feat(oauth): implement OAuth 2.0 authorization server

Complete OAuth 2.0 implementation for AT Protocol with:

- Discovery endpoints (AS metadata, protected resource, JWKS)
- Pushed Authorization Requests (PAR) with DPoP validation
- Authorization endpoint with consent UI (dark theme)
- Token endpoint (authorization_code + refresh_token grants)
- Token revocation (RFC 7009)
- DPoP proof validation and token binding
- PKCE with S256 code challenge
- Client metadata fetching and validation
- Loopback client support for development

Security features:
- DPoP JTI tracking to prevent replay attacks
- Timing-safe password comparison
- 24-hour maximum token lifetime
- Automatic cleanup of expired authorization requests

Also includes comprehensive e2e tests and JSDoc types.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

README.md

···
 - [x] Relay notification (requestCrawl)
 - [x] Single or multi-user (each DID gets isolated storage, no self-service signup yet)
 - [x] Blob storage (uploadBlob, getBlob, listBlobs)
+- [x] OAuth 2.0 (PAR, authorization code + PKCE, DPoP-bound tokens, refresh, revoke)
 - [ ] deleteSession (logout)
 - [ ] updateHandle
 - [ ] importRepo
-- [ ] OAuth
 - [ ] Account management (createAccount, deleteAccount)
 - [ ] Email verification
 - [ ] Invite codes
···
 ## Prerequisites
 
 - Node.js 18+
-- [shfmt](https://github.com/mvdan/sh) (optional, for `npm run format`)
-  ```bash
-  brew install shfmt
-  ```
 
 ## Quick Start
 
···
 For local development, create `.dev.vars`:
 
 ```
-PDS_PASSWORD=your-password
+PDS_PASSWORD=your-password  # Used for legacy auth and OAuth consent
 JWT_SECRET=your-secret
 RELAY_HOST=https://bsky.network  # optional
 ```

