };
+  }
+  if (!isObject(v) || v.format !== EXPORT_FORMAT)
+    return { ok: false, error: "This isn't a Lotus Chat data file." };
+  if (typeof v.version !== 'number' || v.version < 1)
+    return { ok: false, error: 'This data file is damaged (no version).' };
+  if (v.version > EXPORT_VERSION)
+    return {
+      ok: false,
+      error: 'This file was made by a newer Lotus Chat. Update the app, then import it again.',
+    };
+  const accountData = isObject(v.accountData) ? v.accountData : {};
+  const known = new Set(EXPORT_ACCOUNT_DATA.map((t) => t.type));
+  const filtered: Record<string, unknown> = {};
+  Object.entries(accountData).forEach(([type, content]) => {
+    // Only our own types: a file can't be used to write arbitrary account data.
+    if (known.has(type) && content !== null && content !== undefined) filtered[type] = content;
+  });
+  const profile = isObject(v.profile) ? v.profile : {};
+  const local = isObject(v.local) ? v.local : {};
+  return {
+    ok: true,
+    file: {
+      format: EXPORT_FORMAT,
+      version: v.version,
+      exportedAt: typeof v.exportedAt === 'string' ? v.exportedAt : '',
+      userId: typeof v.userId === 'string' ? v.userId : '',
+      accountData: filtered,
+      profile: {
+        decoration: typeof profile.decoration === 'string' ? profile.decoration : null,
+      },
+      local: { settings: isObject(local.settings) ? local.settings : null },
+    },
+  };
+};
+
+const same = (a: unknown, b: unknown): boolean => JSON.stringify(a) === JSON.stringify(b);
+
+const itemKey = (v: unknown): string => {
+  if (isObject(v)) {
+    const id = v.id ?? v.eventId ?? v.event_id ?? v.key ?? v.roomId ?? v.room_id ?? v.mxc;
+    if (typeof id === 'string' || typeof id === 'number') return `id:${String(id)}`;
+  }
+  return `json:${JSON.stringify(v)}`;
+};
+
+export type MergeResult = { value: unknown; added: number; conflicts: number };
+
+/**
+ * Pure: merge `incoming` into `current`. Lists: add items that are missing
+ * (matched by id, else by content). Objects: add missing keys, recurse into
+ * shared ones. A differing leaf is a conflict: `preferIncoming` decides.
+ */
+export const mergeData = (
+  current: unknown,
+  incoming: unknown,
+  preferIncoming = false,
+): MergeResult => {
+  if (current === undefined || current === null) {
+    return { value: incoming, added: incoming === undefined ? 0 : 1, conflicts: 0 };
+  }
+  if (Array.isArray(current) && Array.isArray(incoming)) {
+    const have = new Map(current.map((v, i) => [itemKey(v), i]));
+    const out = [...current];
+    let added = 0;
+    let conflicts = 0;
+    incoming.forEach((item) => {
+      const k = itemKey(item);
+      const at = have.get(k);
+      if (at === undefined) {
+        out.push(item);
+        have.set(k, out.length - 1);
+        added += 1;
+      } else if (!same(out[at], item)) {
+        conflicts += 1;
+        if (preferIncoming) out[at] = item;
+      }
+    });
+    return { value: out, added, conflicts };
+  }
+  if (isObject(current) && isObject(incoming)) {
+    const out: Record<string, unknown> = { ...current };
+    let added = 0;
+    let conflicts = 0;
+    Object.entries(incoming).forEach(([k, v]) => {
+      if (!(k in current)) {
+        out[k] = v;
+        added += 1;
+        return;
+      }
+      const r = mergeData(current[k], v, preferIncoming);
+      out[k] = r.value;
+      added += r.added;
+      conflicts += r.conflicts;
+    });
+    return { value: out, added, conflicts };
+  }
+  if (same(current, incoming)) return { value: current, added: 0, conflicts: 0 };
+  return { value: preferIncoming ? incoming : current, added: 0, conflicts: 1 };
+};
+
+export type ImportPlanItem = {
+  key: string;
+  label: string;
+  added: number;
+  conflicts: number;
+};
+
+/** What importing `file` into the current data would change, per category. */
+export const planImport = (
+  file: ExportFile,
+  current: {
+    accountData: Record<string, unknown>;
+    decoration: string | null;
+    localSettings: Record<string, unknown> | null;
+  },
+): ImportPlanItem[] => {
+  const items: ImportPlanItem[] = [];
+  EXPORT_ACCOUNT_DATA.forEach(({ type, label }) => {
+    if (!(type in file.accountData)) return;
+    const r = mergeData(current.accountData[type], file.accountData[type]);
+    items.push({ key: type, label, added: r.added, conflicts: r.conflicts });
+  });
+  if (file.profile.decoration !== null) {
+    const differs = current.decoration !== file.profile.decoration;
+    items.push({
+      key: 'profile.decoration',
+      label: 'Avatar decoration',
+      added: !current.decoration && differs ? 1 : 0,
+      conflicts: current.decoration && differs ? 1 : 0,
+    });
+  }
+  if (file.local.settings) {
+    const r = mergeData(current.localSettings ?? {}, file.local.settings);
+    items.push({
+      key: 'local.settings',
+      label: "This device's settings",
+      added: r.added,
+      conflicts: r.conflicts,
+    });
+  }
+  return items;
+};
@@ -8,9 +8,6 @@ import {
  parseNudgeRecord,
  SecurityState,
  shouldShowNudge,
-  pickNudge,
-  staleSessions,
-  staleSessionsText,
 } from './securityNudge';