docs/plans/2026-01-07-oauth-implementation.md

···
+# OAuth Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Add full AT Protocol OAuth support (PAR, DPoP, PKCE, authorization code flow) to pds.js while maintaining zero external dependencies.
+
+**Architecture:** Extend the existing single-file pds.js with OAuth endpoints. Store authorization requests and tokens in SQLite. Use Web Crypto APIs for all cryptographic operations. Minimal server-rendered HTML for consent UI.
+
+**Tech Stack:** JavaScript (Cloudflare Workers), SQLite (Durable Objects), Web Crypto API, P-256/ES256 signatures.
+
+---
+
+## Task 1: Add OAuth Database Tables
+
+**Files:**
+- Modify: `src/pds.js`
+
+**Step 1: Add tables to initializeDatabase**
+
+In `src/pds.js`, add to the `initializeDatabase` function after existing table creation:
+
+```javascript
+// OAuth authorization requests (from PAR)
+await sql`
+  CREATE TABLE IF NOT EXISTS authorization_requests (
+    id TEXT PRIMARY KEY,
+    client_id TEXT NOT NULL,
+    client_metadata TEXT NOT NULL,
+    parameters TEXT NOT NULL,
+    code TEXT,
+    code_challenge TEXT,
+    code_challenge_method TEXT,
+    dpop_jkt TEXT,
+    did TEXT,
+    expires_at TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  )
+`;
+
+await sql`
+  CREATE INDEX IF NOT EXISTS idx_authorization_requests_code
+  ON authorization_requests(code) WHERE code IS NOT NULL
+`;
+
+// OAuth tokens
+await sql`
+  CREATE TABLE IF NOT EXISTS tokens (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    token_id TEXT UNIQUE NOT NULL,
+    did TEXT NOT NULL,
+    client_id TEXT NOT NULL,
+    scope TEXT,
+    dpop_jkt TEXT,
+    expires_at TEXT NOT NULL,
+    refresh_token TEXT UNIQUE,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  )
+`;
+
+await sql`
+  CREATE INDEX IF NOT EXISTS idx_tokens_did ON tokens(did)
+`;
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/pds.js
+git commit -m "feat(oauth): add authorization_requests and tokens tables"
+```
+
+---
+
+## Task 2: Implement JWK Thumbprint
+
+**Files:**
+- Modify: `src/pds.js`
+- Test: `test/pds.test.js`
+
+**Step 1: Add unit test**
+
+Add to `test/pds.test.js` imports and test:
+
+```javascript
+import {
+  // ... existing imports ...
+  computeJwkThumbprint,
+} from '../src/pds.js';
+
+describe('JWK Thumbprint', () => {
+  test('computes deterministic thumbprint for EC key', async () => {
+    // Test vector: known JWK and its expected thumbprint
+    const jwk = {
+      kty: 'EC',
+      crv: 'P-256',
+      x: 'WbbCfHGZ9QtKsVuMdPZ8hBbP2949N_CSLG3LVV0nnKY',
+      y: 'eSgPlDj0RVMw8t8u4MvCYG4j_JfDwvrMUUwEEHVLmqQ'
+    };
+
+    const jkt1 = await computeJwkThumbprint(jwk);
+    const jkt2 = await computeJwkThumbprint(jwk);
+
+    // Thumbprint must be deterministic
+    assert.strictEqual(jkt1, jkt2);
+    // Must be base64url-encoded SHA-256 (43 chars)
+    assert.strictEqual(jkt1.length, 43);
+    // Must only contain base64url characters
+    assert.match(jkt1, /^[A-Za-z0-9_-]+$/);
+  });
+
+  test('produces different thumbprints for different keys', async () => {
+    const jwk1 = { kty: 'EC', crv: 'P-256', x: 'WbbCfHGZ9QtKsVuMdPZ8hBbP2949N_CSLG3LVV0nnKY', y: 'eSgPlDj0RVMw8t8u4MvCYG4j_JfDwvrMUUwEEHVLmqQ' };
+    const jwk2 = { kty: 'EC', crv: 'P-256', x: 'f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU', y: 'x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0' };
+
+    const jkt1 = await computeJwkThumbprint(jwk1);
+    const jkt2 = await computeJwkThumbprint(jwk2);
+
+    assert.notStrictEqual(jkt1, jkt2);
+  });
+});
+```
+
+**Step 2: Implement and export**
+
+Add to `src/pds.js`:
+
+```javascript
+/**
+ * Compute JWK thumbprint (SHA-256) per RFC 7638.
+ * Creates a canonical JSON representation of EC key required members
+ * and returns the base64url-encoded SHA-256 hash.
+ * @param {{ kty: string, crv: string, x: string, y: string }} jwk - The EC public key in JWK format
+ * @returns {Promise<string>} The base64url-encoded thumbprint
+ */
+export async function computeJwkThumbprint(jwk) {
+  // RFC 7638: members must be in lexicographic order
+  const thumbprintInput = JSON.stringify({
+    crv: jwk.crv,
+    kty: jwk.kty,
+    x: jwk.x,
+    y: jwk.y
+  });
+  const hash = await crypto.subtle.digest(
+    'SHA-256',
+    new TextEncoder().encode(thumbprintInput)
+  );
+  return base64UrlEncode(new Uint8Array(hash));
+}
+```
+
+**Step 3: Run tests and commit**
+
+```bash
+npm test
+git add src/pds.js test/pds.test.js
+git commit -m "feat(oauth): implement JWK thumbprint computation"
+```
+
+---
+
+## Task 3: Implement Client Metadata Validation
+
+**Files:**
+- Modify: `src/pds.js`
+- Test: `test/pds.test.js`
+
+**Step 1: Add unit tests**
+
+```javascript
+import {
+  // ... existing imports ...
+  isLoopbackClient,
+  getLoopbackClientMetadata,
+  validateClientMetadata,
+} from '../src/pds.js';
+
+describe('Client Metadata', () => {
+  test('isLoopbackClient detects localhost', () => {
+    assert.strictEqual(isLoopbackClient('http://localhost:8080'), true);
+    assert.strictEqual(isLoopbackClient('http://127.0.0.1:3000'), true);
+    assert.strictEqual(isLoopbackClient('https://example.com'), false);
+  });
+
+  test('getLoopbackClientMetadata returns permissive defaults', () => {
+    const metadata = getLoopbackClientMetadata('http://localhost:8080');
+    assert.strictEqual(metadata.client_id, 'http://localhost:8080');
+    assert.ok(metadata.grant_types.includes('authorization_code'));
+    assert.strictEqual(metadata.dpop_bound_access_tokens, true);
+  });
+
+  test('validateClientMetadata rejects mismatched client_id', () => {
+    const metadata = {
+      client_id: 'https://other.com/metadata.json',
+      redirect_uris: ['https://example.com/callback'],
+      grant_types: ['authorization_code'],
+      response_types: ['code']
+    };
+    assert.throws(
+      () => validateClientMetadata(metadata, 'https://example.com/metadata.json'),
+      /client_id mismatch/
+    );
+  });
+});
+```
+
+**Step 2: Implement functions**
+
+```javascript
+/**
+ * Check if a client_id represents a loopback client (localhost development).
+ * Loopback clients are allowed without pre-registration per AT Protocol OAuth spec.
+ * @param {string} clientId - The client_id to check
+ * @returns {boolean} True if the client_id is a loopback address
+ */
+export function isLoopbackClient(clientId) {
+  try {
+    const url = new URL(clientId);
+    const host = url.hostname.toLowerCase();
+    return host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @typedef {Object} ClientMetadata
+ * @property {string} client_id - The client identifier (must match the URL used to fetch metadata)
+ * @property {string} [client_name] - Human-readable client name
+ * @property {string[]} redirect_uris - Allowed redirect URIs
+ * @property {string[]} grant_types - Supported grant types
+ * @property {string[]} response_types - Supported response types
+ * @property {string} [token_endpoint_auth_method] - Token endpoint auth method
+ * @property {boolean} [dpop_bound_access_tokens] - Whether client requires DPoP-bound tokens
+ * @property {string} [scope] - Default scope
+ */
+
+/**
+ * Generate permissive client metadata for a loopback client.
+ * @param {string} clientId - The loopback client_id
+ * @returns {ClientMetadata} Generated client metadata
+ */
+export function getLoopbackClientMetadata(clientId) {
+  return {
+    client_id: clientId,
+    client_name: 'Loopback Client',
+    redirect_uris: [clientId],
+    grant_types: ['authorization_code', 'refresh_token'],
+    response_types: ['code'],
+    token_endpoint_auth_method: 'none',
+    dpop_bound_access_tokens: true,
+    scope: 'atproto'
+  };
+}
+
+/**
+ * Validate client metadata against AT Protocol OAuth requirements.
+ * @param {ClientMetadata} metadata - The client metadata to validate
+ * @param {string} expectedClientId - The expected client_id (the URL used to fetch metadata)
+ * @throws {Error} If validation fails
+ */
+export function validateClientMetadata(metadata, expectedClientId) {
+  if (!metadata.client_id) throw new Error('client_id is required');
+  if (metadata.client_id !== expectedClientId) throw new Error('client_id mismatch');
+  if (!Array.isArray(metadata.redirect_uris) || metadata.redirect_uris.length === 0) {
+    throw new Error('redirect_uris is required');
+  }
+  if (!metadata.grant_types?.includes('authorization_code')) {
+    throw new Error('grant_types must include authorization_code');
+  }
+}
+
+/** @type {Map<string, { metadata: ClientMetadata, expiresAt: number }>} */
+const clientMetadataCache = new Map();
+
+/**
+ * Fetch and validate client metadata from a client_id URL.
+ * Caches results for 10 minutes. Loopback clients return synthetic metadata.
+ * @param {string} clientId - The client_id (URL to fetch metadata from)
+ * @returns {Promise<ClientMetadata>} The validated client metadata
+ * @throws {Error} If fetching or validation fails
+ */
+async function getClientMetadata(clientId) {
+  const cached = clientMetadataCache.get(clientId);
+  if (cached && Date.now() < cached.expiresAt) return cached.metadata;
+
+  if (isLoopbackClient(clientId)) {
+    const metadata = getLoopbackClientMetadata(clientId);
+    clientMetadataCache.set(clientId, { metadata, expiresAt: Date.now() + 600000 });
+    return metadata;
+  }
+
+  const response = await fetch(clientId, { headers: { 'Accept': 'application/json' } });
+  if (!response.ok) throw new Error(`Failed to fetch client metadata: ${response.status}`);
+
+  const metadata = await response.json();
+  validateClientMetadata(metadata, clientId);
+  clientMetadataCache.set(clientId, { metadata, expiresAt: Date.now() + 600000 });
+  return metadata;
+}
+```
+
+**Step 3: Run tests and commit**
+
+```bash
+npm test
+git add src/pds.js test/pds.test.js
+git commit -m "feat(oauth): implement client metadata fetching and validation"
+```
+
+---
+
+## Task 4: Implement DPoP Proof Parsing
+
+**Files:**
+- Modify: `src/pds.js`
+
+**Step 1: Implement parseDpopProof**
+
+```javascript
+/**
+ * @typedef {Object} DpopProofResult
+ * @property {string} jkt - The JWK thumbprint of the DPoP key
+ * @property {string} jti - The unique identifier from the DPoP proof
+ * @property {{ kty: string, crv: string, x: string, y: string }} jwk - The public key from the proof
+ */
+
+/**
+ * Parse and validate a DPoP proof JWT.
+ * Verifies the signature, checks claims (htm, htu, iat, jti), and optionally
+ * validates key binding (expectedJkt) and access token hash (ath).
+ * @param {string} proof - The DPoP proof JWT
+ * @param {string} method - The expected HTTP method (htm claim)
+ * @param {string} url - The expected request URL (htu claim)
+ * @param {string|null} [expectedJkt=null] - If provided, verify the key matches this thumbprint
+ * @param {string|null} [accessToken=null] - If provided, verify the ath claim matches this token's hash
+ * @returns {Promise<DpopProofResult>} The parsed proof with jkt, jti, and jwk
+ * @throws {Error} If validation fails
+ */
+async function parseDpopProof(proof, method, url, expectedJkt = null, accessToken = null) {
+  const parts = proof.split('.');
+  if (parts.length !== 3) throw new Error('Invalid DPoP proof format');
+
+  const header = JSON.parse(new TextDecoder().decode(base64UrlDecode(parts[0])));
+  const payload = JSON.parse(new TextDecoder().decode(base64UrlDecode(parts[1])));
+
+  if (header.typ !== 'dpop+jwt') throw new Error('DPoP proof must have typ dpop+jwt');
+  if (header.alg !== 'ES256') throw new Error('DPoP proof must use ES256');
+  if (!header.jwk || header.jwk.kty !== 'EC') throw new Error('DPoP proof must contain EC key');
+
+  // Verify signature
+  const publicKey = await crypto.subtle.importKey(
+    'jwk', header.jwk,
+    { name: 'ECDSA', namedCurve: 'P-256' },
+    false, ['verify']
+  );
+
+  const signatureInput = new TextEncoder().encode(parts[0] + '.' + parts[1]);
+  const signature = base64UrlDecode(parts[2]);
+  const derSignature = compactSignatureToDer(signature);
+
+  const valid = await crypto.subtle.verify(
+    { name: 'ECDSA', hash: 'SHA-256' },
+    publicKey, derSignature, signatureInput
+  );
+  if (!valid) throw new Error('DPoP proof signature invalid');
+
+  // Validate claims
+  if (payload.htm !== method) throw new Error('DPoP htm mismatch');
+
+  const normalizeUrl = (u) => u.replace(/\/$/, '').split('?')[0].toLowerCase();
+  if (normalizeUrl(payload.htu) !== normalizeUrl(url)) throw new Error('DPoP htu mismatch');
+
+  const now = Math.floor(Date.now() / 1000);
+  if (!payload.iat || payload.iat > now + 60 || payload.iat < now - 300) {
+    throw new Error('DPoP proof expired or invalid iat');
+  }
+
+  if (!payload.jti) throw new Error('DPoP proof missing jti');
+
+  const jkt = await computeJwkThumbprint(header.jwk);
+  if (expectedJkt && jkt !== expectedJkt) throw new Error('DPoP key mismatch');
+
+  if (accessToken) {
+    const tokenHash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(accessToken));
+    const expectedAth = base64UrlEncode(new Uint8Array(tokenHash));
+    if (payload.ath !== expectedAth) throw new Error('DPoP ath mismatch');
+  }
+
+  return { jkt, jti: payload.jti, jwk: header.jwk };
+}
+
+/**
+ * Convert a compact (r||s) ECDSA signature to DER format for Web Crypto API.
+ * @param {Uint8Array} compact - The 64-byte compact signature (32 bytes r + 32 bytes s)
+ * @returns {Uint8Array} The DER-encoded signature
+ */
+function compactSignatureToDer(compact) {
+  const r = compact.slice(0, 32);
+  const s = compact.slice(32, 64);
+
+  /**
+   * @param {Uint8Array} bytes
+   * @returns {Uint8Array}
+   */
+  function encodeInt(bytes) {
+    let i = 0;
+    while (i < bytes.length - 1 && bytes[i] === 0 && !(bytes[i + 1] & 0x80)) i++;
+    const trimmed = bytes.slice(i);
+    if (trimmed[0] & 0x80) return new Uint8Array([0x02, trimmed.length + 1, 0, ...trimmed]);
+    return new Uint8Array([0x02, trimmed.length, ...trimmed]);
+  }
+
+  const rDer = encodeInt(r);
+  const sDer = encodeInt(s);
+  return new Uint8Array([0x30, rDer.length + sDer.length, ...rDer, ...sDer]);
+}
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/pds.js
+git commit -m "feat(oauth): implement DPoP proof parsing"
+```
+
+---
+
+## Task 5: Add OAuth Discovery Endpoints
+
+**Files:**
+- Modify: `src/pds.js`
+
+**Step 1: Add endpoints to handleRequest**
+
+```javascript
+// OAuth Authorization Server Metadata
+if (path === '/.well-known/oauth-authorization-server' && method === 'GET') {
+  const issuer = `${url.protocol}//${url.host}`;
+  return json({
+    issuer,
+    authorization_endpoint: `${issuer}/oauth/authorize`,
+    token_endpoint: `${issuer}/oauth/token`,
+    revocation_endpoint: `${issuer}/oauth/revoke`,
+    pushed_authorization_request_endpoint: `${issuer}/oauth/par`,
+    jwks_uri: `${issuer}/oauth/jwks`,
+    scopes_supported: ['atproto'],
+    response_types_supported: ['code'],
+    grant_types_supported: ['authorization_code', 'refresh_token'],
+    code_challenge_methods_supported: ['S256'],
+    token_endpoint_auth_methods_supported: ['none'],
+    dpop_signing_alg_values_supported: ['ES256'],
+    require_pushed_authorization_requests: true,
+    authorization_response_iss_parameter_supported: true
+  });
+}
+
+// OAuth Protected Resource Metadata
+if (path === '/.well-known/oauth-protected-resource' && method === 'GET') {
+  const resource = `${url.protocol}//${url.host}`;
+  return json({
+    resource,
+    authorization_servers: [resource],
+    bearer_methods_supported: ['header'],
+    scopes_supported: ['atproto']
+  });
+}
+
+// JWKS endpoint
+if (path === '/oauth/jwks' && method === 'GET') {
+  const publicKeyJwk = await getPublicKeyJwk(this);
+  return json({
+    keys: [{ ...publicKeyJwk, kid: 'pds-oauth-key', use: 'sig', alg: 'ES256' }]
+  });
+}
+```
+
+**Step 2: Add getPublicKeyJwk helper**
+
+```javascript
+/**
+ * Get the PDS signing key as a public JWK.
+ * Exports only the public components (kty, crv, x, y) for use in JWKS.
+ * @param {{ storage: DurableObjectStorage }} pds - The PDS instance
+ * @returns {Promise<{ kty: string, crv: string, x: string, y: string }>} The public key in JWK format
+ * @throws {Error} If the PDS is not initialized
+ */
+async function getPublicKeyJwk(pds) {
+  const privateKeyHex = await pds.storage.get('privateKey');
+  if (!privateKeyHex) throw new Error('PDS not initialized');
+
+  const privateKeyBytes = hexToBytes(privateKeyHex);
+  const privateKey = await crypto.subtle.importKey(
+    'pkcs8', privateKeyBytes,
+    { name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign']
+  );
+  const jwk = await crypto.subtle.exportKey('jwk', privateKey);
+  return { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+}
+```
+
+**Step 3: Commit**
+
+```bash
+git add src/pds.js
+git commit -m "feat(oauth): add discovery endpoints"
+```
+
+---
+
+## Task 6: Implement PAR Endpoint
+
+**Files:**
+- Modify: `src/pds.js`
+
+**Step 1: Add PAR handler**
+
+```javascript
+if (path === '/oauth/par' && method === 'POST') {
+  return handlePar(request, url, this, env);
+}
+
+/**
+ * Handle Pushed Authorization Request (PAR) endpoint.
+ * Validates DPoP proof, client metadata, PKCE parameters, and stores the authorization request.
+ * @param {Request} request - The incoming request
+ * @param {URL} url - Parsed request URL
+ * @param {{ storage: DurableObjectStorage }} pds - The PDS instance
+ * @param {{ PDS_PASSWORD: string }} env - Environment variables
+ * @returns {Promise<Response>} JSON response with request_uri and expires_in
+ */
+async function handlePar(request, url, pds, env) {
+  const issuer = `${url.protocol}//${url.host}`;
+
+  const dpopHeader = request.headers.get('DPoP');
+  if (!dpopHeader) {
+    return json({ error: 'invalid_dpop_proof', error_description: 'DPoP proof required' }, 400);
+  }
+
+  let dpop;
+  try {
+    dpop = await parseDpopProof(dpopHeader, 'POST', `${issuer}/oauth/par`);
+  } catch (err) {
+    return json({ error: 'invalid_dpop_proof', error_description: err.message }, 400);
+  }
+
+  const body = await request.text();
+  const params = new URLSearchParams(body);
+
+  const clientId = params.get('client_id');
+  const redirectUri = params.get('redirect_uri');
+  const responseType = params.get('response_type');
+  const scope = params.get('scope');
+  const state = params.get('state');
+  const codeChallenge = params.get('code_challenge');
+  const codeChallengeMethod = params.get('code_challenge_method');
+
+  if (!clientId) return json({ error: 'invalid_request', error_description: 'client_id required' }, 400);
+  if (!redirectUri) return json({ error: 'invalid_request', error_description: 'redirect_uri required' }, 400);
+  if (responseType !== 'code') return json({ error: 'unsupported_response_type' }, 400);
+  if (!codeChallenge || codeChallengeMethod !== 'S256') {
+    return json({ error: 'invalid_request', error_description: 'PKCE with S256 required' }, 400);
+  }
+
+  let clientMetadata;
+  try {
+    clientMetadata = await getClientMetadata(clientId);
+  } catch (err) {
+    return json({ error: 'invalid_client', error_description: err.message }, 400);
+  }
+
+  const requestId = crypto.randomUUID();
+  const requestUri = `urn:ietf:params:oauth:request_uri:${requestId}`;
+  const expiresIn = 600;
+  const expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString();
+
+  const sql = createSql(pds.storage);
+  await sql`
+    INSERT INTO authorization_requests (
+      id, client_id, client_metadata, parameters,
+      code_challenge, code_challenge_method, dpop_jkt,
+      expires_at, created_at
+    ) VALUES (
+      ${requestId}, ${clientId}, ${JSON.stringify(clientMetadata)},
+      ${JSON.stringify({ redirect_uri: redirectUri, scope, state })},
+      ${codeChallenge}, ${codeChallengeMethod}, ${dpop.jkt},
+      ${expiresAt}, ${new Date().toISOString()}
+    )
+  `;
+
+  return json({ request_uri: requestUri, expires_in: expiresIn });
+}
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/pds.js
+git commit -m "feat(oauth): implement PAR endpoint"
+```
+
+---
+
+## Task 7: Implement Authorization Endpoint
+
+**Files:**
+- Modify: `src/pds.js`
+
+**Step 1: Add GET handler (consent UI)**
+
+```javascript
+if (path === '/oauth/authorize' && method === 'GET') {
+  return handleAuthorizeGet(request, url, this, env);
+}
+
+/**
+ * Handle GET /oauth/authorize - displays the consent UI.
+ * Validates the request_uri from PAR and renders a login/consent form.
+ * @param {Request} request - The incoming request
+ * @param {URL} url - Parsed request URL
+ * @param {{ storage: DurableObjectStorage }} pds - The PDS instance
+ * @param {{ PDS_PASSWORD: string }} env - Environment variables
+ * @returns {Promise<Response>} HTML consent page
+ */
+async function handleAuthorizeGet(request, url, pds, env) {
+  const requestUri = url.searchParams.get('request_uri');
+  const clientId = url.searchParams.get('client_id');
+
+  if (!requestUri || !clientId) return new Response('Missing parameters', { status: 400 });
+
+  const match = requestUri.match(/^urn:ietf:params:oauth:request_uri:(.+)$/);
+  if (!match) return new Response('Invalid request_uri', { status: 400 });
+
+  const sql = createSql(pds.storage);
+  const [authRequest] = await sql`
+    SELECT * FROM authorization_requests WHERE id = ${match[1]} AND client_id = ${clientId}
+  `;
+
+  if (!authRequest) return new Response('Request not found', { status: 400 });
+  if (new Date(authRequest.expires_at) < new Date()) return new Response('Request expired', { status: 400 });
+  if (authRequest.code) return new Response('Request already used', { status: 400 });
+
+  const clientMetadata = JSON.parse(authRequest.client_metadata);
+  const parameters = JSON.parse(authRequest.parameters);
+
+  return new Response(renderConsentPage({
+    clientName: clientMetadata.client_name || clientId,
+    clientId, scope: parameters.scope || 'atproto', requestUri
+  }), { status: 200, headers: { 'Content-Type': 'text/html; charset=utf-8' } });
+}
+
+/**
+ * Render the OAuth consent page HTML.
+ * @param {{ clientName: string, clientId: string, scope: string, requestUri: string, error?: string }} params
+ * @returns {string} HTML page content
+ */
+function renderConsentPage({ clientName, clientId, scope, requestUri, error = '' }) {
+  /** @param {string} s */
+  const escHtml = s => s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+  return `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Authorize</title>
+<style>body{font-family:system-ui;max-width:400px;margin:40px auto;padding:20px}
+.error{color:#c00;background:#fee;padding:10px;margin:10px 0}
+button{padding:10px 20px;margin:5px;cursor:pointer}
+.approve{background:#06c;color:#fff;border:none}
+input{width:100%;padding:8px;margin:5px 0;box-sizing:border-box}</style></head>
+<body><h2>Sign in to authorize</h2>
+<p><b>${escHtml(clientName)}</b> wants to access your account.</p>
+<p>Scope: ${escHtml(scope)}</p>
+${error ? `<p class="error">${escHtml(error)}</p>` : ''}
+<form method="POST" action="/oauth/authorize">
+<input type="hidden" name="request_uri" value="${escHtml(requestUri)}">
+<input type="hidden" name="client_id" value="${escHtml(clientId)}">
+<label>Password</label><input type="password" name="password" required autofocus>
+<div><button type="submit" name="action" value="deny">Deny</button>
+<button type="submit" name="action" value="approve" class="approve">Authorize</button></div>
+</form></body></html>`;
+}
+```
+
+**Step 2: Add POST handler (approval)**
+
+```javascript
+if (path === '/oauth/authorize' && method === 'POST') {
+  return handleAuthorizePost(request, url, this, env);
+}
+
+/**
+ * Handle POST /oauth/authorize - processes user approval/denial.
+ * Validates password, generates authorization code on approval, redirects to client.
+ * @param {Request} request - The incoming request
+ * @param {URL} url - Parsed request URL
+ * @param {{ storage: DurableObjectStorage }} pds - The PDS instance
+ * @param {{ PDS_PASSWORD: string }} env - Environment variables
+ * @returns {Promise<Response>} Redirect to client redirect_uri with code or error
+ */
+async function handleAuthorizePost(request, url, pds, env) {
+  const issuer = `${url.protocol}//${url.host}`;
+  const body = await request.text();
+  const params = new URLSearchParams(body);
+
+  const requestUri = params.get('request_uri');
+  const clientId = params.get('client_id');
+  const password = params.get('password');
+  const action = params.get('action');
+
+  const match = requestUri?.match(/^urn:ietf:params:oauth:request_uri:(.+)$/);
+  if (!match) return new Response('Invalid request_uri', { status: 400 });
+
+  const sql = createSql(pds.storage);
+  const [authRequest] = await sql`
+    SELECT * FROM authorization_requests WHERE id = ${match[1]} AND client_id = ${clientId}
+  `;
+  if (!authRequest) return new Response('Request not found', { status: 400 });
+
+  const clientMetadata = JSON.parse(authRequest.client_metadata);
+  const parameters = JSON.parse(authRequest.parameters);
+
+  if (action === 'deny') {
+    await sql`DELETE FROM authorization_requests WHERE id = ${match[1]}`;
+    const errorUrl = new URL(parameters.redirect_uri);
+    errorUrl.searchParams.set('error', 'access_denied');
+    if (parameters.state) errorUrl.searchParams.set('state', parameters.state);
+    errorUrl.searchParams.set('iss', issuer);
+    return Response.redirect(errorUrl.toString(), 302);
+  }
+
+  if (password !== env.PDS_PASSWORD) {
+    return new Response(renderConsentPage({
+      clientName: clientMetadata.client_name || clientId,
+      clientId, scope: parameters.scope || 'atproto', requestUri, error: 'Invalid password'
+    }), { status: 200, headers: { 'Content-Type': 'text/html; charset=utf-8' } });
+  }
+
+  const code = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+  const did = await pds.storage.get('did');
+
+  await sql`UPDATE authorization_requests SET code = ${code}, did = ${did} WHERE id = ${match[1]}`;
+
+  const successUrl = new URL(parameters.redirect_uri);
+  successUrl.searchParams.set('code', code);
+  if (parameters.state) successUrl.searchParams.set('state', parameters.state);
+  successUrl.searchParams.set('iss', issuer);
+  return Response.redirect(successUrl.toString(), 302);
+}
+```
+
+**Step 3: Commit**
+
+```bash
+git add src/pds.js
+git commit -m "feat(oauth): implement authorization endpoint with consent UI"
+```
+
+---
+
+## Task 8: Implement Token Endpoint
+
+**Files:**
+- Modify: `src/pds.js`
+
+**Step 1: Add token handler**
+
+```javascript
+if (path === '/oauth/token' && method === 'POST') {
+  return handleToken(request, url, this, env);
+}
+
+/**
+ * Handle token endpoint - exchanges authorization codes for tokens.
+ * Supports authorization_code and refresh_token grant types.
+ * @param {Request} request - The incoming request
+ * @param {URL} url - Parsed request URL
+ * @param {{ storage: DurableObjectStorage }} pds - The PDS instance
+ * @param {{ PDS_PASSWORD: string }} env - Environment variables
+ * @returns {Promise<Response>} JSON response with access_token, token_type, expires_in, refresh_token, scope
+ */
+async function handleToken(request, url, pds, env) {
+  const issuer = `${url.protocol}//${url.host}`;
+
+  const dpopHeader = request.headers.get('DPoP');
+  if (!dpopHeader) return json({ error: 'invalid_dpop_proof', error_description: 'DPoP required' }, 400);
+
+  let dpop;
+  try {
+    dpop = await parseDpopProof(dpopHeader, 'POST', `${issuer}/oauth/token`);
+  } catch (err) {
+    return json({ error: 'invalid_dpop_proof', error_description: err.message }, 400);
+  }
+
+  const body = await request.text();
+  const params = new URLSearchParams(body);
+  const grantType = params.get('grant_type');
+
+  if (grantType === 'authorization_code') {
+    return handleAuthCodeGrant(params, dpop, issuer, pds);
+  } else if (grantType === 'refresh_token') {
+    return handleRefreshGrant(params, dpop, issuer, pds);
+  }
+  return json({ error: 'unsupported_grant_type' }, 400);
+}
+
+/**
+ * Handle authorization_code grant type.
+ * Validates the code, PKCE verifier, and DPoP binding, then issues tokens.
+ * @param {URLSearchParams} params - Token request parameters
+ * @param {DpopProofResult} dpop - Parsed DPoP proof
+ * @param {string} issuer - The PDS issuer URL
+ * @param {{ storage: DurableObjectStorage }} pds - The PDS instance
+ * @returns {Promise<Response>} JSON token response
+ */
+async function handleAuthCodeGrant(params, dpop, issuer, pds) {
+  const code = params.get('code');
+  const redirectUri = params.get('redirect_uri');
+  const clientId = params.get('client_id');
+  const codeVerifier = params.get('code_verifier');
+
+  if (!code || !redirectUri || !clientId || !codeVerifier) {
+    return json({ error: 'invalid_request' }, 400);
+  }
+
+  const sql = createSql(pds.storage);
+  const [authRequest] = await sql`SELECT * FROM authorization_requests WHERE code = ${code}`;
+  if (!authRequest) return json({ error: 'invalid_grant', error_description: 'Invalid code' }, 400);
+  if (authRequest.client_id !== clientId) return json({ error: 'invalid_grant' }, 400);
+  if (authRequest.dpop_jkt !== dpop.jkt) return json({ error: 'invalid_dpop_proof' }, 400);
+
+  const parameters = JSON.parse(authRequest.parameters);
+  if (parameters.redirect_uri !== redirectUri) return json({ error: 'invalid_grant' }, 400);
+
+  // Verify PKCE
+  const challengeHash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(codeVerifier));
+  const computedChallenge = base64UrlEncode(new Uint8Array(challengeHash));
+  if (computedChallenge !== authRequest.code_challenge) {
+    return json({ error: 'invalid_grant', error_description: 'Invalid code_verifier' }, 400);
+  }
+
+  await sql`DELETE FROM authorization_requests WHERE id = ${authRequest.id}`;
+
+  const tokenId = crypto.randomUUID();
+  const refreshToken = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+  const scope = parameters.scope || 'atproto';
+  const now = new Date();
+  const expiresIn = 3600;
+
+  const accessToken = await createOAuthAccessToken({
+    issuer, subject: authRequest.did, clientId, scope, tokenId, dpopJkt: dpop.jkt, expiresIn
+  }, pds);
+
+  await sql`
+    INSERT INTO tokens (token_id, did, client_id, scope, dpop_jkt, expires_at, refresh_token, created_at, updated_at)
+    VALUES (${tokenId}, ${authRequest.did}, ${clientId}, ${scope}, ${dpop.jkt},
+            ${new Date(now.getTime() + expiresIn * 1000).toISOString()},
+            ${refreshToken}, ${now.toISOString()}, ${now.toISOString()})
+  `;
+
+  return json({ access_token: accessToken, token_type: 'DPoP', expires_in: expiresIn, refresh_token: refreshToken, scope });
+}
+
+/**
+ * @typedef {Object} AccessTokenParams
+ * @property {string} issuer - The PDS issuer URL
+ * @property {string} subject - The DID of the authenticated user
+ * @property {string} clientId - The OAuth client_id
+ * @property {string} scope - The granted scope
+ * @property {string} tokenId - Unique token identifier (jti)
+ * @property {string} dpopJkt - The DPoP key thumbprint for token binding
+ * @property {number} expiresIn - Token lifetime in seconds
+ */
+
+/**
+ * Create a DPoP-bound access token (at+jwt).
+ * @param {AccessTokenParams} params - Token parameters
+ * @param {{ storage: DurableObjectStorage }} pds - The PDS instance
+ * @returns {Promise<string>} The signed JWT access token
+ */
+async function createOAuthAccessToken({ issuer, subject, clientId, scope, tokenId, dpopJkt, expiresIn }, pds) {
+  const now = Math.floor(Date.now() / 1000);
+  const header = { typ: 'at+jwt', alg: 'ES256', kid: 'pds-oauth-key' };
+  const payload = {
+    iss: issuer, sub: subject, aud: issuer, client_id: clientId,
+    scope, jti: tokenId, iat: now, exp: now + expiresIn, cnf: { jkt: dpopJkt }
+  };
+
+  const privateKeyHex = await pds.storage.get('privateKey');
+  const privateKey = await importPrivateKey(hexToBytes(privateKeyHex));
+
+  const headerB64 = base64UrlEncode(new TextEncoder().encode(JSON.stringify(header)));
+  const payloadB64 = base64UrlEncode(new TextEncoder().encode(JSON.stringify(payload)));
+  const sigInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+  const sig = await sign(privateKey, sigInput);
+
+  return `${headerB64}.${payloadB64}.${base64UrlEncode(sig)}`;
+}
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/pds.js
+git commit -m "feat(oauth): implement token endpoint"
+```
+
+---
+
+## Task 9: Implement Refresh Token Grant
+
+**Files:**
+- Modify: `src/pds.js`
+
+**Step 1: Add refresh handler**
+
+```javascript
+/**
+ * Handle refresh_token grant type.
+ * Validates the refresh token, DPoP binding, and 24hr lifetime, then rotates tokens.
+ * @param {URLSearchParams} params - Token request parameters
+ * @param {DpopProofResult} dpop - Parsed DPoP proof
+ * @param {string} issuer - The PDS issuer URL
+ * @param {{ storage: DurableObjectStorage }} pds - The PDS instance
+ * @returns {Promise<Response>} JSON token response with new access and refresh tokens
+ */
+async function handleRefreshGrant(params, dpop, issuer, pds) {
+  const refreshToken = params.get('refresh_token');
+  const clientId = params.get('client_id');
+
+  if (!refreshToken || !clientId) return json({ error: 'invalid_request' }, 400);
+
+  const sql = createSql(pds.storage);
+  const [token] = await sql`SELECT * FROM tokens WHERE refresh_token = ${refreshToken}`;
+
+  if (!token) return json({ error: 'invalid_grant', error_description: 'Invalid refresh token' }, 400);
+  if (token.client_id !== clientId) return json({ error: 'invalid_grant' }, 400);
+  if (token.dpop_jkt !== dpop.jkt) return json({ error: 'invalid_dpop_proof' }, 400);
+
+  // Check 24hr lifetime
+  const createdAt = new Date(token.created_at);
+  if (Date.now() - createdAt.getTime() > 24 * 60 * 60 * 1000) {
+    await sql`DELETE FROM tokens WHERE id = ${token.id}`;
+    return json({ error: 'invalid_grant', error_description: 'Refresh token expired' }, 400);
+  }
+
+  const newTokenId = crypto.randomUUID();
+  const newRefreshToken = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+  const now = new Date();
+  const expiresIn = 3600;
+
+  const accessToken = await createOAuthAccessToken({
+    issuer, subject: token.did, clientId, scope: token.scope,
+    tokenId: newTokenId, dpopJkt: dpop.jkt, expiresIn
+  }, pds);
+
+  await sql`
+    UPDATE tokens SET token_id = ${newTokenId}, refresh_token = ${newRefreshToken},
+    expires_at = ${new Date(now.getTime() + expiresIn * 1000).toISOString()},
+    updated_at = ${now.toISOString()} WHERE id = ${token.id}
+  `;
+
+  return json({ access_token: accessToken, token_type: 'DPoP', expires_in: expiresIn, refresh_token: newRefreshToken, scope: token.scope });
+}
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/pds.js
+git commit -m "feat(oauth): implement refresh token grant"
+```
+
+---
+
+## Task 10: Update requireAuth for DPoP Tokens
+
+**Files:**
+- Modify: `src/pds.js`
+
+**Step 1: Update requireAuth**
+
+```javascript
+/**
+ * @typedef {Object} AuthResult
+ * @property {string} did - The authenticated user's DID
+ * @property {string} [scope] - The granted scope (for OAuth tokens)
+ */
+
+/**
+ * Require authentication for a request.
+ * Supports both legacy Bearer tokens (JWT with symmetric key) and OAuth DPoP tokens.
+ * @param {Request} request - The incoming request
+ * @param {{ JWT_SECRET: string, PDS_PASSWORD: string }} env - Environment variables
+ * @param {{ storage: DurableObjectStorage }} pds - The PDS instance
+ * @returns {Promise<AuthResult>} The authenticated user's DID and scope
+ * @throws {AuthRequiredError} If authentication fails
+ */
+async function requireAuth(request, env, pds) {
+  const authHeader = request.headers.get('Authorization');
+  if (!authHeader) throw new AuthRequiredError('Authorization required');
+
+  if (authHeader.startsWith('Bearer ')) {
+    return verifyAccessJwt(authHeader.slice(7), env.JWT_SECRET);
+  }
+
+  if (authHeader.startsWith('DPoP ')) {
+    return verifyOAuthAccessToken(request, authHeader.slice(5), pds);
+  }
+
+  throw new AuthRequiredError('Invalid authorization type');
+}
+
+/**
+ * Verify an OAuth DPoP-bound access token.
+ * Validates the JWT signature, expiration, DPoP binding, and proof.
+ * @param {Request} request - The incoming request (for DPoP validation)
+ * @param {string} token - The access token JWT
+ * @param {{ storage: DurableObjectStorage }} pds - The PDS instance
+ * @returns {Promise<AuthResult>} The authenticated user's DID and scope
+ * @throws {AuthRequiredError} If verification fails
+ */
+async function verifyOAuthAccessToken(request, token, pds) {
+  const parts = token.split('.');
+  if (parts.length !== 3) throw new AuthRequiredError('Invalid token format');
+
+  const header = JSON.parse(new TextDecoder().decode(base64UrlDecode(parts[0])));
+  if (header.typ !== 'at+jwt') throw new AuthRequiredError('Invalid token type');
+
+  // Verify signature with PDS public key
+  const publicKeyJwk = await getPublicKeyJwk(pds);
+  const publicKey = await crypto.subtle.importKey(
+    'jwk', publicKeyJwk, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']
+  );
+
+  const signatureInput = new TextEncoder().encode(parts[0] + '.' + parts[1]);
+  const signature = base64UrlDecode(parts[2]);
+
+  const valid = await crypto.subtle.verify(
+    { name: 'ECDSA', hash: 'SHA-256' }, publicKey,
+    compactSignatureToDer(signature), signatureInput
+  );
+  if (!valid) throw new AuthRequiredError('Invalid token signature');
+
+  const payload = JSON.parse(new TextDecoder().decode(base64UrlDecode(parts[1])));
+
+  if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {
+    throw new AuthRequiredError('Token expired');
+  }
+
+  if (!payload.cnf?.jkt) throw new AuthRequiredError('Token missing DPoP binding');
+
+  const dpopHeader = request.headers.get('DPoP');
+  if (!dpopHeader) throw new AuthRequiredError('DPoP proof required');
+
+  const url = new URL(request.url);
+  await parseDpopProof(dpopHeader, request.method, `${url.protocol}//${url.host}${url.pathname}`, payload.cnf.jkt, token);
+
+  return { did: payload.sub, scope: payload.scope };
+}
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/pds.js
+git commit -m "feat(oauth): update requireAuth to handle DPoP tokens"
+```
+
+---
+
+## Task 11: Add Revocation Endpoint
+
+**Files:**
+- Modify: `src/pds.js`
+
+**Step 1: Add revoke handler**
+
+```javascript
+if (path === '/oauth/revoke' && method === 'POST') {
+  return handleRevoke(request, url, this, env);
+}
+
+/**
+ * Handle token revocation endpoint (RFC 7009).
+ * Revokes access tokens and refresh tokens by client_id.
+ * @param {Request} request - The incoming request
+ * @param {URL} url - Parsed request URL
+ * @param {{ storage: DurableObjectStorage }} pds - The PDS instance
+ * @param {{ PDS_PASSWORD: string }} env - Environment variables
+ * @returns {Promise<Response>} Empty 200 response on success
+ */
+async function handleRevoke(request, url, pds, env) {
+  const body = await request.text();
+  const params = new URLSearchParams(body);
+  const token = params.get('token');
+  const clientId = params.get('client_id');
+
+  if (!token || !clientId) return json({ error: 'invalid_request' }, 400);
+
+  const sql = createSql(pds.storage);
+  await sql`
+    DELETE FROM tokens WHERE client_id = ${clientId}
+    AND (refresh_token = ${token} OR token_id = ${token})
+  `;
+
+  return new Response(null, { status: 200 });
+}
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/pds.js
+git commit -m "feat(oauth): add token revocation endpoint"
+```
+
+---
+
+## Task 12: Add OAuth E2E Tests
+
+**Files:**
+- Modify: `test/e2e.sh`
+
+**Step 1: Add OAuth tests to e2e.sh**
+
+Add after the existing tests:
+
+```bash
+# OAuth tests
+echo
+echo "Testing OAuth endpoints..."
+
+# Test OAuth Authorization Server Metadata
+echo "Testing OAuth AS metadata..."
+AS_METADATA=$(curl -sf "$BASE/.well-known/oauth-authorization-server")
+echo "$AS_METADATA" | jq -e '.issuer == "'"$BASE"'"' >/dev/null &&
+  pass "AS metadata: issuer matches base URL" || fail "AS metadata: issuer mismatch"
+echo "$AS_METADATA" | jq -e '.authorization_endpoint == "'"$BASE"'/oauth/authorize"' >/dev/null &&
+  pass "AS metadata: authorization_endpoint" || fail "AS metadata: authorization_endpoint"
+echo "$AS_METADATA" | jq -e '.token_endpoint == "'"$BASE"'/oauth/token"' >/dev/null &&
+  pass "AS metadata: token_endpoint" || fail "AS metadata: token_endpoint"
+echo "$AS_METADATA" | jq -e '.pushed_authorization_request_endpoint == "'"$BASE"'/oauth/par"' >/dev/null &&
+  pass "AS metadata: PAR endpoint" || fail "AS metadata: PAR endpoint"
+echo "$AS_METADATA" | jq -e '.revocation_endpoint == "'"$BASE"'/oauth/revoke"' >/dev/null &&
+  pass "AS metadata: revocation_endpoint" || fail "AS metadata: revocation_endpoint"
+echo "$AS_METADATA" | jq -e '.jwks_uri == "'"$BASE"'/oauth/jwks"' >/dev/null &&
+  pass "AS metadata: jwks_uri" || fail "AS metadata: jwks_uri"
+echo "$AS_METADATA" | jq -e '.scopes_supported | contains(["atproto"])' >/dev/null &&
+  pass "AS metadata: scopes_supported includes atproto" || fail "AS metadata: scopes_supported"
+echo "$AS_METADATA" | jq -e '.response_types_supported | contains(["code"])' >/dev/null &&
+  pass "AS metadata: response_types_supported" || fail "AS metadata: response_types_supported"
+echo "$AS_METADATA" | jq -e '.grant_types_supported | contains(["authorization_code", "refresh_token"])' >/dev/null &&
+  pass "AS metadata: grant_types_supported" || fail "AS metadata: grant_types_supported"
+echo "$AS_METADATA" | jq -e '.code_challenge_methods_supported | contains(["S256"])' >/dev/null &&
+  pass "AS metadata: PKCE S256 supported" || fail "AS metadata: PKCE S256"
+echo "$AS_METADATA" | jq -e '.dpop_signing_alg_values_supported | contains(["ES256"])' >/dev/null &&
+  pass "AS metadata: DPoP ES256 supported" || fail "AS metadata: DPoP ES256"
+echo "$AS_METADATA" | jq -e '.require_pushed_authorization_requests == true' >/dev/null &&
+  pass "AS metadata: PAR required" || fail "AS metadata: PAR required"
+echo "$AS_METADATA" | jq -e '.authorization_response_iss_parameter_supported == true' >/dev/null &&
+  pass "AS metadata: iss parameter supported" || fail "AS metadata: iss parameter"
+
+# Test OAuth Protected Resource Metadata
+echo "Testing OAuth PR metadata..."
+PR_METADATA=$(curl -sf "$BASE/.well-known/oauth-protected-resource")
+echo "$PR_METADATA" | jq -e '.resource == "'"$BASE"'"' >/dev/null &&
+  pass "PR metadata: resource matches base URL" || fail "PR metadata: resource mismatch"
+echo "$PR_METADATA" | jq -e '.authorization_servers | contains(["'"$BASE"'"])' >/dev/null &&
+  pass "PR metadata: authorization_servers" || fail "PR metadata: authorization_servers"
+echo "$PR_METADATA" | jq -e '.scopes_supported | contains(["atproto"])' >/dev/null &&
+  pass "PR metadata: scopes_supported" || fail "PR metadata: scopes_supported"
+
+# Test JWKS endpoint
+echo "Testing JWKS endpoint..."
+JWKS=$(curl -sf "$BASE/oauth/jwks")
+echo "$JWKS" | jq -e '.keys | length > 0' >/dev/null &&
+  pass "JWKS: has at least one key" || fail "JWKS: no keys"
+echo "$JWKS" | jq -e '.keys[0].kty == "EC"' >/dev/null &&
+  pass "JWKS: key is EC type" || fail "JWKS: key type"
+echo "$JWKS" | jq -e '.keys[0].crv == "P-256"' >/dev/null &&
+  pass "JWKS: key uses P-256 curve" || fail "JWKS: curve"
+echo "$JWKS" | jq -e '.keys[0].alg == "ES256"' >/dev/null &&
+  pass "JWKS: key algorithm is ES256" || fail "JWKS: algorithm"
+echo "$JWKS" | jq -e '.keys[0].use == "sig"' >/dev/null &&
+  pass "JWKS: key use is sig" || fail "JWKS: key use"
+echo "$JWKS" | jq -e '.keys[0].kid == "pds-oauth-key"' >/dev/null &&
+  pass "JWKS: kid is pds-oauth-key" || fail "JWKS: kid"
+echo "$JWKS" | jq -e '.keys[0] | has("x") and has("y")' >/dev/null &&
+  pass "JWKS: has x and y coordinates" || fail "JWKS: coordinates"
+echo "$JWKS" | jq -e '.keys[0] | has("d") | not' >/dev/null &&
+  pass "JWKS: does not expose private key (d)" || fail "JWKS: private key exposed!"
+
+# Test PAR endpoint error cases
+echo "Testing PAR error handling..."
+PAR_NO_DPOP=$(curl -s -w "\n%{http_code}" -X POST "$BASE/oauth/par" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "client_id=http://localhost:3000&redirect_uri=http://localhost:3000/callback&response_type=code&scope=atproto&code_challenge=test&code_challenge_method=S256")
+PAR_BODY=$(echo "$PAR_NO_DPOP" | head -n -1)
+PAR_STATUS=$(echo "$PAR_NO_DPOP" | tail -n 1)
+[ "$PAR_STATUS" = "400" ] && pass "PAR: rejects missing DPoP (400)" || fail "PAR: should reject missing DPoP"
+echo "$PAR_BODY" | jq -e '.error == "invalid_dpop_proof"' >/dev/null &&
+  pass "PAR: error code is invalid_dpop_proof" || fail "PAR: wrong error code"
+
+# Test token endpoint error cases
+echo "Testing token endpoint error handling..."
+TOKEN_NO_DPOP=$(curl -s -w "\n%{http_code}" -X POST "$BASE/oauth/token" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "grant_type=authorization_code&code=fake&client_id=http://localhost:3000")
+TOKEN_BODY=$(echo "$TOKEN_NO_DPOP" | head -n -1)
+TOKEN_STATUS=$(echo "$TOKEN_NO_DPOP" | tail -n 1)
+[ "$TOKEN_STATUS" = "400" ] && pass "Token: rejects missing DPoP (400)" || fail "Token: should reject missing DPoP"
+echo "$TOKEN_BODY" | jq -e '.error == "invalid_dpop_proof"' >/dev/null &&
+  pass "Token: error code is invalid_dpop_proof" || fail "Token: wrong error code"
+
+# Test revoke endpoint (should accept without valid token - RFC 7009 says always 200)
+echo "Testing revoke endpoint..."
+REVOKE_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/oauth/revoke" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "token=nonexistent&client_id=http://localhost:3000")
+[ "$REVOKE_STATUS" = "200" ] && pass "Revoke: returns 200 even for invalid token" || fail "Revoke: should always return 200"
+
+echo
+echo "All OAuth endpoint tests passed!"
+```
+
+**Step 2: Commit**
+
+```bash
+git add test/e2e.sh
+git commit -m "test(oauth): add comprehensive OAuth e2e tests"
+```
+
+---
+
+## Task 13: Run Typecheck and Fix Any Errors
+
+**Files:**
+- Modify: `src/pds.js` (if needed)
+
+**Step 1: Run TypeScript type checking**
+
+```bash
+npm run typecheck
+```
+
+Expect: No type errors. If there are errors, fix them before continuing.
+
+**Step 2: Run unit tests**
+
+```bash
+npm test
+```
+
+Expect: All tests pass.
+
+**Step 3: Run e2e tests**
+
+Start wrangler dev in one terminal, then run:
+
+```bash
+./test/e2e.sh
+```
+
+Expect: All tests pass.
+
+**Step 4: Final commit (if any fixes were needed)**
+
+```bash
+git add src/pds.js
+git commit -m "fix(oauth): address typecheck errors"
+```
+
+---
+
+## Summary
+
+This plan implements AT Protocol OAuth with:
+- PAR (Pushed Authorization Requests)
+- DPoP (Demonstration of Proof-of-Possession)
+- PKCE (Proof Key for Code Exchange)
+- Authorization code flow with consent UI
+- Token refresh and revocation
+- Backward compatibility with existing Bearer tokens
+
+All implemented with zero external dependencies using Web Crypto APIs.

package.json

···
     "dev": "wrangler dev --persist-to .wrangler/state",
     "dev:remote": "wrangler dev --remote",
     "deploy": "wrangler deploy",
-    "test": "node --test test/*.test.js",
-    "test:e2e": "./test/e2e.sh",
+    "test": "node --test test/pds.test.js",
+    "test:e2e": "node --test test/e2e.test.js",
     "setup": "node scripts/setup.js",
-    "format": "biome format --write . && shfmt -w -i 2 test/*.sh",
+    "format": "biome format --write .",
     "lint": "biome lint .",
     "check": "biome check .",
     "typecheck": "tsc --noEmit"

src/pds.js

···
 // ║     • Merkle Search Tree (MST) for repository structure                      ║
 // ║     • P-256 signing with low-S normalization                                 ║
 // ║     • JWT authentication (access, refresh, service tokens)                   ║
+// ║     • OAuth 2.0 with DPoP, PKCE, and token management                        ║
 // ║     • CAR file building for repo sync                                        ║
 // ║     • R2 blob storage with MIME detection                                    ║
 // ║     • SQLite persistence via Durable Objects                                 ║
···
  * @property {string} [jti] - Unique token identifier
  */
 
+/**
+ * OAuth client metadata from client_id URL
+ * @typedef {Object} ClientMetadata
+ * @property {string} client_id - The client identifier (must match the URL used to fetch metadata)
+ * @property {string} [client_name] - Human-readable client name
+ * @property {string[]} redirect_uris - Allowed redirect URIs
+ * @property {string[]} grant_types - Supported grant types
+ * @property {string[]} response_types - Supported response types
+ * @property {string} [token_endpoint_auth_method] - Token endpoint auth method
+ * @property {boolean} [dpop_bound_access_tokens] - Whether client requires DPoP-bound tokens
+ * @property {string} [scope] - Default scope
+ */
+
+/**
+ * Parsed and validated DPoP proof
+ * @typedef {Object} DpopProofResult
+ * @property {string} jkt - The JWK thumbprint of the DPoP key
+ * @property {string} jti - The unique identifier from the DPoP proof
+ * @property {number} iat - The issued-at timestamp from the DPoP proof
+ * @property {{ kty: string, crv: string, x: string, y: string }} jwk - The public key from the proof
+ */
+
+/**
+ * Parameters for creating a DPoP-bound access token
+ * @typedef {Object} AccessTokenParams
+ * @property {string} issuer - The PDS issuer URL
+ * @property {string} subject - The DID of the authenticated user
+ * @property {string} clientId - The OAuth client_id
+ * @property {string} scope - The granted scope
+ * @property {string} tokenId - Unique token identifier (jti)
+ * @property {string} dpopJkt - The DPoP key thumbprint for token binding
+ * @property {number} expiresIn - Token lifetime in seconds
+ */
+
 // ╔══════════════════════════════════════════════════════════════════════════════╗
 // ║ UTILITIES                                                                    ║
 // ║ Error responses, byte conversion, base encoding                              ║
···
 }
 
 /**
+ * Get the default PDS Durable Object stub.
+ * @param {Env} env - Environment bindings
+ * @returns {{ fetch: (req: Request) => Promise<Response> }} Default PDS stub
+ */
+function getDefaultPds(env) {
+  const id = env.PDS.idFromName('default');
+  return env.PDS.get(id);
+}
+
+/**
+ * Parse request body supporting both JSON and form-encoded formats.
+ * @param {Request} request - The incoming request
+ * @returns {Promise<Record<string, string>>} Parsed body data
+ * @throws {Error} If JSON parsing fails
+ */
+async function parseRequestBody(request) {
+  const contentType = request.headers.get('content-type') || '';
+  const body = await request.text();
+  if (contentType.includes('application/json')) {
+    return JSON.parse(body);
+  }
+  const params = new URLSearchParams(body);
+  return Object.fromEntries(params.entries());
+}
+
+/**
+ * Validate that required parameters are present in data object.
+ * @param {Record<string, unknown>} data - Data object to validate
+ * @param {string[]} required - List of required parameter names
+ * @returns {{ valid: true } | { valid: false, missing: string[] }} Validation result
+ */
+function validateRequiredParams(data, required) {
+  const missing = required.filter((key) => !data[key]);
+  if (missing.length > 0) {
+    return { valid: false, missing };
+  }
+  return { valid: true };
+}
+
+/**
  * Convert bytes to hexadecimal string
  * @param {Uint8Array} bytes - Bytes to convert
  * @returns {string} Hex string
···
     bytes[i] = binary.charCodeAt(i);
   }
   return bytes;
+}
+
+/**
+ * Timing-safe string comparison using constant-time comparison.
+ * Compares hashes of strings to prevent timing attacks.
+ * @param {string} a - First string to compare
+ * @param {string} b - Second string to compare
+ * @returns {Promise<boolean>} True if strings are equal
+ */
+export async function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder();
+  const aBytes = encoder.encode(a);
+  const bBytes = encoder.encode(b);
+
+  // Hash both to ensure constant-time comparison regardless of length
+  const [aHash, bHash] = await Promise.all([
+    crypto.subtle.digest('SHA-256', aBytes),
+    crypto.subtle.digest('SHA-256', bBytes),
+  ]);
+
+  const aArr = new Uint8Array(aHash);
+  const bArr = new Uint8Array(bHash);
+
+  // Constant-time comparison
+  let result = 0;
+  for (let i = 0; i < aArr.length; i++) {
+    result |= aArr[i] ^ bArr[i];
+  }
+  return result === 0;
+}
+
+/**
+ * Compute JWK thumbprint (SHA-256) per RFC 7638.
+ * Creates a canonical JSON representation of EC key required members
+ * and returns the base64url-encoded SHA-256 hash.
+ * @param {{ kty: string, crv: string, x: string, y: string }} jwk - The EC public key in JWK format
+ * @returns {Promise<string>} The base64url-encoded thumbprint
+ */
+export async function computeJwkThumbprint(jwk) {
+  // RFC 7638: members must be in lexicographic order
+  const thumbprintInput = JSON.stringify({
+    crv: jwk.crv,
+    kty: jwk.kty,
+    x: jwk.x,
+    y: jwk.y,
+  });
+  const hash = await crypto.subtle.digest(
+    'SHA-256',
+    new TextEncoder().encode(thumbprintInput),
+  );
+  return base64UrlEncode(new Uint8Array(hash));
+}
+
+/**
+ * Check if a client_id represents a loopback client (localhost development).
+ * Loopback clients are allowed without pre-registration per AT Protocol OAuth spec.
+ * @param {string} clientId - The client_id to check
+ * @returns {boolean} True if the client_id is a loopback address
+ */
+export function isLoopbackClient(clientId) {
+  try {
+    const url = new URL(clientId);
+    const host = url.hostname.toLowerCase();
+    return host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Generate permissive client metadata for a loopback client.
+ * @param {string} clientId - The loopback client_id
+ * @returns {ClientMetadata} Generated client metadata
+ */
+export function getLoopbackClientMetadata(clientId) {
+  return {
+    client_id: clientId,
+    client_name: 'Loopback Client',
+    redirect_uris: [clientId],
+    grant_types: ['authorization_code', 'refresh_token'],
+    response_types: ['code'],
+    token_endpoint_auth_method: 'none',
+    dpop_bound_access_tokens: true,
+    scope: 'atproto',
+  };
+}
+
+/**
+ * Validate client metadata against AT Protocol OAuth requirements.
+ * @param {ClientMetadata} metadata - The client metadata to validate
+ * @param {string} expectedClientId - The expected client_id (the URL used to fetch metadata)
+ * @throws {Error} If validation fails
+ */
+export function validateClientMetadata(metadata, expectedClientId) {
+  if (!metadata.client_id) throw new Error('client_id is required');
+  if (metadata.client_id !== expectedClientId)
+    throw new Error('client_id mismatch');
+  if (
+    !Array.isArray(metadata.redirect_uris) ||
+    metadata.redirect_uris.length === 0
+  ) {
+    throw new Error('redirect_uris is required');
+  }
+  if (!metadata.grant_types?.includes('authorization_code')) {
+    throw new Error('grant_types must include authorization_code');
+  }
+}
+
+/** @type {Map<string, { metadata: ClientMetadata, expiresAt: number }>} */
+const clientMetadataCache = new Map();
+
+/**
+ * Fetch and validate client metadata from a client_id URL.
+ * Caches results for 10 minutes. Loopback clients return synthetic metadata.
+ * @param {string} clientId - The client_id (URL to fetch metadata from)
+ * @returns {Promise<ClientMetadata>} The validated client metadata
+ * @throws {Error} If fetching or validation fails
+ */
+async function getClientMetadata(clientId) {
+  const cached = clientMetadataCache.get(clientId);
+  if (cached && Date.now() < cached.expiresAt) return cached.metadata;
+
+  if (isLoopbackClient(clientId)) {
+    const metadata = getLoopbackClientMetadata(clientId);
+    clientMetadataCache.set(clientId, {
+      metadata,
+      expiresAt: Date.now() + 600000,
+    });
+    return metadata;
+  }
+
+  const response = await fetch(clientId, {
+    headers: { Accept: 'application/json' },
+  });
+  if (!response.ok)
+    throw new Error(`Failed to fetch client metadata: ${response.status}`);
+
+  const metadata = await response.json();
+  validateClientMetadata(metadata, clientId);
+  clientMetadataCache.set(clientId, {
+    metadata,
+    expiresAt: Date.now() + 600000,
+  });
+  return metadata;
+}
+
+/**
+ * Parse and validate a DPoP proof JWT.
+ * Verifies the signature, checks claims (htm, htu, iat, jti), and optionally
+ * validates key binding (expectedJkt) and access token hash (ath).
+ * @param {string} proof - The DPoP proof JWT
+ * @param {string} method - The expected HTTP method (htm claim)
+ * @param {string} url - The expected request URL (htu claim)
+ * @param {string|null} [expectedJkt=null] - If provided, verify the key matches this thumbprint
+ * @param {string|null} [accessToken=null] - If provided, verify the ath claim matches this token's hash
+ * @returns {Promise<DpopProofResult>} The parsed proof with jkt, jti, and jwk
+ * @throws {Error} If validation fails
+ */
+async function parseDpopProof(
+  proof,
+  method,
+  url,
+  expectedJkt = null,
+  accessToken = null,
+) {
+  const parts = proof.split('.');
+  if (parts.length !== 3) throw new Error('Invalid DPoP proof format');
+
+  const header = JSON.parse(
+    new TextDecoder().decode(base64UrlDecode(parts[0])),
+  );
+  const payload = JSON.parse(
+    new TextDecoder().decode(base64UrlDecode(parts[1])),
+  );
+
+  if (header.typ !== 'dpop+jwt')
+    throw new Error('DPoP proof must have typ dpop+jwt');
+  if (header.alg !== 'ES256') throw new Error('DPoP proof must use ES256');
+  if (!header.jwk || header.jwk.kty !== 'EC')
+    throw new Error('DPoP proof must contain EC key');
+
+  // Verify signature
+  const publicKey = await crypto.subtle.importKey(
+    'jwk',
+    header.jwk,
+    { name: 'ECDSA', namedCurve: 'P-256' },
+    false,
+    ['verify'],
+  );
+
+  const signatureInput = new TextEncoder().encode(`${parts[0]}.${parts[1]}`);
+  const signature = base64UrlDecode(parts[2]);
+
+  const valid = await crypto.subtle.verify(
+    { name: 'ECDSA', hash: 'SHA-256' },
+    publicKey,
+    /** @type {BufferSource} */ (signature),
+    /** @type {BufferSource} */ (signatureInput),
+  );
+  if (!valid) throw new Error('DPoP proof signature invalid');
+
+  // Validate claims
+  if (payload.htm !== method) throw new Error('DPoP htm mismatch');
+
+  /** @param {string} u */
+  const normalizeUrl = (u) => u.replace(/\/$/, '').split('?')[0].toLowerCase();
+  if (normalizeUrl(payload.htu) !== normalizeUrl(url))
+    throw new Error('DPoP htu mismatch');
+
+  const now = Math.floor(Date.now() / 1000);
+  if (!payload.iat || payload.iat > now + 60 || payload.iat < now - 300) {
+    throw new Error('DPoP proof expired or invalid iat');
+  }
+
+  if (!payload.jti) throw new Error('DPoP proof missing jti');
+
+  const jkt = await computeJwkThumbprint(header.jwk);
+  if (expectedJkt && jkt !== expectedJkt) throw new Error('DPoP key mismatch');
+
+  if (accessToken) {
+    const tokenHash = await crypto.subtle.digest(
+      'SHA-256',
+      new TextEncoder().encode(accessToken),
+    );
+    const expectedAth = base64UrlEncode(new Uint8Array(tokenHash));
+    if (payload.ath !== expectedAth) throw new Error('DPoP ath mismatch');
+  }
+
+  return { jkt, jti: payload.jti, iat: payload.iat, jwk: header.jwk };
+}
+/**
+ * Render the OAuth consent page HTML.
+ * @param {{ clientName: string, clientId: string, scope: string, requestUri: string, error?: string }} params
+ * @returns {string} HTML page content
+ */
+function renderConsentPage({
+  clientName,
+  clientId,
+  scope,
+  requestUri,
+  error = '',
+}) {
+  /** @param {string} s */
+  const escHtml = (s) =>
+    s
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;');
+  return `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Authorize</title>
+<style>
+*{box-sizing:border-box}
+body{font-family:system-ui,sans-serif;max-width:400px;margin:40px auto;padding:20px;background:#1a1a1a;color:#e0e0e0}
+h2{color:#fff;margin-bottom:24px}
+p{color:#b0b0b0;line-height:1.5}
+b{color:#fff}
+.error{color:#ff6b6b;background:#2d1f1f;padding:12px;margin:12px 0;border-radius:6px;border:1px solid #4a2020}
+label{display:block;margin:16px 0 6px;color:#b0b0b0;font-size:14px}
+input[type="password"]{width:100%;padding:12px;background:#2a2a2a;border:1px solid #404040;border-radius:6px;color:#fff;font-size:16px}
+input[type="password"]:focus{outline:none;border-color:#4a9eff;box-shadow:0 0 0 2px rgba(74,158,255,0.2)}
+.actions{display:flex;gap:12px;margin-top:24px}
+button{flex:1;padding:12px 20px;border-radius:6px;font-size:16px;font-weight:500;cursor:pointer;transition:background 0.15s}
+.deny{background:#2a2a2a;color:#e0e0e0;border:1px solid #404040}
+.deny:hover{background:#333}
+.approve{background:#2563eb;color:#fff;border:none}
+.approve:hover{background:#1d4ed8}
+</style></head>
+<body><h2>Sign in to authorize</h2>
+<p><b>${escHtml(clientName)}</b> wants to access your account.</p>
+<p>Scope: ${escHtml(scope)}</p>
+${error ? `<p class="error">${escHtml(error)}</p>` : ''}
+<form method="POST" action="/oauth/authorize">
+<input type="hidden" name="request_uri" value="${escHtml(requestUri)}">
+<input type="hidden" name="client_id" value="${escHtml(clientId)}">
+<label>Password</label><input type="password" name="password" required autofocus>
+<div class="actions"><button type="submit" name="action" value="deny" class="deny" formnovalidate>Deny</button>
+<button type="submit" name="action" value="approve" class="approve">Authorize</button></div>
+</form></body></html>`;
 }
 