 const healthy: SecurityState = {
@@ -82,45 +79,3 @@ test('stored record: round trip, and garbage starts a fresh grace period', () =>
    assert.deepEqual(parseNudgeRecord(bad, t0), { firstSeen: t0, dismissals: {} }, bad);
  }
 });
-
-test('[#113] stale sessions: 90+ days unused, never the current one', () => {
-  const now = Date.UTC(2026, 9, 25);
-  const day = 86_400_000;
-  const devices = [
-    { device_id: 'ME', last_seen_ts: now - 400 * day },
-    { device_id: 'OLD', last_seen_ts: now - 91 * day },
-    { device_id: 'EDGE', last_seen_ts: now - 90 * day },
-    { device_id: 'RECENT', last_seen_ts: now - 89 * day },
-    { device_id: 'UNKNOWN' },
-    { device_id: 'NULL', last_seen_ts: null },
-  ];
-  assert.deepEqual(
-    staleSessions(devices, 'ME', now).map((d) => d.device_id),
-    ['OLD', 'EDGE'],
-  );
-});
-
-test('[#113] wording follows the count', () => {
-  assert.match(
-    staleSessionsText(1),
-    /^You have a session you haven't used in 3 months\. Signing it out/,
-  );
-  assert.match(
-    staleSessionsText(3),
-    /^You have 3 sessions you haven't used in 3 months\. Signing them out/,
-  );
-});
-
-test('[#113] pickNudge: security first, stale sessions when that one is snoozed or absent', () => {
-  const now = 10 * 86_400_000;
-  const fresh = { firstSeen: 0, dismissals: {} };
-  assert.equal(pickNudge('verify-device', 2, fresh, now), 'verify-device');
-  assert.equal(pickNudge(undefined, 2, fresh, now), 'stale-sessions');
-  assert.equal(pickNudge(undefined, 0, fresh, now), undefined);
-  const snoozed = dismissNudge('verify-device', fresh, now);
-  assert.equal(pickNudge('verify-device', 2, snoozed, now), 'stale-sessions');
-  const bothSnoozed = dismissNudge('stale-sessions', snoozed, now);
-  assert.equal(pickNudge('verify-device', 2, bothSnoozed, now), undefined);
-  // inside the 24 h grace period nothing shows
-  assert.equal(pickNudge(undefined, 2, { firstSeen: now, dismissals: {} }, now), undefined);
-});
@@ -9,15 +9,12 @@
 * - setup-backup: no key backup at all (includes accounts that never set up
 *   cross-signing: the setup flow does both).
 *
- * - stale-sessions (#113, lowest priority): sessions of this account not used
- *   for 90+ days; Review opens Settings → Devices with them ticked to sign out.
- *
 * Anything not yet known (crypto still loading) → no nudge. Timing: not in
 * the first 24 h on a device (onboarding), "Not now" snoozes 7 days, three
 * dismissals of a nudge stop it for good; a healthy device never sees one.
 */

-export type NudgeKind = 'verify-device' | 'connect-backup' | 'setup-backup' | 'stale-sessions';
+export type NudgeKind = 'verify-device' | 'connect-backup' | 'setup-backup';

 export type SecurityState = {
  /** m.cross_signing.master account data present. */
@@ -41,51 +38,6 @@ export const nudgeFor = (s: SecurityState): NudgeKind | undefined => {
  return s.backupActive ? undefined : 'connect-backup';
 };

-/** [Gitea #113] A session counts as stale after this long unused. */
-export const STALE_SESSION_MS = 90 * 24 * 60 * 60 * 1000;
-
-type SessionLike = { device_id: string; last_seen_ts?: number | null };
-
-/**
- * Pure: other sessions of this account not seen for STALE_SESSION_MS. Never
- * the current session; a session with no last-seen time is left alone (we
- * can't tell it's unused).
- */
-export const staleSessions = <T extends SessionLike>(
-  devices: T[],
-  currentDeviceId: string | undefined,
-  now: number,
-): T[] =>
-  devices.filter(
-    (d) =>
-      d.device_id !== currentDeviceId &&
-      typeof d.last_seen_ts === 'number' &&
-      now - d.last_seen_ts >= STALE_SESSION_MS,
-  );
-
-/** "1 session" / "3 sessions you haven't used in 3 months". */
-export const staleSessionsText = (count: number): string =>
-  `You have ${count === 1 ? 'a session' : `${count} sessions`} you haven't used in 3 months. Signing ${
-    count === 1 ? 'it' : 'them'
-  } out keeps your account safe if an old device is lost.`;
-
-/**
- * The nudge to show: the device-security one first, then stale sessions, each
- * only if its own snooze allows (so a snoozed security nudge doesn't hide the
- * stale-sessions one, and vice versa).
- */
-export const pickNudge = (
-  security: NudgeKind | undefined,
-  staleCount: number,
-  record: NudgeRecord,
-  now: number,
-): NudgeKind | undefined => {
-  const candidates: NudgeKind[] = [];
-  if (security) candidates.push(security);
-  if (staleCount > 0) candidates.push('stale-sessions');
-  return candidates.find((k) => shouldShowNudge(k, record, now));
-};
-
 export const NUDGE_GRACE_MS = 24 * 60 * 60 * 1000;
 export const NUDGE_SNOOZE_MS = 7 * 24 * 60 * 60 * 1000;
 export const NUDGE_MAX_DISMISSALS = 3;
@@ -135,11 +87,6 @@ export const NUDGE_COPY: Record<NudgeKind, { text: string; action: string }> = {
    text: "This device isn't using your key backup yet. Connect it so your encrypted messages stay readable if you lose it.",
    action: 'Connect',
  },
-  'stale-sessions': {
-    // The text depends on the count: see staleSessionsText.
-    text: '',
-    action: 'Review',
-  },
  'setup-backup': {
    text: "Your encryption keys aren't backed up. Set up key backup so you don't lose your encrypted messages if you log out or lose this device.",
    action: 'Set up',