 /**
···
   '/repo-info': {
     handler: (pds, _req, _url) => pds.handleRepoInfo(),
   },
+  '/oauth-public-key': {
+    handler: async (pds) => Response.json(await pds.getPublicKeyJwk()),
+  },
+  '/check-dpop-jti': {
+    method: 'POST',
+    handler: async (pds, req) => {
+      const { jti, iat } = await req.json();
+      const fresh = pds.checkAndStoreDpopJti(jti, iat);
+      return Response.json({ fresh });
+    },
+  },
   '/xrpc/com.atproto.server.describeServer': {
     handler: (pds, req, _url) => pds.handleDescribeServer(req),
   },
···
   '/xrpc/com.atproto.sync.subscribeRepos': {
     handler: (pds, req, url) => pds.handleSubscribeRepos(req, url),
   },
+  // OAuth endpoints
+  '/.well-known/oauth-authorization-server': {
+    handler: (pds, _req, url) => pds.handleOAuthAuthServerMetadata(url),
+  },
+  '/.well-known/oauth-protected-resource': {
+    handler: (pds, _req, url) => pds.handleOAuthProtectedResource(url),
+  },
+  '/oauth/jwks': {
+    handler: (pds, _req, _url) => pds.handleOAuthJwks(),
+  },
+  '/oauth/par': {
+    method: 'POST',
+    handler: (pds, req, url) => pds.handleOAuthPar(req, url),
+  },
+  '/oauth/authorize': {
+    handler: (pds, req, url) => pds.handleOAuthAuthorize(req, url),
+  },
+  '/oauth/token': {
+    method: 'POST',
+    handler: (pds, req, url) => pds.handleOAuthToken(req, url),
+  },
+  '/oauth/revoke': {
+    method: 'POST',
+    handler: (pds, req, url) => pds.handleOAuthRevoke(req, url),
+  },
 };
 
 // ╔══════════════════════════════════════════════════════════════════════════════╗
···
       CREATE INDEX IF NOT EXISTS idx_record_blobs_record_uri ON record_blobs(record_uri);
 
       CREATE INDEX IF NOT EXISTS idx_records_collection ON records(collection, rkey);
+
+      CREATE TABLE IF NOT EXISTS authorization_requests (
+        id TEXT PRIMARY KEY,
+        client_id TEXT NOT NULL,
+        client_metadata TEXT NOT NULL,
+        parameters TEXT NOT NULL,
+        code TEXT,
+        code_challenge TEXT,
+        code_challenge_method TEXT,
+        dpop_jkt TEXT,
+        did TEXT,
+        expires_at TEXT NOT NULL,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_authorization_requests_code
+      ON authorization_requests(code) WHERE code IS NOT NULL;
+
+      CREATE TABLE IF NOT EXISTS tokens (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        token_id TEXT UNIQUE NOT NULL,
+        did TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        scope TEXT,
+        dpop_jkt TEXT,
+        expires_at TEXT NOT NULL,
+        refresh_token TEXT UNIQUE,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_tokens_did ON tokens(did);
+
+      CREATE TABLE IF NOT EXISTS dpop_jtis (
+        jti TEXT PRIMARY KEY,
+        expires_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_dpop_jtis_expires ON dpop_jtis(expires_at);
     `);
   }
 
···
       );
     }
 
-    // Check password against env var
+    // Check password against env var (timing-safe comparison)
     const expectedPassword = this.env?.PDS_PASSWORD;
-    if (!expectedPassword || password !== expectedPassword) {
+    if (
+      !expectedPassword ||
+      !(await timingSafeEqual(password, expectedPassword))
+    ) {
       return errorResponse(
         'AuthRequired',
         'Invalid identifier or password',
···
   /** @param {Request} request */
   async handleGetSession(request) {
     const authHeader = request.headers.get('Authorization');
-    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    if (!authHeader) {
       return errorResponse(
         'AuthRequired',
         'Missing or invalid authorization header',
···
       );
     }
 
-    const token = authHeader.slice(7); // Remove 'Bearer '
-    const jwtSecret = this.env?.JWT_SECRET;
-    if (!jwtSecret) {
+    let did;
+
+    // OAuth DPoP token
+    if (authHeader.startsWith('DPoP ')) {
+      try {
+        const result = await verifyOAuthAccessToken(
+          request,
+          authHeader.slice(5),
+          this,
+        );
+        did = result.did;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return errorResponse('InvalidToken', message, 401);
+      }
+    }
+    // Legacy Bearer token
+    else if (authHeader.startsWith('Bearer ')) {
+      const token = authHeader.slice(7);
+      const jwtSecret = this.env?.JWT_SECRET;
+      if (!jwtSecret) {
+        return errorResponse(
+          'InternalServerError',
+          'Server not configured for authentication',
+          500,
+        );
+      }
+
+      try {
+        const payload = await verifyAccessJwt(token, jwtSecret);
+        did = payload.sub;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return errorResponse('InvalidToken', message, 401);
+      }
+    } else {
       return errorResponse(
-        'InternalServerError',
-        'Server not configured for authentication',
-        500,
+        'AuthRequired',
+        'Invalid authorization header format',
+        401,
       );
     }
 
-    try {
-      const payload = await verifyAccessJwt(token, jwtSecret);
-      const did = payload.sub;
-      const handle = await this.getHandleForDid(did);
-
-      return Response.json({
-        handle: handle || did,
-        did,
-        active: true,
-      });
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      return errorResponse('InvalidToken', message, 401);
-    }
+    const handle = await this.getHandleForDid(did);
+    return Response.json({
+      handle: handle || did,
+      did,
+      active: true,
+    });
   }
 
   /** @param {Request} request */
···
     try {
       const result = await this.deleteRecord(body.collection, body.rkey);
       if (result.error) {
-        return Response.json(result, { status: 404 });
+        return errorResponse(result.error, result.message, 404);
       }
       return Response.json({});
     } catch (err) {
···
       this.sql.exec('DELETE FROM blobs WHERE cid = ?', cid);
     }
   }
+
+  // ╔═════════════════════════════════════════════════════════════════════════════╗
+  // ║ OAUTH HANDLERS                                                              ║
+  // ║ OAuth 2.0 authorization server with DPoP, PKCE, and token management        ║
+  // ╚═════════════════════════════════════════════════════════════════════════════╝
+
+  /**
+   * Check if a DPoP jti has been used and mark it as used.
+   * Returns true if the jti is fresh (not seen before), false if it's a replay.
+   * Also cleans up expired jtis.
+   * @param {string} jti - The DPoP proof jti to check
+   * @param {number} iat - The iat claim from the DPoP proof (unix timestamp)
+   * @returns {boolean} True if jti is fresh, false if replay
+   */
+  checkAndStoreDpopJti(jti, iat) {
+    // Clean up expired jtis (older than 5 minutes)
+    const cutoff = new Date(Date.now() - 5 * 60 * 1000).toISOString();
+    this.sql.exec(`DELETE FROM dpop_jtis WHERE expires_at < ?`, cutoff);
+
+    // Check if jti already exists
+    const existing = this.sql
+      .exec(`SELECT 1 FROM dpop_jtis WHERE jti = ?`, jti)
+      .toArray();
+    if (existing.length > 0) {
+      return false; // Replay attack
+    }
+
+    // Store jti with expiration (iat + 5 minutes)
+    const expiresAt = new Date((iat + 300) * 1000).toISOString();
+    this.sql.exec(
+      `INSERT INTO dpop_jtis (jti, expires_at) VALUES (?, ?)`,
+      jti,
+      expiresAt,
+    );
+    return true;
+  }
+
+  /**
+   * Clean up expired authorization requests.
+   * Should be called periodically to prevent table bloat.
+   * @returns {number} Number of expired requests deleted
+   */
+  cleanupExpiredAuthorizationRequests() {
+    const now = new Date().toISOString();
+    const result = this.sql.exec(
+      `DELETE FROM authorization_requests WHERE expires_at < ?`,
+      now,
+    );
+    return result.rowsWritten;
+  }
+
+  /**
+   * Validate a required DPoP proof header, parse it, and check for replay attacks.
+   * @param {Request} request - The incoming request
+   * @param {string} method - Expected HTTP method
+   * @param {string} uri - Expected request URI
+   * @returns {Promise<{ dpop: DpopProofResult } | { error: Response }>} The parsed DPoP proof or error response
+   */
+  async validateRequiredDpop(request, method, uri) {
+    const dpopHeader = request.headers.get('DPoP');
+    if (!dpopHeader) {
+      return {
+        error: errorResponse('invalid_dpop_proof', 'DPoP proof required', 400),
+      };
+    }
+
+    let dpop;
+    try {
+      dpop = await parseDpopProof(dpopHeader, method, uri);
+    } catch (err) {
+      return { error: errorResponse('invalid_dpop_proof', err.message, 400) };
+    }
+
+    if (!this.checkAndStoreDpopJti(dpop.jti, dpop.iat)) {
+      return {
+        error: errorResponse(
+          'invalid_dpop_proof',
+          'DPoP proof replay detected',
+          400,
+        ),
+      };
+    }
+
+    return { dpop };
+  }
+
+  /**
+   * Get or create the OAuth signing key for this PDS instance.
+   * Lazily generates a new key if one doesn't exist.
+   * @returns {Promise<string>} The private key as hex string
+   */
+  async getOAuthPrivateKey() {
+    let privateKeyHex = /** @type {string|undefined} */ (
+      await this.state.storage.get('oauthPrivateKey')
+    );
+    if (!privateKeyHex) {
+      // Generate a new OAuth signing key
+      const keyPair = await crypto.subtle.generateKey(
+        { name: 'ECDSA', namedCurve: 'P-256' },
+        true,
+        ['sign', 'verify'],
+      );
+      const rawKey = await crypto.subtle.exportKey('pkcs8', keyPair.privateKey);
+      // Extract the 32-byte private key from PKCS#8 (last 32 bytes after the prefix)
+      const keyBytes = new Uint8Array(rawKey).slice(-32);
+      privateKeyHex = bytesToHex(keyBytes);
+      await this.state.storage.put('oauthPrivateKey', privateKeyHex);
+    }
+    return privateKeyHex;
+  }
+
+  /**
+   * Get the PDS signing key as a public JWK.
+   * Exports only the public components (kty, crv, x, y) for use in JWKS.
+   * @returns {Promise<{ kty: string, crv: string, x: string, y: string }>} The public key in JWK format
+   * @throws {Error} If the PDS is not initialized
+   */
+  async getPublicKeyJwk() {
+    const privateKeyHex = await this.getOAuthPrivateKey();
+    if (!privateKeyHex) throw new Error('PDS not initialized');
+
+    // Import key with extractable=true to export public components
+    const privateKeyBytes = hexToBytes(privateKeyHex);
+    const pkcs8Prefix = new Uint8Array([
+      0x30, 0x41, 0x02, 0x01, 0x00, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48,
+      0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03,
+      0x01, 0x07, 0x04, 0x27, 0x30, 0x25, 0x02, 0x01, 0x01, 0x04, 0x20,
+    ]);
+    const pkcs8 = new Uint8Array(pkcs8Prefix.length + 32);
+    pkcs8.set(pkcs8Prefix);
+    pkcs8.set(privateKeyBytes, pkcs8Prefix.length);
+
+    const privateKey = await crypto.subtle.importKey(
+      'pkcs8',
+      pkcs8,
+      { name: 'ECDSA', namedCurve: 'P-256' },
+      true,
+      ['sign'],
+    );
+    const jwk = await crypto.subtle.exportKey('jwk', privateKey);
+    return {
+      kty: /** @type {string} */ (jwk.kty),
+      crv: /** @type {string} */ (jwk.crv),
+      x: /** @type {string} */ (jwk.x),
+      y: /** @type {string} */ (jwk.y),
+    };
+  }
+
+  /**
+   * Handle OAuth Authorization Server Metadata endpoint.
+   * @param {URL} url - Parsed request URL
+   * @returns {Response} JSON response with OAuth AS metadata
+   */
+  handleOAuthAuthServerMetadata(url) {
+    const issuer = `${url.protocol}//${url.host}`;
+    return Response.json({
+      issuer,
+      authorization_endpoint: `${issuer}/oauth/authorize`,
+      token_endpoint: `${issuer}/oauth/token`,
+      revocation_endpoint: `${issuer}/oauth/revoke`,
+      pushed_authorization_request_endpoint: `${issuer}/oauth/par`,
+      jwks_uri: `${issuer}/oauth/jwks`,
+      scopes_supported: ['atproto'],
+      subject_types_supported: ['public'],
+      response_types_supported: ['code'],
+      response_modes_supported: ['query', 'fragment'],
+      grant_types_supported: ['authorization_code', 'refresh_token'],
+      code_challenge_methods_supported: ['S256'],
+      token_endpoint_auth_methods_supported: ['none'],
+      dpop_signing_alg_values_supported: ['ES256'],
+      require_pushed_authorization_requests: true,
+      authorization_response_iss_parameter_supported: true,
+      client_id_metadata_document_supported: true,
+      protected_resources: [issuer],
+    });
+  }
+
+  /**
+   * Handle OAuth Protected Resource Metadata endpoint.
+   * @param {URL} url - Parsed request URL
+   * @returns {Response} JSON response with OAuth PR metadata
+   */
+  handleOAuthProtectedResource(url) {
+    const resource = `${url.protocol}//${url.host}`;
+    return Response.json({
+      resource,
+      authorization_servers: [resource],
+      bearer_methods_supported: ['header'],
+      scopes_supported: ['atproto'],
+    });
+  }
+
+  /**
+   * Handle OAuth JWKS endpoint.
+   * @returns {Promise<Response>} JSON response with JWKS
+   */
+  async handleOAuthJwks() {
+    const publicKeyJwk = await this.getPublicKeyJwk();
+    return Response.json({
+      keys: [
+        { ...publicKeyJwk, kid: 'pds-oauth-key', use: 'sig', alg: 'ES256' },
+      ],
+    });
+  }
+
+  /**
+   * Handle Pushed Authorization Request (PAR) endpoint.
+   * Validates DPoP proof, client metadata, PKCE parameters, and stores the authorization request.
+   * @param {Request} request - The incoming request
+   * @param {URL} url - Parsed request URL
+   * @returns {Promise<Response>} JSON response with request_uri and expires_in
+   */
+  async handleOAuthPar(request, url) {
+    // Opportunistically clean up expired authorization requests
+    this.cleanupExpiredAuthorizationRequests();
+
+    const issuer = `${url.protocol}//${url.host}`;
+
+    const dpopResult = await this.validateRequiredDpop(
+      request,
+      'POST',
+      `${issuer}/oauth/par`,
+    );
+    if ('error' in dpopResult) return dpopResult.error;
+    const { dpop } = dpopResult;
+
+    // Parse body - support both JSON and form-encoded
+    /** @type {Record<string, string|undefined>} */
+    let data;
+    try {
+      data = await parseRequestBody(request);
+    } catch {
+      return errorResponse('invalid_request', 'Invalid JSON body', 400);
+    }
+
+    const clientId = data.client_id;
+    const redirectUri = data.redirect_uri;
+    const responseType = data.response_type;
+    const responseMode = data.response_mode;
+    const scope = data.scope;
+    const state = data.state;
+    const codeChallenge = data.code_challenge;
+    const codeChallengeMethod = data.code_challenge_method;
+    const loginHint = data.login_hint;
+
+    if (!clientId)
+      return errorResponse('invalid_request', 'client_id required', 400);
+    if (!redirectUri)
+      return errorResponse('invalid_request', 'redirect_uri required', 400);
+    if (responseType !== 'code')
+      return errorResponse(
+        'unsupported_response_type',
+        'response_type must be code',
+        400,
+      );
+    if (!codeChallenge || codeChallengeMethod !== 'S256') {
+      return errorResponse('invalid_request', 'PKCE with S256 required', 400);
+    }
+
+    let clientMetadata;
+    try {
+      clientMetadata = await getClientMetadata(clientId);
+    } catch (err) {
+      return errorResponse('invalid_client', err.message, 400);
+    }
+
+    // Validate redirect_uri against registered URIs
+    // For loopback clients (RFC 8252), allow any path on the same origin
+    const isLoopback =
+      clientId.startsWith('http://localhost') ||
+      clientId.startsWith('http://127.0.0.1');
+    const redirectUriValid = clientMetadata.redirect_uris.some((uri) => {
+      if (isLoopback) {
+        // For loopback, check origin match (any path allowed)
+        try {
+          const registered = new URL(uri);
+          const requested = new URL(redirectUri);
+          return registered.origin === requested.origin;
+        } catch {
+          return false;
+        }
+      }
+      return uri === redirectUri;
+    });
+    if (!redirectUriValid) {
+      return errorResponse(
+        'invalid_request',
+        'redirect_uri not registered for this client',
+        400,
+      );
+    }
+
+    const requestId = crypto.randomUUID();
+    const requestUri = `urn:ietf:params:oauth:request_uri:${requestId}`;
+    const expiresIn = 600;
+    const expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString();
+
+    this.sql.exec(
+      `INSERT INTO authorization_requests (
+        id, client_id, client_metadata, parameters,
+        code_challenge, code_challenge_method, dpop_jkt,
+        expires_at, created_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      requestId,
+      clientId,
+      JSON.stringify(clientMetadata),
+      JSON.stringify({
+        redirect_uri: redirectUri,
+        scope,
+        state,
+        response_mode: responseMode,
+        login_hint: loginHint,
+      }),
+      codeChallenge,
+      codeChallengeMethod,
+      dpop.jkt,
+      expiresAt,
+      new Date().toISOString(),
+    );
+
+    return Response.json({ request_uri: requestUri, expires_in: expiresIn });
+  }
+
+  /**
+   * Handle OAuth Authorize endpoint - displays consent UI (GET) or processes approval (POST).
+   * @param {Request} request - The incoming request
+   * @param {URL} url - Parsed request URL
+   * @returns {Promise<Response>} HTML consent page or redirect
+   */
+  async handleOAuthAuthorize(request, url) {
+    if (request.method === 'GET') {
+      return this.handleOAuthAuthorizeGet(url);
+    } else if (request.method === 'POST') {
+      return this.handleOAuthAuthorizePost(request, url);
+    }
+    return errorResponse('MethodNotAllowed', 'Method not allowed', 405);
+  }
+
+  /**
+   * Handle GET /oauth/authorize - displays the consent UI.
+   * Validates the request_uri from PAR and renders a login/consent form.
+   * @param {URL} url - Parsed request URL
+   * @returns {Promise<Response>} HTML consent page
+   */
+  async handleOAuthAuthorizeGet(url) {
+    const requestUri = url.searchParams.get('request_uri');
+    const clientId = url.searchParams.get('client_id');
+
+    if (!requestUri || !clientId) {
+      return new Response('Missing parameters', { status: 400 });
+    }
+
+    const match = requestUri.match(/^urn:ietf:params:oauth:request_uri:(.+)$/);
+    if (!match) return new Response('Invalid request_uri', { status: 400 });
+
+    const rows = this.sql
+      .exec(
+        `SELECT * FROM authorization_requests WHERE id = ? AND client_id = ?`,
+        match[1],
+        clientId,
+      )
+      .toArray();
+    const authRequest = rows[0];
+
+    if (!authRequest) return new Response('Request not found', { status: 400 });
+    if (new Date(/** @type {string} */ (authRequest.expires_at)) < new Date())
+      return new Response('Request expired', { status: 400 });
+    if (authRequest.code)
+      return new Response('Request already used', { status: 400 });
+
+    const clientMetadata = JSON.parse(
+      /** @type {string} */ (authRequest.client_metadata),
+    );
+    const parameters = JSON.parse(
+      /** @type {string} */ (authRequest.parameters),
+    );
+
+    return new Response(
+      renderConsentPage({
+        clientName: clientMetadata.client_name || clientId,
+        clientId: clientId || '',
+        scope: parameters.scope || 'atproto',
+        requestUri: requestUri || '',
+      }),
+      { status: 200, headers: { 'Content-Type': 'text/html; charset=utf-8' } },
+    );
+  }
+
+  /**
+   * Handle POST /oauth/authorize - processes user approval/denial.
+   * Validates password, generates authorization code on approval, redirects to client.
+   * @param {Request} request - The incoming request
+   * @param {URL} url - Parsed request URL
+   * @returns {Promise<Response>} Redirect to client redirect_uri with code or error
+   */
+  async handleOAuthAuthorizePost(request, url) {
+    const issuer = `${url.protocol}//${url.host}`;
+    const body = await request.text();
+    const params = new URLSearchParams(body);
+
+    const requestUri = params.get('request_uri');
+    const clientId = params.get('client_id');
+    const password = params.get('password');
+    const action = params.get('action');
+
+    const match = requestUri?.match(/^urn:ietf:params:oauth:request_uri:(.+)$/);
+    if (!match) return new Response('Invalid request_uri', { status: 400 });
+
+    const authRows = this.sql
+      .exec(
+        `SELECT * FROM authorization_requests WHERE id = ? AND client_id = ?`,
+        match[1],
+        clientId,
+      )
+      .toArray();
+    const authRequest = authRows[0];
+    if (!authRequest) return new Response('Request not found', { status: 400 });
+
+    const clientMetadata = JSON.parse(
+      /** @type {string} */ (authRequest.client_metadata),
+    );
+    const parameters = JSON.parse(
+      /** @type {string} */ (authRequest.parameters),
+    );
+
+    if (action === 'deny') {
+      this.sql.exec(
+        `DELETE FROM authorization_requests WHERE id = ?`,
+        match[1],
+      );
+      const errorUrl = new URL(parameters.redirect_uri);
+      errorUrl.searchParams.set('error', 'access_denied');
+      if (parameters.state)
+        errorUrl.searchParams.set('state', parameters.state);
+      errorUrl.searchParams.set('iss', issuer);
+      return Response.redirect(errorUrl.toString(), 302);
+    }
+
+    // Timing-safe password comparison
+    const expectedPwd = this.env?.PDS_PASSWORD;
+    const passwordValid =
+      password && expectedPwd && (await timingSafeEqual(password, expectedPwd));
+    if (!passwordValid) {
+      return new Response(
+        renderConsentPage({
+          clientName: clientMetadata.client_name || clientId,
+          clientId: clientId || '',
+          scope: parameters.scope || 'atproto',
+          requestUri: requestUri || '',
+          error: 'Invalid password',
+        }),
+        {
+          status: 200,
+          headers: { 'Content-Type': 'text/html; charset=utf-8' },
+        },
+      );
+    }
+
+    const code = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+
+    // Resolve DID from login_hint (can be handle or DID)
+    let did = parameters.login_hint;
+    if (did && !did.startsWith('did:')) {
+      // It's a handle, resolve to DID
+      const handleMap = /** @type {Record<string, string>} */ (
+        (await this.state.storage.get('handleMap')) || {}
+      );
+      did = handleMap[did];
+    }
+    if (!did) {
+      return new Response('Could not resolve user', { status: 400 });
+    }
+
+    this.sql.exec(
+      `UPDATE authorization_requests SET code = ?, did = ? WHERE id = ?`,
+      code,
+      did,
+      match[1],
+    );
+
+    const successUrl = new URL(parameters.redirect_uri);
+    if (parameters.response_mode === 'fragment') {
+      const fragParams = new URLSearchParams();
+      fragParams.set('code', code);
+      if (parameters.state) fragParams.set('state', parameters.state);
+      fragParams.set('iss', issuer);
+      successUrl.hash = fragParams.toString();
+    } else {
+      successUrl.searchParams.set('code', code);
+      if (parameters.state)
+        successUrl.searchParams.set('state', parameters.state);
+      successUrl.searchParams.set('iss', issuer);
+    }
+    return Response.redirect(successUrl.toString(), 302);
+  }
+
+  /**
+   * Handle token endpoint - exchanges authorization codes for tokens.
+   * Supports authorization_code and refresh_token grant types.
+   * @param {Request} request - The incoming request
+   * @param {URL} url - Parsed request URL
+   * @returns {Promise<Response>} JSON response with access_token, token_type, expires_in, refresh_token, scope
+   */
+  async handleOAuthToken(request, url) {
+    const issuer = `${url.protocol}//${url.host}`;
+
+    const dpopResult = await this.validateRequiredDpop(
+      request,
+      'POST',
+      `${issuer}/oauth/token`,
+    );
+    if ('error' in dpopResult) return dpopResult.error;
+    const { dpop } = dpopResult;
+
+    const contentType = request.headers.get('content-type') || '';
+    const body = await request.text();
+    /** @type {URLSearchParams | Map<string, string>} */
+    let params;
+    if (contentType.includes('application/json')) {
+      try {
+        const json = JSON.parse(body);
+        params = new Map(Object.entries(json));
+      } catch {
+        return errorResponse('invalid_request', 'Invalid JSON body', 400);
+      }
+    } else {
+      params = new URLSearchParams(body);
+    }
+    const grantType = params.get('grant_type');
+
+    if (grantType === 'authorization_code') {
+      return this.handleAuthCodeGrant(params, dpop, issuer);
+    } else if (grantType === 'refresh_token') {
+      return this.handleRefreshGrant(params, dpop, issuer);
+    }
+    return errorResponse(
+      'unsupported_grant_type',
+      'Grant type not supported',
+      400,
+    );
+  }
+
+  /**
+   * Handle authorization_code grant type.
+   * Validates the code, PKCE verifier, and DPoP binding, then issues tokens.
+   * @param {URLSearchParams | Map<string, string>} params - Token request parameters
+   * @param {DpopProofResult} dpop - Parsed DPoP proof
+   * @param {string} issuer - The PDS issuer URL
+   * @returns {Promise<Response>} JSON token response
+   */
+  async handleAuthCodeGrant(params, dpop, issuer) {
+    const code = params.get('code');
+    const redirectUri = params.get('redirect_uri');
+    const clientId = params.get('client_id');
+    const codeVerifier = params.get('code_verifier');
+
+    if (!code || !redirectUri || !clientId || !codeVerifier) {
+      return errorResponse(
+        'invalid_request',
+        'Missing required parameters',
+        400,
+      );
+    }
+
+    const authRows = this.sql
+      .exec(`SELECT * FROM authorization_requests WHERE code = ?`, code)
+      .toArray();
+    const authRequest = authRows[0];
+    if (!authRequest)
+      return errorResponse('invalid_grant', 'Invalid code', 400);
+    if (authRequest.client_id !== clientId)
+      return errorResponse('invalid_grant', 'Client mismatch', 400);
+    if (authRequest.dpop_jkt !== dpop.jkt)
+      return errorResponse('invalid_dpop_proof', 'DPoP key mismatch', 400);
+
+    const parameters = JSON.parse(
+      /** @type {string} */ (authRequest.parameters),
+    );
+    if (parameters.redirect_uri !== redirectUri)
+      return errorResponse('invalid_grant', 'Redirect URI mismatch', 400);
+
+    // Verify PKCE
+    const challengeHash = await crypto.subtle.digest(
+      'SHA-256',
+      new TextEncoder().encode(codeVerifier),
+    );
+    const computedChallenge = base64UrlEncode(new Uint8Array(challengeHash));
+    if (computedChallenge !== authRequest.code_challenge) {
+      return errorResponse('invalid_grant', 'Invalid code_verifier', 400);
+    }
+
+    this.sql.exec(
+      `DELETE FROM authorization_requests WHERE id = ?`,
+      authRequest.id,
+    );
+
+    const tokenId = crypto.randomUUID();
+    const refreshToken = base64UrlEncode(
+      crypto.getRandomValues(new Uint8Array(32)),
+    );
+    const scope = parameters.scope || 'atproto';
+    const now = new Date();
+    const expiresIn = 3600;
+    const subjectDid = /** @type {string} */ (authRequest.did);
+
+    const accessToken = await this.createOAuthAccessToken({
+      issuer,
+      subject: subjectDid,
+      clientId,
+      scope,
+      tokenId,
+      dpopJkt: dpop.jkt,
+      expiresIn,
+    });
+
+    this.sql.exec(
+      `INSERT INTO tokens (token_id, did, client_id, scope, dpop_jkt, expires_at, refresh_token, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      tokenId,
+      subjectDid,
+      clientId,
+      scope,
+      dpop.jkt,
+      new Date(now.getTime() + expiresIn * 1000).toISOString(),
+      refreshToken,
+      now.toISOString(),
+      now.toISOString(),
+    );
+
+    return Response.json({
+      access_token: accessToken,
+      token_type: 'DPoP',
+      expires_in: expiresIn,
+      refresh_token: refreshToken,
+      scope,
+      sub: subjectDid,
+    });
+  }
+
+  /**
+   * Handle refresh_token grant type.
+   * Validates the refresh token, DPoP binding, and 24hr lifetime, then rotates tokens.
+   * @param {URLSearchParams | Map<string, string>} params - Token request parameters
+   * @param {DpopProofResult} dpop - Parsed DPoP proof
+   * @param {string} issuer - The PDS issuer URL
+   * @returns {Promise<Response>} JSON token response with new access and refresh tokens
+   */
+  async handleRefreshGrant(params, dpop, issuer) {
+    const refreshToken = params.get('refresh_token');
+    const clientId = params.get('client_id');
+
+    if (!refreshToken || !clientId)
+      return errorResponse(
+        'invalid_request',
+        'Missing required parameters',
+        400,
+      );
+
+    const tokenRows = this.sql
+      .exec(`SELECT * FROM tokens WHERE refresh_token = ?`, refreshToken)
+      .toArray();
+    const token = tokenRows[0];
+
+    if (!token)
+      return errorResponse('invalid_grant', 'Invalid refresh token', 400);
+    if (token.client_id !== clientId)
+      return errorResponse('invalid_grant', 'Client mismatch', 400);
+    if (token.dpop_jkt !== dpop.jkt)
+      return errorResponse('invalid_dpop_proof', 'DPoP key mismatch', 400);
+
+    // Check 24hr lifetime
+    const createdAt = new Date(/** @type {string} */ (token.created_at));
+    if (Date.now() - createdAt.getTime() > 24 * 60 * 60 * 1000) {
+      this.sql.exec(`DELETE FROM tokens WHERE token_id = ?`, token.token_id);
+      return errorResponse('invalid_grant', 'Refresh token expired', 400);
+    }
+
+    const newTokenId = crypto.randomUUID();
+    const newRefreshToken = base64UrlEncode(
+      crypto.getRandomValues(new Uint8Array(32)),
+    );
+    const now = new Date();
+    const expiresIn = 3600;
+    const tokenDid = /** @type {string} */ (token.did);
+    const tokenScope = /** @type {string} */ (token.scope);
+
+    const accessToken = await this.createOAuthAccessToken({
+      issuer,
+      subject: tokenDid,
+      clientId,
+      scope: tokenScope,
+      tokenId: newTokenId,
+      dpopJkt: dpop.jkt,
+      expiresIn,
+    });
+
+    this.sql.exec(
+      `UPDATE tokens SET token_id = ?, refresh_token = ?, expires_at = ?, updated_at = ? WHERE token_id = ?`,
+      newTokenId,
+      newRefreshToken,
+      new Date(now.getTime() + expiresIn * 1000).toISOString(),
+      now.toISOString(),
+      token.token_id,
+    );
+
+    return Response.json({
+      access_token: accessToken,
+      token_type: 'DPoP',
+      expires_in: expiresIn,
+      refresh_token: newRefreshToken,
+      scope: tokenScope,
+      sub: tokenDid,
+    });
+  }
+
+  /**
+   * Create a DPoP-bound access token (at+jwt).
+   * @param {AccessTokenParams} params
+   * @returns {Promise<string>} The signed JWT access token
+   */
+  async createOAuthAccessToken({
+    issuer,
+    subject,
+    clientId,
+    scope,
+    tokenId,
+    dpopJkt,
+    expiresIn,
+  }) {
+    const now = Math.floor(Date.now() / 1000);
+    const header = { typ: 'at+jwt', alg: 'ES256', kid: 'pds-oauth-key' };
+    const payload = {
+      iss: issuer,
+      sub: subject,
+      aud: issuer,
+      client_id: clientId,
+      scope,
+      jti: tokenId,
+      iat: now,
+      exp: now + expiresIn,
+      cnf: { jkt: dpopJkt },
+    };
+
+    const privateKeyHex = await this.getOAuthPrivateKey();
+    const privateKey = await importPrivateKey(hexToBytes(privateKeyHex));
+
+    const headerB64 = base64UrlEncode(
+      new TextEncoder().encode(JSON.stringify(header)),
+    );
+    const payloadB64 = base64UrlEncode(
+      new TextEncoder().encode(JSON.stringify(payload)),
+    );
+    const sigInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+    const sig = await sign(privateKey, sigInput);
+
+    return `${headerB64}.${payloadB64}.${base64UrlEncode(sig)}`;
+  }
+
+  /**
+   * Handle token revocation endpoint (RFC 7009).
+   * Revokes access tokens and refresh tokens by client_id.
+   * @param {Request} request - The incoming request
+   * @param {URL} url - Parsed request URL
+   * @returns {Promise<Response>} Empty 200 response on success
+   */
+  async handleOAuthRevoke(request, url) {
+    const issuer = `${url.protocol}//${url.host}`;
+
+    // Optional DPoP verification - if present, verify it
+    const dpopHeader = request.headers.get('DPoP');
+    if (dpopHeader) {
+      try {
+        const dpop = await parseDpopProof(
+          dpopHeader,
+          'POST',
+          `${issuer}/oauth/revoke`,
+        );
+        // Check for DPoP replay attack
+        if (!this.checkAndStoreDpopJti(dpop.jti, dpop.iat)) {
+          return errorResponse(
+            'invalid_dpop_proof',
+            'DPoP proof replay detected',
+            400,
+          );
+        }
+      } catch (err) {
+        return errorResponse('invalid_dpop_proof', err.message, 400);
+      }
+    }
+
+    /** @type {Record<string, string>} */
+    let data;
+    try {
+      data = await parseRequestBody(request);
+    } catch {
+      return errorResponse('invalid_request', 'Invalid JSON body', 400);
+    }
+
+    const validation = validateRequiredParams(data, ['token', 'client_id']);
+    if (!validation.valid) {
+      return errorResponse(
+        'invalid_request',
+        'Missing required parameters',
+        400,
+      );
+    }
+    const { token, client_id: clientId } = data;
+
+    this.sql.exec(
+      `DELETE FROM tokens WHERE client_id = ? AND (refresh_token = ? OR token_id = ?)`,
+      clientId,
+      token,
+      token,
+    );
+
+    return new Response(null, { status: 200 });
+  }
 }
 
 // ╔══════════════════════════════════════════════════════════════════════════════╗
···
   'Access-Control-Allow-Origin': '*',
   'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
   'Access-Control-Allow-Headers':
-    'Content-Type, Authorization, atproto-accept-labelers, atproto-proxy, x-bsky-topics',
+    'Content-Type, Authorization, DPoP, atproto-accept-labelers, atproto-proxy, x-bsky-topics',
 };
 
 /**
···
 }
 
 /**
- * Verify auth and return DID from token
+ * Verify auth and return DID from token.
+ * Supports both legacy Bearer tokens (JWT with symmetric key) and OAuth DPoP tokens.
  * @param {Request} request - HTTP request with Authorization header
  * @param {Env} env - Environment with JWT_SECRET
- * @returns {Promise<{did: string} | {error: Response}>} DID or error response
+ * @param {{ fetch: (req: Request) => Promise<Response> }} [pds] - PDS stub for OAuth token verification (optional)
+ * @returns {Promise<{did: string, scope?: string} | {error: Response}>} DID (and scope for OAuth) or error response
  */
-async function requireAuth(request, env) {
+async function requireAuth(request, env, pds = undefined) {
   const authHeader = request.headers.get('Authorization');
-  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+  if (!authHeader) {
     return {
-      error: Response.json(
-        {
-          error: 'AuthRequired',
-          message: 'Authentication required',
-        },
-        { status: 401 },
-      ),
+      error: errorResponse('AuthRequired', 'Authentication required', 401),
     };
   }
 
-  const token = authHeader.slice(7);
-  const jwtSecret = env?.JWT_SECRET;
-  if (!jwtSecret) {
-    return {
-      error: Response.json(
-        {
-          error: 'InternalServerError',
-          message: 'Server not configured for authentication',
-        },
-        { status: 500 },
-      ),
-    };
+  // Legacy Bearer token (symmetric JWT)
+  if (authHeader.startsWith('Bearer ')) {
+    const token = authHeader.slice(7);
+    const jwtSecret = env?.JWT_SECRET;
+    if (!jwtSecret) {
+      return {
+        error: errorResponse(
+          'InternalServerError',
+          'Server not configured for authentication',
+          500,
+        ),
+      };
+    }
+
+    try {
+      const payload = await verifyAccessJwt(token, jwtSecret);
+      return { did: payload.sub };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return { error: errorResponse('InvalidToken', message, 401) };
+    }
   }
 
-  try {
-    const payload = await verifyAccessJwt(token, jwtSecret);
-    return { did: payload.sub };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return {
-      error: Response.json(
-        {
-          error: 'InvalidToken',
-          message: message,
-        },
-        { status: 401 },
-      ),
-    };
+  // OAuth DPoP token
+  if (authHeader.startsWith('DPoP ')) {
+    if (!pds) {
+      return {
+        error: errorResponse(
+          'InternalServerError',
+          'DPoP tokens not supported on this endpoint',
+          500,
+        ),
+      };
+    }
+
+    try {
+      const result = await verifyOAuthAccessToken(
+        request,
+        authHeader.slice(5),
+        pds,
+      );
+      return result;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return { error: errorResponse('InvalidToken', message, 401) };
+    }
+  }
+
+  return {
+    error: errorResponse('AuthRequired', 'Invalid authorization type', 401),
+  };
+}
+
+/**
+ * Verify an OAuth DPoP-bound access token.
+ * Validates the JWT signature, expiration, DPoP binding, and proof.
+ * @param {Request} request - The incoming request (for DPoP validation)
+ * @param {string} token - The access token JWT
+ * @param {{ fetch: (req: Request) => Promise<Response> }} pdsStub - The PDS stub with fetch method
+ * @returns {Promise<{did: string, scope?: string}>} The authenticated user's DID and scope
+ * @throws {Error} If verification fails
+ */
+async function verifyOAuthAccessToken(request, token, pdsStub) {
+  const parts = token.split('.');
+  if (parts.length !== 3) throw new Error('Invalid token format');
+
+  const header = JSON.parse(
+    new TextDecoder().decode(base64UrlDecode(parts[0])),
+  );
+  if (header.typ !== 'at+jwt') throw new Error('Invalid token type');
+
+  // Verify signature with PDS public key (fetch from DO)
+  const keyRes = await pdsStub.fetch(
+    new Request('http://internal/oauth-public-key'),
+  );
+  const publicKeyJwk = await keyRes.json();
+  const publicKey = await crypto.subtle.importKey(
+    'jwk',
+    publicKeyJwk,
+    { name: 'ECDSA', namedCurve: 'P-256' },
+    false,
+    ['verify'],
+  );
+
+  const signatureInput = new TextEncoder().encode(`${parts[0]}.${parts[1]}`);
+  const signature = base64UrlDecode(parts[2]);
+
+  const valid = await crypto.subtle.verify(
+    { name: 'ECDSA', hash: 'SHA-256' },
+    publicKey,
+    /** @type {BufferSource} */ (signature),
+    /** @type {BufferSource} */ (signatureInput),
+  );
+  if (!valid) throw new Error('Invalid token signature');
+
+  const payload = JSON.parse(
+    new TextDecoder().decode(base64UrlDecode(parts[1])),
+  );
+
+  if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {
+    throw new Error('Token expired');
   }
+
+  if (!payload.cnf?.jkt) throw new Error('Token missing DPoP binding');
+
+  const dpopHeader = request.headers.get('DPoP');
+  if (!dpopHeader) throw new Error('DPoP proof required');
+
+  const url = new URL(request.url);
+  const dpop = await parseDpopProof(
+    dpopHeader,
+    request.method,
+    `${url.protocol}//${url.host}${url.pathname}`,
+    payload.cnf.jkt,
+    token,
+  );
+
+  // Check for DPoP jti replay
+  const jtiRes = await pdsStub.fetch(
+    new Request('http://internal/check-dpop-jti', {
+      method: 'POST',
+      body: JSON.stringify({ jti: dpop.jti, iat: dpop.iat }),
+    }),
+  );
+  const { fresh } = await jtiRes.json();
+  if (!fresh) throw new Error('DPoP proof replay detected');
+
+  return { did: payload.sub, scope: payload.scope };
+}
+
+/**
+ * Check if the token scope allows the requested operation.
+ * Legacy tokens (no scope) are always allowed; OAuth tokens must have 'atproto' scope.
+ * @param {string | undefined} scope - The token scope
+ * @param {string} requiredScope - The required scope (e.g., 'atproto')
+ * @returns {boolean} Whether the scope is sufficient
+ */
+function hasRequiredScope(scope, requiredScope) {
+  // Legacy tokens without scope are trusted for all operations
+  if (!scope) return true;
+  // Check if the scope includes the required scope
+  const scopes = scope.split(' ');
+  return scopes.includes(requiredScope);
 }
 
 /**
···
  * @param {Env} env
  */
 async function handleAuthenticatedBlobUpload(request, env) {
-  const auth = await requireAuth(request, env);
+  // Get default PDS for OAuth token verification
+  const defaultPds = getDefaultPds(env);
+  const auth = await requireAuth(request, env, defaultPds);
   if ('error' in auth) return auth.error;
 
+  // Validate scope for blob upload
+  if (!hasRequiredScope(auth.scope, 'atproto')) {
+    return errorResponse(
+      'Forbidden',
+      'Insufficient scope for blob upload',
+      403,
+    );
+  }
+
   // Route to the user's DO based on their DID from the token
   const id = env.PDS.idFromName(auth.did);
   const pds = env.PDS.get(id);
···
  * @param {Env} env
  */
 async function handleAuthenticatedRepoWrite(request, env) {
-  const auth = await requireAuth(request, env);
+  // Get default PDS for OAuth token verification
+  const defaultPds = getDefaultPds(env);
+  const auth = await requireAuth(request, env, defaultPds);
   if ('error' in auth) return auth.error;
 
+  // Validate scope for repo write
+  if (!hasRequiredScope(auth.scope, 'atproto')) {
+    return errorResponse('Forbidden', 'Insufficient scope for repo write', 403);
+  }
+
   const body = await request.json();
   const repo = body.repo;
   if (!repo) {
···
     // Look up handle -> DID in default DO
     // Use subdomain if present, otherwise try bare hostname as handle
     const handleToResolve = subdomain || url.hostname;
-    const defaultId = env.PDS.idFromName('default');
-    const defaultPds = env.PDS.get(defaultId);
+    const defaultPds = getDefaultPds(env);
     const resolveRes = await defaultPds.fetch(
       new Request(
         `http://internal/resolve-handle?handle=${encodeURIComponent(handleToResolve)}`,
···
 
   // describeServer - works on bare domain
   if (url.pathname === '/xrpc/com.atproto.server.describeServer') {
-    const defaultId = env.PDS.idFromName('default');
-    const defaultPds = env.PDS.get(defaultId);
+    const defaultPds = getDefaultPds(env);
     const newReq = new Request(request.url, {
       method: request.method,
       headers: {
···
     return defaultPds.fetch(newReq);
   }
 
-  // createSession - handle on default DO (has handleMap for identifier resolution)
-  if (url.pathname === '/xrpc/com.atproto.server.createSession') {
-    const defaultId = env.PDS.idFromName('default');
-    const defaultPds = env.PDS.get(defaultId);
-    return defaultPds.fetch(request);
-  }
-
-  // getSession - route to default DO
-  if (url.pathname === '/xrpc/com.atproto.server.getSession') {
-    const defaultId = env.PDS.idFromName('default');
-    const defaultPds = env.PDS.get(defaultId);
-    return defaultPds.fetch(request);
-  }
-
-  // refreshSession - route to default DO
-  if (url.pathname === '/xrpc/com.atproto.server.refreshSession') {
-    const defaultId = env.PDS.idFromName('default');
-    const defaultPds = env.PDS.get(defaultId);
+  // Session endpoints - route to default DO (has handleMap for identifier resolution)
+  const sessionEndpoints = [
+    '/xrpc/com.atproto.server.createSession',
+    '/xrpc/com.atproto.server.getSession',
+    '/xrpc/com.atproto.server.refreshSession',
+  ];
+  if (sessionEndpoints.includes(url.pathname)) {
+    const defaultPds = getDefaultPds(env);
     return defaultPds.fetch(request);
   }
 
   // Proxy app.bsky.* endpoints to Bluesky AppView
   if (url.pathname.startsWith('/xrpc/app.bsky.')) {
+    // Get default PDS for OAuth token verification
+    const defaultPds = getDefaultPds(env);
     // Authenticate the user first
-    const auth = await requireAuth(request, env);
+    const auth = await requireAuth(request, env, defaultPds);
     if ('error' in auth) return auth.error;
 
     // Route to the user's DO instance to create service auth and proxy
···
     url.pathname === '/register-handle' ||
     url.pathname === '/resolve-handle'
   ) {
-    const defaultId = env.PDS.idFromName('default');
-    const defaultPds = env.PDS.get(defaultId);
+    const defaultPds = getDefaultPds(env);
     return defaultPds.fetch(request);
   }
 
···
     if (!handle) {
       return errorResponse('InvalidRequest', 'missing handle param', 400);
     }
-    const defaultId = env.PDS.idFromName('default');
-    const defaultPds = env.PDS.get(defaultId);
+    const defaultPds = getDefaultPds(env);
     const resolveRes = await defaultPds.fetch(
       new Request(
         `http://internal/resolve-handle?handle=${encodeURIComponent(handle)}`,
···
 
   // subscribeRepos WebSocket - route to default instance for firehose
   if (url.pathname === '/xrpc/com.atproto.sync.subscribeRepos') {
-    const defaultId = env.PDS.idFromName('default');
-    const defaultPds = env.PDS.get(defaultId);
+    const defaultPds = getDefaultPds(env);
     return defaultPds.fetch(request);
   }
 
   // listRepos needs to aggregate from all registered DIDs
   if (url.pathname === '/xrpc/com.atproto.sync.listRepos') {
-    const defaultId = env.PDS.idFromName('default');
-    const defaultPds = env.PDS.get(defaultId);
+    const defaultPds = getDefaultPds(env);
     const regRes = await defaultPds.fetch(
       new Request('http://internal/get-registered-dids'),
     );
···
     const body = await request.json();
 
     // Register with default instance for discovery
-    const defaultId = env.PDS.idFromName('default');
-    const defaultPds = env.PDS.get(defaultId);
+    const defaultPds = getDefaultPds(env);
     await defaultPds.fetch(
       new Request('http://internal/register-did', {
         method: 'POST',
···
       );
     }
 
+    // Also initialize default instance with identity for OAuth (single-user PDS)
+    await defaultPds.fetch(
+      new Request('http://internal/init', {
+        method: 'POST',
+        body: JSON.stringify(body),
+      }),
+    );
+
     // Forward to the actual PDS instance
     const id = env.PDS.idFromName(did);
     const pds = env.PDS.get(id);
···
         body: JSON.stringify(body),
       }),
     );
+  }
+
+  // OAuth endpoints - route to default PDS instance
+  const oauthEndpoints = [
+    '/.well-known/oauth-authorization-server',
+    '/.well-known/oauth-protected-resource',
+    '/oauth/jwks',
+    '/oauth/par',
+    '/oauth/authorize',
+    '/oauth/token',
+    '/oauth/revoke',
+  ];
+  if (oauthEndpoints.includes(url.pathname)) {
+    const defaultPds = getDefaultPds(env);
+    return defaultPds.fetch(request);
   }
 
   // Unknown endpoint

test/e2e.sh

···
-#!/bin/bash
-# E2E tests for PDS - runs against local wrangler dev
-set -e
-
-BASE="http://localhost:8787"
-# Generate unique test DID (or use env var for consistency)
-DID="${TEST_DID:-did:plc:test$(openssl rand -hex 8)}"
-
-# Helper for colored output
-pass() { echo "✓ $1"; }
-fail() {
-  echo "✗ $1" >&2
-  cleanup
-  exit 1
-}
-
-# Cleanup function
-cleanup() {
-  if [ -n "$WRANGLER_PID" ]; then
-    echo "Shutting down wrangler..."
-    kill $WRANGLER_PID 2>/dev/null || true
-    wait $WRANGLER_PID 2>/dev/null || true
-  fi
-}
-trap cleanup EXIT
-
-# Start wrangler dev with local R2 persistence
-echo "Starting wrangler dev..."
-npx wrangler dev --port 8787 --persist-to .wrangler/state >/dev/null 2>&1 &
-WRANGLER_PID=$!
-
-# Wait for server to be ready
-for i in {1..30}; do
-  if curl -sf "$BASE/" >/dev/null 2>&1; then
-    break
-  fi
-  sleep 0.5
-done
-
-# Verify server is up
-curl -sf "$BASE/" >/dev/null || fail "Server failed to start"
-pass "Server started"
-
-# Initialize PDS
-PRIVKEY=$(openssl rand -hex 32)
-curl -sf -X POST "$BASE/init?did=$DID" \
-  -H "Content-Type: application/json" \
-  -d "{\"did\":\"$DID\",\"privateKey\":\"$PRIVKEY\",\"handle\":\"test.local\"}" >/dev/null &&
-  pass "PDS initialized" || fail "PDS init"
-
-echo
-echo "Running tests..."
-echo
-
-# Root returns ASCII art
-curl -sf "$BASE/" | grep -q "PDS" && pass "Root returns ASCII art" || fail "Root"
-
-# describeServer works
-curl -sf "$BASE/xrpc/com.atproto.server.describeServer" | jq -e '.did' >/dev/null &&
-  pass "describeServer" || fail "describeServer"
-
-# resolveHandle works
-curl -sf "$BASE/xrpc/com.atproto.identity.resolveHandle?handle=test.local" |
-  jq -e '.did' >/dev/null && pass "resolveHandle" || fail "resolveHandle"
-
-# createSession returns tokens
-SESSION=$(curl -sf -X POST "$BASE/xrpc/com.atproto.server.createSession" \
-  -H "Content-Type: application/json" \
-  -d "{\"identifier\":\"$DID\",\"password\":\"test-password\"}")
-TOKEN=$(echo "$SESSION" | jq -r '.accessJwt')
-[ "$TOKEN" != "null" ] && [ -n "$TOKEN" ] && pass "createSession returns token" || fail "createSession"
-
-# getSession works with token
-curl -sf "$BASE/xrpc/com.atproto.server.getSession" \
-  -H "Authorization: Bearer $TOKEN" | jq -e '.did' >/dev/null &&
-  pass "getSession with valid token" || fail "getSession"
-
-# refreshSession returns new tokens
-REFRESH_TOKEN=$(echo "$SESSION" | jq -r '.refreshJwt')
-REFRESH_RESULT=$(curl -sf -X POST "$BASE/xrpc/com.atproto.server.refreshSession" \
-  -H "Authorization: Bearer $REFRESH_TOKEN")
-NEW_ACCESS=$(echo "$REFRESH_RESULT" | jq -r '.accessJwt')
-NEW_REFRESH=$(echo "$REFRESH_RESULT" | jq -r '.refreshJwt')
-[ "$NEW_ACCESS" != "null" ] && [ -n "$NEW_ACCESS" ] && [ "$NEW_REFRESH" != "null" ] && [ -n "$NEW_REFRESH" ] &&
-  pass "refreshSession returns new tokens" || fail "refreshSession"
-
-# New access token from refresh works
-curl -sf "$BASE/xrpc/com.atproto.server.getSession" \
-  -H "Authorization: Bearer $NEW_ACCESS" | jq -e '.did' >/dev/null &&
-  pass "refreshed access token works" || fail "refreshed token"
-
-# refreshSession rejects access token (wrong type)
-STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/xrpc/com.atproto.server.refreshSession" \
-  -H "Authorization: Bearer $TOKEN")
-[ "$STATUS" = "400" ] && pass "refreshSession rejects access token" || fail "refreshSession should reject access token"
-
-# refreshSession rejects missing auth
-STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/xrpc/com.atproto.server.refreshSession")
-[ "$STATUS" = "401" ] && pass "refreshSession rejects missing auth" || fail "refreshSession should require auth"
-
-# refreshSession rejects malformed token
-STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/xrpc/com.atproto.server.refreshSession" \
-  -H "Authorization: Bearer not-a-valid-jwt")
-[ "$STATUS" = "400" ] && pass "refreshSession rejects malformed token" || fail "refreshSession should reject malformed token"
-
-# Protected endpoint rejects without auth
-STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/xrpc/com.atproto.repo.createRecord" \
-  -H "Content-Type: application/json" \
-  -d '{"repo":"x","collection":"x","record":{}}')
-[ "$STATUS" = "401" ] && pass "createRecord rejects without auth" || fail "createRecord should reject"
-
-# getPreferences works (returns empty array initially)
-curl -sf "$BASE/xrpc/app.bsky.actor.getPreferences" \
-  -H "Authorization: Bearer $TOKEN" | jq -e '.preferences' >/dev/null &&
-  pass "getPreferences" || fail "getPreferences"
-
-# putPreferences works
-curl -sf -X POST "$BASE/xrpc/app.bsky.actor.putPreferences" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{"preferences":[{"$type":"app.bsky.actor.defs#savedFeedsPrefV2"}]}' >/dev/null &&
-  pass "putPreferences" || fail "putPreferences"
-
-# createRecord works with auth
-RECORD=$(curl -sf -X POST "$BASE/xrpc/com.atproto.repo.createRecord" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d "{\"repo\":\"$DID\",\"collection\":\"app.bsky.feed.post\",\"record\":{\"text\":\"test\",\"createdAt\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}}")
-URI=$(echo "$RECORD" | jq -r '.uri')
-[ "$URI" != "null" ] && [ -n "$URI" ] && pass "createRecord with auth" || fail "createRecord"
-
-# getRecord retrieves it
-RKEY=$(echo "$URI" | sed 's|.*/||')
-curl -sf "$BASE/xrpc/com.atproto.repo.getRecord?repo=$DID&collection=app.bsky.feed.post&rkey=$RKEY" |
-  jq -e '.value.text' >/dev/null && pass "getRecord" || fail "getRecord"
-
-# putRecord updates the record
-curl -sf -X POST "$BASE/xrpc/com.atproto.repo.putRecord" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d "{\"repo\":\"$DID\",\"collection\":\"app.bsky.feed.post\",\"rkey\":\"$RKEY\",\"record\":{\"text\":\"updated\",\"createdAt\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}}" |
-  jq -e '.uri' >/dev/null && pass "putRecord" || fail "putRecord"
-
-# listRecords shows the record
-curl -sf "$BASE/xrpc/com.atproto.repo.listRecords?repo=$DID&collection=app.bsky.feed.post" |
-  jq -e '.records | length > 0' >/dev/null && pass "listRecords" || fail "listRecords"
-
-# describeRepo returns repo info
-curl -sf "$BASE/xrpc/com.atproto.repo.describeRepo?repo=$DID" |
-  jq -e '.did' >/dev/null && pass "describeRepo" || fail "describeRepo"
-
-# applyWrites batch operation (create then delete a record)
-APPLY_RESULT=$(curl -sf -X POST "$BASE/xrpc/com.atproto.repo.applyWrites" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d "{\"repo\":\"$DID\",\"writes\":[{\"\$type\":\"com.atproto.repo.applyWrites#create\",\"collection\":\"app.bsky.feed.post\",\"rkey\":\"applytest\",\"value\":{\"text\":\"batch\",\"createdAt\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}}]}")
-echo "$APPLY_RESULT" | jq -e '.results' >/dev/null && pass "applyWrites create" || fail "applyWrites create"
-
-# applyWrites delete
-curl -sf -X POST "$BASE/xrpc/com.atproto.repo.applyWrites" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d "{\"repo\":\"$DID\",\"writes\":[{\"\$type\":\"com.atproto.repo.applyWrites#delete\",\"collection\":\"app.bsky.feed.post\",\"rkey\":\"applytest\"}]}" |
-  jq -e '.results' >/dev/null && pass "applyWrites delete" || fail "applyWrites delete"
-
-# sync.getLatestCommit returns head
-curl -sf "$BASE/xrpc/com.atproto.sync.getLatestCommit?did=$DID" |
-  jq -e '.cid' >/dev/null && pass "sync.getLatestCommit" || fail "sync.getLatestCommit"
-
-# sync.getRepoStatus returns status
-curl -sf "$BASE/xrpc/com.atproto.sync.getRepoStatus?did=$DID" |
-  jq -e '.did' >/dev/null && pass "sync.getRepoStatus" || fail "sync.getRepoStatus"
-
-# sync.getRepo returns CAR file
-REPO_SIZE=$(curl -sf "$BASE/xrpc/com.atproto.sync.getRepo?did=$DID" | wc -c)
-[ "$REPO_SIZE" -gt 100 ] && pass "sync.getRepo returns CAR" || fail "sync.getRepo"
-
-# sync.getRecord returns record with proof (binary CAR data)
-RECORD_SIZE=$(curl -sf "$BASE/xrpc/com.atproto.sync.getRecord?did=$DID&collection=app.bsky.feed.post&rkey=$RKEY" | wc -c)
-[ "$RECORD_SIZE" -gt 50 ] && pass "sync.getRecord" || fail "sync.getRecord"
-
-# sync.listRepos lists repos
-curl -sf "$BASE/xrpc/com.atproto.sync.listRepos" |
-  jq -e '.repos | length > 0' >/dev/null && pass "sync.listRepos" || fail "sync.listRepos"
-
-# Error handling tests
-echo
-echo "Testing error handling..."
-
-# Invalid password rejected
-STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/xrpc/com.atproto.server.createSession" \
-  -H "Content-Type: application/json" \
-  -d "{\"identifier\":\"$DID\",\"password\":\"wrong-password\"}")
-[ "$STATUS" = "401" ] && pass "Invalid password rejected (401)" || fail "Invalid password should return 401"
-
-# Wrong repo rejected (can't modify another user's repo)
-STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/xrpc/com.atproto.repo.createRecord" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{"repo":"did:plc:z72i7hdynmk6r22z27h6tvur","collection":"app.bsky.feed.post","record":{"text":"x","createdAt":"2024-01-01T00:00:00Z"}}')
-[ "$STATUS" = "403" ] && pass "Wrong repo rejected (403)" || fail "Wrong repo should return 403"
-
-# Non-existent record returns 404
-STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/xrpc/com.atproto.repo.getRecord?repo=$DID&collection=app.bsky.feed.post&rkey=nonexistent")
-[ "$STATUS" = "400" ] || [ "$STATUS" = "404" ] && pass "Non-existent record error" || fail "Non-existent record should error"
-
-# Blob tests
-echo
-echo "Testing blob endpoints..."
-
-# Create a minimal valid PNG (1x1 transparent pixel)
-# PNG signature + IHDR + IDAT + IEND
-PNG_FILE=$(mktemp)
-printf '\x89PNG\r\n\x1a\n' >"$PNG_FILE"
-printf '\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x06\x00\x00\x00\x1f\x15\xc4\x89' >>"$PNG_FILE"
-printf '\x00\x00\x00\nIDATx\x9cc\x00\x01\x00\x00\x05\x00\x01\r\n-\xb4' >>"$PNG_FILE"
-printf '\x00\x00\x00\x00IEND\xaeB`\x82' >>"$PNG_FILE"
-
-# uploadBlob requires auth
-STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/xrpc/com.atproto.repo.uploadBlob" \
-  -H "Content-Type: image/png" \
-  --data-binary @"$PNG_FILE")
-[ "$STATUS" = "401" ] && pass "uploadBlob rejects without auth" || fail "uploadBlob should require auth"
-
-# uploadBlob works with auth
-BLOB_RESULT=$(curl -sf -X POST "$BASE/xrpc/com.atproto.repo.uploadBlob" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: image/png" \
-  --data-binary @"$PNG_FILE")
-BLOB_CID=$(echo "$BLOB_RESULT" | jq -r '.blob.ref."$link"')
-BLOB_MIME=$(echo "$BLOB_RESULT" | jq -r '.blob.mimeType')
-[ "$BLOB_CID" != "null" ] && [ -n "$BLOB_CID" ] && pass "uploadBlob returns CID" || fail "uploadBlob"
-[ "$BLOB_MIME" = "image/png" ] && pass "uploadBlob detects PNG mime type" || fail "uploadBlob mime detection"
-
-# listBlobs shows the uploaded blob
-curl -sf "$BASE/xrpc/com.atproto.sync.listBlobs?did=$DID" |
-  jq -e ".cids | index(\"$BLOB_CID\")" >/dev/null && pass "listBlobs includes uploaded blob" || fail "listBlobs"
-
-# getBlob retrieves the blob
-BLOB_SIZE=$(curl -sf "$BASE/xrpc/com.atproto.sync.getBlob?did=$DID&cid=$BLOB_CID" | wc -c)
-[ "$BLOB_SIZE" -gt 0 ] && pass "getBlob retrieves blob data" || fail "getBlob"
-
-# getBlob returns correct headers
-BLOB_HEADERS=$(curl -sI "$BASE/xrpc/com.atproto.sync.getBlob?did=$DID&cid=$BLOB_CID")
-echo "$BLOB_HEADERS" | grep -qi "content-type: image/png" && pass "getBlob Content-Type header" || fail "getBlob Content-Type"
-echo "$BLOB_HEADERS" | grep -qi "x-content-type-options: nosniff" && pass "getBlob security headers" || fail "getBlob security headers"
-
-# getBlob rejects wrong DID
-STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/xrpc/com.atproto.sync.getBlob?did=did:plc:wrongdid&cid=$BLOB_CID")
-[ "$STATUS" = "400" ] && pass "getBlob rejects wrong DID" || fail "getBlob should reject wrong DID"
-
-# getBlob returns 400 for invalid CID format
-STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/xrpc/com.atproto.sync.getBlob?did=$DID&cid=invalid")
-[ "$STATUS" = "400" ] && pass "getBlob rejects invalid CID format" || fail "getBlob should reject invalid CID"
-
-# getBlob returns 404 for non-existent blob (valid format CID - 59 chars)
-STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/xrpc/com.atproto.sync.getBlob?did=$DID&cid=bafkreiaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
-[ "$STATUS" = "404" ] && pass "getBlob 404 for missing blob" || fail "getBlob should 404"
-
-# Create a record with blob reference
-BLOB_POST=$(curl -sf -X POST "$BASE/xrpc/com.atproto.repo.createRecord" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d "{\"repo\":\"$DID\",\"collection\":\"app.bsky.feed.post\",\"record\":{\"text\":\"post with image\",\"createdAt\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"embed\":{\"\$type\":\"app.bsky.embed.images\",\"images\":[{\"image\":{\"\$type\":\"blob\",\"ref\":{\"\$link\":\"$BLOB_CID\"},\"mimeType\":\"image/png\",\"size\":$(wc -c <"$PNG_FILE")},\"alt\":\"test\"}]}}}")
-BLOB_POST_URI=$(echo "$BLOB_POST" | jq -r '.uri')
-BLOB_POST_RKEY=$(echo "$BLOB_POST_URI" | sed 's|.*/||')
-[ "$BLOB_POST_URI" != "null" ] && [ -n "$BLOB_POST_URI" ] && pass "createRecord with blob ref" || fail "createRecord with blob"
-
-# Blob still exists after record creation
-curl -sf "$BASE/xrpc/com.atproto.sync.listBlobs?did=$DID" |
-  jq -e ".cids | index(\"$BLOB_CID\")" >/dev/null && pass "blob persists after record creation" || fail "blob should persist"
-
-# Delete the record with blob
-curl -sf -X POST "$BASE/xrpc/com.atproto.repo.deleteRecord" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d "{\"repo\":\"$DID\",\"collection\":\"app.bsky.feed.post\",\"rkey\":\"$BLOB_POST_RKEY\"}" >/dev/null &&
-  pass "deleteRecord with blob" || fail "deleteRecord with blob"
-
-# Blob should be cleaned up (orphaned)
-BLOB_COUNT=$(curl -sf "$BASE/xrpc/com.atproto.sync.listBlobs?did=$DID" | jq '.cids | length')
-[ "$BLOB_COUNT" = "0" ] && pass "orphaned blob cleaned up on delete" || fail "blob should be cleaned up"
-
-# Clean up temp file
-rm -f "$PNG_FILE"
-
-# Cleanup: delete the test record
-curl -sf -X POST "$BASE/xrpc/com.atproto.repo.deleteRecord" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d "{\"repo\":\"$DID\",\"collection\":\"app.bsky.feed.post\",\"rkey\":\"$RKEY\"}" >/dev/null &&
-  pass "deleteRecord (cleanup)" || fail "deleteRecord"
-
-echo
-echo "All tests passed!"

test/e2e.test.js

···
+/**
+ * E2E tests for PDS - runs against local wrangler dev
+ * Uses Node's built-in test runner and fetch
+ */
+
+import { describe, it, before, after } from 'node:test';
+import assert from 'node:assert';
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { DpopClient } from './helpers/dpop.js';
+
+const BASE = 'http://localhost:8787';
+const DID = `did:plc:test${randomBytes(8).toString('hex')}`;
+const PASSWORD = 'test-password';
+
+/** @type {import('node:child_process').ChildProcess|null} */
+let wrangler = null;
+/** @type {string} */
+let token = '';
+/** @type {string} */
+let refreshToken = '';
+/** @type {string} */
+let testRkey = '';
+
+/**
+ * Wait for server to be ready
+ */
+async function waitForServer(maxAttempts = 30) {
+  for (let i = 0; i < maxAttempts; i++) {
+    try {
+      const res = await fetch(`${BASE}/`);
+      if (res.ok) return;
+    } catch {
+      // Server not ready yet
+    }
+    await new Promise((r) => setTimeout(r, 500));
+  }
+  throw new Error('Server failed to start');
+}
+
+/**
+ * Make JSON request helper
+ */
+async function jsonPost(path, body, headers = {}) {
+  const res = await fetch(`${BASE}${path}`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', ...headers },
+    body: JSON.stringify(body),
+  });
+  return { status: res.status, data: res.ok ? await res.json() : null };
+}
+
+/**
+ * Make form-encoded POST
+ */
+async function formPost(path, params, headers = {}) {
+  const res = await fetch(`${BASE}${path}`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      ...headers,
+    },
+    body: new URLSearchParams(params).toString(),
+  });
+  const text = await res.text();
+  let data = null;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    data = text;
+  }
+  return { status: res.status, data };
+}
+
+describe('E2E Tests', () => {
+  before(async () => {
+    // Start wrangler
+    wrangler = spawn(
+      'npx',
+      ['wrangler', 'dev', '--port', '8787', '--persist-to', '.wrangler/state'],
+      {
+        stdio: 'pipe',
+        cwd: process.cwd(),
+      },
+    );
+
+    await waitForServer();
+
+    // Initialize PDS
+    const privKey = randomBytes(32).toString('hex');
+    const res = await fetch(`${BASE}/init?did=${DID}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        did: DID,
+        privateKey: privKey,
+        handle: 'test.local',
+      }),
+    });
+    assert.ok(res.ok, 'PDS initialization failed');
+  });
+
+  after(() => {
+    if (wrangler) {
+      wrangler.kill();
+    }
+  });
+
+  describe('Server endpoints', () => {
+    it('root returns ASCII art', async () => {
+      const res = await fetch(`${BASE}/`);
+      const text = await res.text();
+      assert.ok(text.includes('PDS'), 'Root should contain PDS');
+    });
+
+    it('describeServer returns DID', async () => {
+      const res = await fetch(`${BASE}/xrpc/com.atproto.server.describeServer`);
+      const data = await res.json();
+      assert.ok(data.did, 'describeServer should return did');
+    });
+
+    it('resolveHandle returns DID', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.identity.resolveHandle?handle=test.local`,
+      );
+      const data = await res.json();
+      assert.ok(data.did, 'resolveHandle should return did');
+    });
+  });
+
+  describe('Authentication', () => {
+    it('createSession returns tokens', async () => {
+      const { status, data } = await jsonPost(
+        '/xrpc/com.atproto.server.createSession',
+        {
+          identifier: DID,
+          password: PASSWORD,
+        },
+      );
+      assert.strictEqual(status, 200);
+      assert.ok(data.accessJwt, 'Should return accessJwt');
+      assert.ok(data.refreshJwt, 'Should return refreshJwt');
+      token = data.accessJwt;
+      refreshToken = data.refreshJwt;
+    });
+
+    it('getSession with valid token', async () => {
+      const res = await fetch(`${BASE}/xrpc/com.atproto.server.getSession`, {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      const data = await res.json();
+      assert.ok(data.did, 'getSession should return did');
+    });
+
+    it('refreshSession returns new tokens', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.server.refreshSession`,
+        {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${refreshToken}` },
+        },
+      );
+      const data = await res.json();
+      assert.ok(data.accessJwt, 'Should return new accessJwt');
+      assert.ok(data.refreshJwt, 'Should return new refreshJwt');
+      token = data.accessJwt; // Use new token
+    });
+
+    it('refreshSession rejects access token', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.server.refreshSession`,
+        {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${token}` },
+        },
+      );
+      assert.strictEqual(res.status, 400);
+    });
+
+    it('refreshSession rejects missing auth', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.server.refreshSession`,
+        {
+          method: 'POST',
+        },
+      );
+      assert.strictEqual(res.status, 401);
+    });
+
+    it('createRecord rejects without auth', async () => {
+      const { status } = await jsonPost('/xrpc/com.atproto.repo.createRecord', {
+        repo: 'x',
+        collection: 'x',
+        record: {},
+      });
+      assert.strictEqual(status, 401);
+    });
+
+    it('getPreferences works', async () => {
+      const res = await fetch(`${BASE}/xrpc/app.bsky.actor.getPreferences`, {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      const data = await res.json();
+      assert.ok(data.preferences, 'Should return preferences');
+    });
+
+    it('putPreferences works', async () => {
+      const { status } = await jsonPost(
+        '/xrpc/app.bsky.actor.putPreferences',
+        { preferences: [{ $type: 'app.bsky.actor.defs#savedFeedsPrefV2' }] },
+        { Authorization: `Bearer ${token}` },
+      );
+      assert.strictEqual(status, 200);
+    });
+  });
+
+  describe('Record operations', () => {
+    it('createRecord with auth', async () => {
+      const { status, data } = await jsonPost(
+        '/xrpc/com.atproto.repo.createRecord',
+        {
+          repo: DID,
+          collection: 'app.bsky.feed.post',
+          record: { text: 'test', createdAt: new Date().toISOString() },
+        },
+        { Authorization: `Bearer ${token}` },
+      );
+      assert.strictEqual(status, 200);
+      assert.ok(data.uri, 'Should return uri');
+      testRkey = data.uri.split('/').pop();
+    });
+
+    it('getRecord returns record', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.repo.getRecord?repo=${DID}&collection=app.bsky.feed.post&rkey=${testRkey}`,
+      );
+      const data = await res.json();
+      assert.ok(data.value?.text, 'Should return record value');
+    });
+
+    it('putRecord updates record', async () => {
+      const { status, data } = await jsonPost(
+        '/xrpc/com.atproto.repo.putRecord',
+        {
+          repo: DID,
+          collection: 'app.bsky.feed.post',
+          rkey: testRkey,
+          record: { text: 'updated', createdAt: new Date().toISOString() },
+        },
+        { Authorization: `Bearer ${token}` },
+      );
+      assert.strictEqual(status, 200);
+      assert.ok(data.uri);
+    });
+
+    it('listRecords returns records', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.repo.listRecords?repo=${DID}&collection=app.bsky.feed.post`,
+      );
+      const data = await res.json();
+      assert.ok(data.records?.length > 0, 'Should return records');
+    });
+
+    it('describeRepo returns did', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.repo.describeRepo?repo=${DID}`,
+      );
+      const data = await res.json();
+      assert.ok(data.did);
+    });
+
+    it('applyWrites create', async () => {
+      const { status, data } = await jsonPost(
+        '/xrpc/com.atproto.repo.applyWrites',
+        {
+          repo: DID,
+          writes: [
+            {
+              $type: 'com.atproto.repo.applyWrites#create',
+              collection: 'app.bsky.feed.post',
+              rkey: 'applytest',
+              value: { text: 'batch', createdAt: new Date().toISOString() },
+            },
+          ],
+        },
+        { Authorization: `Bearer ${token}` },
+      );
+      assert.strictEqual(status, 200);
+      assert.ok(data.results);
+    });
+
+    it('applyWrites delete', async () => {
+      const { status, data } = await jsonPost(
+        '/xrpc/com.atproto.repo.applyWrites',
+        {
+          repo: DID,
+          writes: [
+            {
+              $type: 'com.atproto.repo.applyWrites#delete',
+              collection: 'app.bsky.feed.post',
+              rkey: 'applytest',
+            },
+          ],
+        },
+        { Authorization: `Bearer ${token}` },
+      );
+      assert.strictEqual(status, 200);
+      assert.ok(data.results);
+    });
+  });
+
+  describe('Sync endpoints', () => {
+    it('getLatestCommit returns cid', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.sync.getLatestCommit?did=${DID}`,
+      );
+      const data = await res.json();
+      assert.ok(data.cid);
+    });
+
+    it('getRepoStatus returns did', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.sync.getRepoStatus?did=${DID}`,
+      );
+      const data = await res.json();
+      assert.ok(data.did);
+    });
+
+    it('getRepo returns CAR', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.sync.getRepo?did=${DID}`,
+      );
+      const data = await res.arrayBuffer();
+      assert.ok(data.byteLength > 100, 'Should return CAR data');
+    });
+
+    it('getRecord returns record CAR', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.sync.getRecord?did=${DID}&collection=app.bsky.feed.post&rkey=${testRkey}`,
+      );
+      const data = await res.arrayBuffer();
+      assert.ok(data.byteLength > 50);
+    });
+
+    it('listRepos returns repos', async () => {
+      const res = await fetch(`${BASE}/xrpc/com.atproto.sync.listRepos`);
+      const data = await res.json();
+      assert.ok(data.repos?.length > 0);
+    });
+  });
+
+  describe('Error handling', () => {
+    it('invalid password rejected (401)', async () => {
+      const { status } = await jsonPost(
+        '/xrpc/com.atproto.server.createSession',
+        {
+          identifier: DID,
+          password: 'wrong-password',
+        },
+      );
+      assert.strictEqual(status, 401);
+    });
+
+    it('wrong repo rejected (403)', async () => {
+      const { status } = await jsonPost(
+        '/xrpc/com.atproto.repo.createRecord',
+        {
+          repo: 'did:plc:z72i7hdynmk6r22z27h6tvur',
+          collection: 'app.bsky.feed.post',
+          record: { text: 'x', createdAt: '2024-01-01T00:00:00Z' },
+        },
+        { Authorization: `Bearer ${token}` },
+      );
+      assert.strictEqual(status, 403);
+    });
+
+    it('non-existent record errors', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.repo.getRecord?repo=${DID}&collection=app.bsky.feed.post&rkey=nonexistent`,
+      );
+      assert.ok([400, 404].includes(res.status));
+    });
+  });
+
+  describe('Blob endpoints', () => {
+    /** @type {string} */
+    let blobCid = '';
+    /** @type {string} */
+    let blobPostRkey = '';
+
+    // Create minimal PNG
+    const pngBytes = new Uint8Array([
+      0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d,
+      0x49, 0x48, 0x44, 0x52, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01,
+      0x08, 0x06, 0x00, 0x00, 0x00, 0x1f, 0x15, 0xc4, 0x89, 0x00, 0x00, 0x00,
+      0x0a, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9c, 0x63, 0x00, 0x01, 0x00, 0x00,
+      0x05, 0x00, 0x01, 0x0d, 0x0a, 0x2d, 0xb4, 0x00, 0x00, 0x00, 0x00, 0x49,
+      0x45, 0x4e, 0x44, 0xae, 0x42, 0x60, 0x82,
+    ]);
+
+    it('uploadBlob rejects without auth', async () => {
+      const res = await fetch(`${BASE}/xrpc/com.atproto.repo.uploadBlob`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'image/png' },
+        body: pngBytes,
+      });
+      assert.strictEqual(res.status, 401);
+    });
+
+    it('uploadBlob returns CID', async () => {
+      const res = await fetch(`${BASE}/xrpc/com.atproto.repo.uploadBlob`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'image/png',
+          Authorization: `Bearer ${token}`,
+        },
+        body: pngBytes,
+      });
+      const data = await res.json();
+      assert.ok(data.blob?.ref?.$link);
+      assert.strictEqual(data.blob?.mimeType, 'image/png');
+      blobCid = data.blob.ref.$link;
+    });
+
+    it('listBlobs includes uploaded blob', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.sync.listBlobs?did=${DID}`,
+      );
+      const data = await res.json();
+      assert.ok(data.cids?.includes(blobCid));
+    });
+
+    it('getBlob retrieves data', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.sync.getBlob?did=${DID}&cid=${blobCid}`,
+      );
+      assert.ok(res.ok);
+      assert.strictEqual(res.headers.get('content-type'), 'image/png');
+      assert.strictEqual(res.headers.get('x-content-type-options'), 'nosniff');
+    });
+
+    it('getBlob rejects wrong DID', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.sync.getBlob?did=did:plc:wrongdid&cid=${blobCid}`,
+      );
+      assert.strictEqual(res.status, 400);
+    });
+
+    it('getBlob rejects invalid CID', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.sync.getBlob?did=${DID}&cid=invalid`,
+      );
+      assert.strictEqual(res.status, 400);
+    });
+
+    it('getBlob 404 for missing blob', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.sync.getBlob?did=${DID}&cid=bafkreiaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa`,
+      );
+      assert.strictEqual(res.status, 404);
+    });
+
+    it('createRecord with blob ref', async () => {
+      const { status, data } = await jsonPost(
+        '/xrpc/com.atproto.repo.createRecord',
+        {
+          repo: DID,
+          collection: 'app.bsky.feed.post',
+          record: {
+            text: 'post with image',
+            createdAt: new Date().toISOString(),
+            embed: {
+              $type: 'app.bsky.embed.images',
+              images: [
+                {
+                  image: {
+                    $type: 'blob',
+                    ref: { $link: blobCid },
+                    mimeType: 'image/png',
+                    size: pngBytes.length,
+                  },
+                  alt: 'test',
+                },
+              ],
+            },
+          },
+        },
+        { Authorization: `Bearer ${token}` },
+      );
+      assert.strictEqual(status, 200);
+      blobPostRkey = data.uri.split('/').pop();
+    });
+
+    it('blob persists after record creation', async () => {
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.sync.listBlobs?did=${DID}`,
+      );
+      const data = await res.json();
+      assert.ok(data.cids?.includes(blobCid));
+    });
+
+    it('deleteRecord with blob cleans up', async () => {
+      const { status } = await jsonPost(
+        '/xrpc/com.atproto.repo.deleteRecord',
+        { repo: DID, collection: 'app.bsky.feed.post', rkey: blobPostRkey },
+        { Authorization: `Bearer ${token}` },
+      );
+      assert.strictEqual(status, 200);
+
+      const res = await fetch(
+        `${BASE}/xrpc/com.atproto.sync.listBlobs?did=${DID}`,
+      );
+      const data = await res.json();
+      assert.strictEqual(
+        data.cids?.length,
+        0,
+        'Orphaned blob should be cleaned up',
+      );
+    });
+  });
+
+  describe('OAuth endpoints', () => {
+    it('AS metadata', async () => {
+      const res = await fetch(`${BASE}/.well-known/oauth-authorization-server`);
+      const data = await res.json();
+      assert.strictEqual(data.issuer, BASE);
+      assert.strictEqual(
+        data.authorization_endpoint,
+        `${BASE}/oauth/authorize`,
+      );
+      assert.strictEqual(data.token_endpoint, `${BASE}/oauth/token`);
+      assert.strictEqual(
+        data.pushed_authorization_request_endpoint,
+        `${BASE}/oauth/par`,
+      );
+      assert.strictEqual(data.revocation_endpoint, `${BASE}/oauth/revoke`);
+      assert.strictEqual(data.jwks_uri, `${BASE}/oauth/jwks`);
+      assert.deepStrictEqual(data.scopes_supported, ['atproto']);
+      assert.deepStrictEqual(data.dpop_signing_alg_values_supported, ['ES256']);
+      assert.strictEqual(data.require_pushed_authorization_requests, true);
+      assert.strictEqual(data.client_id_metadata_document_supported, true);
+      assert.deepStrictEqual(data.protected_resources, [BASE]);
+    });
+
+    it('PR metadata', async () => {
+      const res = await fetch(`${BASE}/.well-known/oauth-protected-resource`);
+      const data = await res.json();
+      assert.strictEqual(data.resource, BASE);
+      assert.deepStrictEqual(data.authorization_servers, [BASE]);
+    });
+
+    it('JWKS endpoint', async () => {
+      const res = await fetch(`${BASE}/oauth/jwks`);
+      const data = await res.json();
+      assert.ok(data.keys?.length > 0);
+      const key = data.keys[0];
+      assert.strictEqual(key.kty, 'EC');
+      assert.strictEqual(key.crv, 'P-256');
+      assert.strictEqual(key.alg, 'ES256');
+      assert.strictEqual(key.use, 'sig');
+      assert.ok(key.x && key.y, 'Should have x,y coords');
+      assert.ok(!key.d, 'Should not expose private key');
+    });
+
+    it('PAR rejects missing DPoP', async () => {
+      const { status, data } = await formPost('/oauth/par', {
+        client_id: 'http://localhost:3000',
+        redirect_uri: 'http://localhost:3000/callback',
+        response_type: 'code',
+        scope: 'atproto',
+        code_challenge: 'test',
+        code_challenge_method: 'S256',
+      });
+      assert.strictEqual(status, 400);
+      assert.strictEqual(data.error, 'invalid_dpop_proof');
+    });
+
+    it('token rejects missing DPoP', async () => {
+      const { status, data } = await formPost('/oauth/token', {
+        grant_type: 'authorization_code',
+        code: 'fake',
+        client_id: 'http://localhost:3000',
+      });
+      assert.strictEqual(status, 400);
+      assert.strictEqual(data.error, 'invalid_dpop_proof');
+    });
+
+    it('revoke returns 200 for invalid token', async () => {
+      const { status } = await formPost('/oauth/revoke', {
+        token: 'nonexistent',
+        client_id: 'http://localhost:3000',
+      });
+      assert.strictEqual(status, 200);
+    });
+  });
+
+  describe('OAuth flow with DPoP', () => {
+    it('full PAR -> authorize -> token flow', async () => {
+      const dpop = await DpopClient.create();
+      const clientId = 'http://localhost:3000';
+      const redirectUri = 'http://localhost:3000/callback';
+      const codeVerifier = randomBytes(32).toString('base64url');
+
+      // Generate code_challenge from verifier (S256)
+      const challengeBuffer = await crypto.subtle.digest(
+        'SHA-256',
+        new TextEncoder().encode(codeVerifier),
+      );
+      const codeChallenge = Buffer.from(challengeBuffer).toString('base64url');
+
+      // Step 1: PAR request
+      const parProof = await dpop.createProof('POST', `${BASE}/oauth/par`);
+      const parRes = await fetch(`${BASE}/oauth/par`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: parProof,
+        },
+        body: new URLSearchParams({
+          client_id: clientId,
+          redirect_uri: redirectUri,
+          response_type: 'code',
+          scope: 'atproto',
+          code_challenge: codeChallenge,
+          code_challenge_method: 'S256',
+          state: 'test-state',
+          login_hint: DID,
+        }).toString(),
+      });
+
+      assert.strictEqual(parRes.status, 200, 'PAR should succeed');
+      const parData = await parRes.json();
+      assert.ok(parData.request_uri, 'PAR should return request_uri');
+      assert.ok(parData.expires_in > 0, 'PAR should return expires_in');
+
+      // Step 2: Authorization (simulate user consent by POSTing to authorize)
+      const authRes = await fetch(`${BASE}/oauth/authorize`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          request_uri: parData.request_uri,
+          client_id: clientId,
+          password: PASSWORD,
+        }).toString(),
+        redirect: 'manual',
+      });
+
+      assert.strictEqual(authRes.status, 302, 'Authorize should redirect');
+      const location = authRes.headers.get('location');
+      assert.ok(location, 'Should have Location header');
+
+      const redirectUrl = new URL(location);
+      const authCode = redirectUrl.searchParams.get('code');
+      assert.ok(authCode, 'Redirect should have code');
+      assert.strictEqual(redirectUrl.searchParams.get('state'), 'test-state');
+      assert.strictEqual(redirectUrl.searchParams.get('iss'), BASE);
+
+      // Step 3: Token exchange
+      const tokenProof = await dpop.createProof('POST', `${BASE}/oauth/token`);
+      const tokenRes = await fetch(`${BASE}/oauth/token`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: tokenProof,
+        },
+        body: new URLSearchParams({
+          grant_type: 'authorization_code',
+          code: authCode,
+          client_id: clientId,
+          redirect_uri: redirectUri,
+          code_verifier: codeVerifier,
+        }).toString(),
+      });
+
+      assert.strictEqual(tokenRes.status, 200, 'Token exchange should succeed');
+      const tokenData = await tokenRes.json();
+      assert.ok(tokenData.access_token, 'Should return access_token');
+      assert.ok(tokenData.refresh_token, 'Should return refresh_token');
+      assert.strictEqual(tokenData.token_type, 'DPoP');
+      assert.strictEqual(tokenData.scope, 'atproto');
+      assert.ok(tokenData.sub, 'Should return sub');
+
+      // Step 4: Use access token with DPoP for protected endpoint
+      const resourceProof = await dpop.createProof(
+        'GET',
+        `${BASE}/xrpc/com.atproto.server.getSession`,
+        tokenData.access_token,
+      );
+      const sessionRes = await fetch(
+        `${BASE}/xrpc/com.atproto.server.getSession`,
+        {
+          headers: {
+            Authorization: `DPoP ${tokenData.access_token}`,
+            DPoP: resourceProof,
+          },
+        },
+      );
+
+      assert.strictEqual(
+        sessionRes.status,
+        200,
+        'Protected endpoint should work with DPoP token',
+      );
+      const sessionData = await sessionRes.json();
+      assert.ok(sessionData.did, 'Should return session data');
+
+      // Step 5: Refresh token
+      const refreshProof = await dpop.createProof(
+        'POST',
+        `${BASE}/oauth/token`,
+      );
+      const refreshRes = await fetch(`${BASE}/oauth/token`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: refreshProof,
+        },
+        body: new URLSearchParams({
+          grant_type: 'refresh_token',
+          refresh_token: tokenData.refresh_token,
+          client_id: clientId,
+        }).toString(),
+      });
+
+      assert.strictEqual(refreshRes.status, 200, 'Refresh should succeed');
+      const refreshData = await refreshRes.json();
+      assert.ok(refreshData.access_token, 'Should return new access_token');
+      assert.ok(refreshData.refresh_token, 'Should return new refresh_token');
+
+      // Step 6: Revoke token
+      const revokeRes = await fetch(`${BASE}/oauth/revoke`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          token: refreshData.refresh_token,
+          client_id: clientId,
+        }).toString(),
+      });
+      assert.strictEqual(revokeRes.status, 200);
+    });
+
+    it('DPoP key mismatch rejected', async () => {
+      const dpop1 = await DpopClient.create();
+      const dpop2 = await DpopClient.create();
+      const clientId = 'http://localhost:3000';
+      const redirectUri = 'http://localhost:3000/callback';
+      const codeVerifier = randomBytes(32).toString('base64url');
+      const challengeBuffer = await crypto.subtle.digest(
+        'SHA-256',
+        new TextEncoder().encode(codeVerifier),
+      );
+      const codeChallenge = Buffer.from(challengeBuffer).toString('base64url');
+
+      // PAR with first key
+      const parProof = await dpop1.createProof('POST', `${BASE}/oauth/par`);
+      const parRes = await fetch(`${BASE}/oauth/par`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: parProof,
+        },
+        body: new URLSearchParams({
+          client_id: clientId,
+          redirect_uri: redirectUri,
+          response_type: 'code',
+          scope: 'atproto',
+          code_challenge: codeChallenge,
+          code_challenge_method: 'S256',
+          login_hint: DID,
+        }).toString(),
+      });
+      const parData = await parRes.json();
+
+      // Authorize
+      const authRes = await fetch(`${BASE}/oauth/authorize`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          request_uri: parData.request_uri,
+          client_id: clientId,
+          password: PASSWORD,
+        }).toString(),
+        redirect: 'manual',
+      });
+      const location = authRes.headers.get('location');
+      const authCode = new URL(location).searchParams.get('code');
+
+      // Token with DIFFERENT key should fail
+      const tokenProof = await dpop2.createProof('POST', `${BASE}/oauth/token`);
+      const tokenRes = await fetch(`${BASE}/oauth/token`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: tokenProof,
+        },
+        body: new URLSearchParams({
+          grant_type: 'authorization_code',
+          code: authCode,
+          client_id: clientId,
+          redirect_uri: redirectUri,
+          code_verifier: codeVerifier,
+        }).toString(),
+      });
+
+      assert.strictEqual(tokenRes.status, 400);
+      const tokenData = await tokenRes.json();
+      assert.strictEqual(tokenData.error, 'invalid_dpop_proof');
+    });
+
+    it('fragment response_mode returns code in fragment', async () => {
+      const dpop = await DpopClient.create();
+      const clientId = 'http://localhost:3000';
+      const redirectUri = 'http://localhost:3000/callback';
+      const codeVerifier = randomBytes(32).toString('base64url');
+      const challengeBuffer = await crypto.subtle.digest(
+        'SHA-256',
+        new TextEncoder().encode(codeVerifier),
+      );
+      const codeChallenge = Buffer.from(challengeBuffer).toString('base64url');
+
+      // PAR with response_mode=fragment
+      const parProof = await dpop.createProof('POST', `${BASE}/oauth/par`);
+      const parRes = await fetch(`${BASE}/oauth/par`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: parProof,
+        },
+        body: new URLSearchParams({
+          client_id: clientId,
+          redirect_uri: redirectUri,
+          response_type: 'code',
+          response_mode: 'fragment',
+          scope: 'atproto',
+          code_challenge: codeChallenge,
+          code_challenge_method: 'S256',
+          login_hint: DID,
+        }).toString(),
+      });
+      const parData = await parRes.json();
+      assert.ok(parData.request_uri);
+
+      // Authorize
+      const authRes = await fetch(`${BASE}/oauth/authorize`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          request_uri: parData.request_uri,
+          client_id: clientId,
+          password: PASSWORD,
+        }).toString(),
+        redirect: 'manual',
+      });
+
+      assert.strictEqual(authRes.status, 302);
+      const location = authRes.headers.get('location');
+      assert.ok(location);
+      // For fragment mode, code should be in hash fragment
+      assert.ok(location.includes('#'), 'Should use fragment');
+      const url = new URL(location);
+      const fragment = new URLSearchParams(url.hash.slice(1));
+      assert.ok(fragment.get('code'), 'Code should be in fragment');
+      assert.ok(fragment.get('iss'), 'Issuer should be in fragment');
+    });
+
+    it('PKCE failure - wrong code_verifier rejected', async () => {
+      const dpop = await DpopClient.create();
+      const clientId = 'http://localhost:3000';
+      const redirectUri = 'http://localhost:3000/callback';
+      const codeVerifier = randomBytes(32).toString('base64url');
+      const wrongVerifier = randomBytes(32).toString('base64url');
+      const challengeBuffer = await crypto.subtle.digest(
+        'SHA-256',
+        new TextEncoder().encode(codeVerifier),
+      );
+      const codeChallenge = Buffer.from(challengeBuffer).toString('base64url');
+
+      // PAR
+      const parProof = await dpop.createProof('POST', `${BASE}/oauth/par`);
+      const parRes = await fetch(`${BASE}/oauth/par`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: parProof,
+        },
+        body: new URLSearchParams({
+          client_id: clientId,
+          redirect_uri: redirectUri,
+          response_type: 'code',
+          scope: 'atproto',
+          code_challenge: codeChallenge,
+          code_challenge_method: 'S256',
+          login_hint: DID,
+        }).toString(),
+      });
+      const parData = await parRes.json();
+
+      // Authorize
+      const authRes = await fetch(`${BASE}/oauth/authorize`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          request_uri: parData.request_uri,
+          client_id: clientId,
+          password: PASSWORD,
+        }).toString(),
+        redirect: 'manual',
+      });
+      const location = authRes.headers.get('location');
+      const authCode = new URL(location).searchParams.get('code');
+
+      // Token with WRONG code_verifier should fail
+      const tokenProof = await dpop.createProof('POST', `${BASE}/oauth/token`);
+      const tokenRes = await fetch(`${BASE}/oauth/token`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: tokenProof,
+        },
+        body: new URLSearchParams({
+          grant_type: 'authorization_code',
+          code: authCode,
+          client_id: clientId,
+          redirect_uri: redirectUri,
+          code_verifier: wrongVerifier,
+        }).toString(),
+      });
+
+      assert.strictEqual(tokenRes.status, 400);
+      const tokenData = await tokenRes.json();
+      assert.strictEqual(tokenData.error, 'invalid_grant');
+      assert.ok(tokenData.message?.includes('code_verifier'));
+    });
+
+    it('redirect_uri mismatch rejected', async () => {
+      const dpop = await DpopClient.create();
+      const clientId = 'http://localhost:3000';
+      const codeVerifier = randomBytes(32).toString('base64url');
+      const challengeBuffer = await crypto.subtle.digest(
+        'SHA-256',
+        new TextEncoder().encode(codeVerifier),
+      );
+      const codeChallenge = Buffer.from(challengeBuffer).toString('base64url');
+
+      // PAR with unregistered redirect_uri
+      const parProof = await dpop.createProof('POST', `${BASE}/oauth/par`);
+      const parRes = await fetch(`${BASE}/oauth/par`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: parProof,
+        },
+        body: new URLSearchParams({
+          client_id: clientId,
+          redirect_uri: 'http://attacker.com/callback',
+          response_type: 'code',
+          scope: 'atproto',
+          code_challenge: codeChallenge,
+          code_challenge_method: 'S256',
+          login_hint: DID,
+        }).toString(),
+      });
+
+      assert.strictEqual(parRes.status, 400);
+      const parData = await parRes.json();
+      assert.strictEqual(parData.error, 'invalid_request');
+      assert.ok(parData.message?.includes('redirect_uri'));
+    });
+
+    it('DPoP jti replay rejected', async () => {
+      const dpop = await DpopClient.create();
+      const clientId = 'http://localhost:3000';
+      const redirectUri = 'http://localhost:3000/callback';
+      const codeVerifier = randomBytes(32).toString('base64url');
+      const challengeBuffer = await crypto.subtle.digest(
+        'SHA-256',
+        new TextEncoder().encode(codeVerifier),
+      );
+      const codeChallenge = Buffer.from(challengeBuffer).toString('base64url');
+
+      // Create a single DPoP proof
+      const parProof = await dpop.createProof('POST', `${BASE}/oauth/par`);
+
+      // First request should succeed
+      const parRes1 = await fetch(`${BASE}/oauth/par`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: parProof,
+        },
+        body: new URLSearchParams({
+          client_id: clientId,
+          redirect_uri: redirectUri,
+          response_type: 'code',
+          scope: 'atproto',
+          code_challenge: codeChallenge,
+          code_challenge_method: 'S256',
+          login_hint: DID,
+        }).toString(),
+      });
+      assert.strictEqual(parRes1.status, 200);
+
+      // Second request with SAME proof should be rejected
+      const parRes2 = await fetch(`${BASE}/oauth/par`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: parProof,
+        },
+        body: new URLSearchParams({
+          client_id: clientId,
+          redirect_uri: redirectUri,
+          response_type: 'code',
+          scope: 'atproto',
+          code_challenge: codeChallenge,
+          code_challenge_method: 'S256',
+          login_hint: DID,
+        }).toString(),
+      });
+
+      assert.strictEqual(parRes2.status, 400);
+      const data = await parRes2.json();
+      assert.strictEqual(data.error, 'invalid_dpop_proof');
+      assert.ok(data.message?.includes('replay'));
+    });
+  });
+
+  describe('Cleanup', () => {
+    it('deleteRecord (cleanup)', async () => {
+      const { status } = await jsonPost(
+        '/xrpc/com.atproto.repo.deleteRecord',
+        { repo: DID, collection: 'app.bsky.feed.post', rkey: testRkey },
+        { Authorization: `Bearer ${token}` },
+      );
+      assert.strictEqual(status, 200);
+    });
+  });
+});

test/helpers/dpop.js

···
+/**
+ * DPoP proof generation for e2e tests
+ */
+
+import { base64UrlEncode, computeJwkThumbprint } from '../../src/pds.js';
+
+/**
+ * Generate an ES256 key pair for DPoP
+ * @returns {Promise<{privateKey: CryptoKey, publicKey: CryptoKey, jwk: object}>}
+ */
+export async function generateKeyPair() {
+  const keyPair = await crypto.subtle.generateKey(
+    { name: 'ECDSA', namedCurve: 'P-256' },
+    true,
+    ['sign', 'verify'],
+  );
+
+  const jwk = await crypto.subtle.exportKey('jwk', keyPair.publicKey);
+  const publicJwk = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+
+  return {
+    privateKey: keyPair.privateKey,
+    publicKey: keyPair.publicKey,
+    jwk: publicJwk,
+  };
+}
+
+/**
+ * Create a DPoP proof JWT
+ * @param {object} params
+ * @param {CryptoKey} params.privateKey
+ * @param {object} params.jwk
+ * @param {string} params.method
+ * @param {string} params.url
+ * @param {string} [params.accessToken]
+ * @returns {Promise<string>}
+ */
+export async function createDpopProof({
+  privateKey,
+  jwk,
+  method,
+  url,
+  accessToken,
+}) {
+  const header = { typ: 'dpop+jwt', alg: 'ES256', jwk };
+  const payload = {
+    jti: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
+    htm: method,
+    htu: url,
+    iat: Math.floor(Date.now() / 1000),
+  };
+
+  if (accessToken) {
+    const hash = await crypto.subtle.digest(
+      'SHA-256',
+      new TextEncoder().encode(accessToken),
+    );
+    payload.ath = base64UrlEncode(new Uint8Array(hash));
+  }
+
+  const headerB64 = base64UrlEncode(
+    new TextEncoder().encode(JSON.stringify(header)),
+  );
+  const payloadB64 = base64UrlEncode(
+    new TextEncoder().encode(JSON.stringify(payload)),
+  );
+  const signingInput = `${headerB64}.${payloadB64}`;
+
+  const signature = await crypto.subtle.sign(
+    { name: 'ECDSA', hash: 'SHA-256' },
+    privateKey,
+    new TextEncoder().encode(signingInput),
+  );
+
+  return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
+}
+
+/**
+ * DPoP client helper
+ */
+export class DpopClient {
+  #privateKey;
+  #jwk;
+  #jkt = null;
+
+  constructor(privateKey, jwk) {
+    this.#privateKey = privateKey;
+    this.#jwk = jwk;
+  }
+
+  static async create() {
+    const { privateKey, jwk } = await generateKeyPair();
+    return new DpopClient(privateKey, jwk);
+  }
+
+  async getJkt() {
+    if (!this.#jkt) this.#jkt = await computeJwkThumbprint(this.#jwk);
+    return this.#jkt;
+  }
+
+  getJwk() {
+    return this.#jwk;
+  }
+
+  async createProof(method, url, accessToken) {
+    return createDpopProof({
+      privateKey: this.#privateKey,
+      jwk: this.#jwk,
+      method,
+      url,
+      accessToken,
+    });
+  }
+}

test/pds.test.js

···
   cborDecode,
   cborEncode,
   cidToString,
+  computeJwkThumbprint,
   createAccessJwt,
   createCid,
   createBlobCid,
···
   findBlobRefs,
   generateKeyPair,
   getKeyDepth,
+  getLoopbackClientMetadata,
   hexToBytes,
   importPrivateKey,
+  isLoopbackClient,
   sign,
   sniffMimeType,
+  validateClientMetadata,
   varint,
   verifyAccessJwt,
   verifyRefreshJwt,
···
     assert.deepStrictEqual(findBlobRefs(42), []);
   });
 });
+
+describe('JWK Thumbprint', () => {
+  test('computes deterministic thumbprint for EC key', async () => {
+    // Test vector: known JWK and its expected thumbprint
+    const jwk = {
+      kty: 'EC',
+      crv: 'P-256',
+      x: 'WbbCfHGZ9QtKsVuMdPZ8hBbP2949N_CSLG3LVV0nnKY',
+      y: 'eSgPlDj0RVMw8t8u4MvCYG4j_JfDwvrMUUwEEHVLmqQ',
+    };
+
+    const jkt1 = await computeJwkThumbprint(jwk);
+    const jkt2 = await computeJwkThumbprint(jwk);
+
+    // Thumbprint must be deterministic
+    assert.strictEqual(jkt1, jkt2);
+    // Must be base64url-encoded SHA-256 (43 chars)
+    assert.strictEqual(jkt1.length, 43);
+    // Must only contain base64url characters
+    assert.match(jkt1, /^[A-Za-z0-9_-]+$/);
+  });
+
+  test('produces different thumbprints for different keys', async () => {
+    const jwk1 = {
+      kty: 'EC',
+      crv: 'P-256',
+      x: 'WbbCfHGZ9QtKsVuMdPZ8hBbP2949N_CSLG3LVV0nnKY',
+      y: 'eSgPlDj0RVMw8t8u4MvCYG4j_JfDwvrMUUwEEHVLmqQ',
+    };
+    const jwk2 = {
+      kty: 'EC',
+      crv: 'P-256',
+      x: 'f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU',
+      y: 'x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0',
+    };
+
+    const jkt1 = await computeJwkThumbprint(jwk1);
+    const jkt2 = await computeJwkThumbprint(jwk2);
+
+    assert.notStrictEqual(jkt1, jkt2);
+  });
+});
+
+describe('Client Metadata', () => {
+  test('isLoopbackClient detects localhost', () => {
+    assert.strictEqual(isLoopbackClient('http://localhost:8080'), true);
+    assert.strictEqual(isLoopbackClient('http://127.0.0.1:3000'), true);
+    assert.strictEqual(isLoopbackClient('https://example.com'), false);
+  });
+
+  test('getLoopbackClientMetadata returns permissive defaults', () => {
+    const metadata = getLoopbackClientMetadata('http://localhost:8080');
+    assert.strictEqual(metadata.client_id, 'http://localhost:8080');
+    assert.ok(metadata.grant_types.includes('authorization_code'));
+    assert.strictEqual(metadata.dpop_bound_access_tokens, true);
+  });
+
+  test('validateClientMetadata rejects mismatched client_id', () => {
+    const metadata = {
+      client_id: 'https://other.com/metadata.json',
+      redirect_uris: ['https://example.com/callback'],
+      grant_types: ['authorization_code'],
+      response_types: ['code'],
+    };
+    assert.throws(
+      () =>
+        validateClientMetadata(metadata, 'https://example.com/metadata.json'),
+      /client_id mismatch/,
+    );
+  });
+});