feat: atproto auth & persistence

* added TUI (form) for auth

cmd/publication_commands.go

···
-// TODO: implement prompt for password
-//
-//	See: https://github.com/charmbracelet/bubbletea/blob/main/examples/textinputs/main.go
 package main
 
 import (
···
 
 	"github.com/spf13/cobra"
 	"github.com/stormlightlabs/noteleaf/internal/handlers"
+	"github.com/stormlightlabs/noteleaf/internal/ui"
 )
 
 // PublicationCommand implements [CommandGroup] for leaflet publication commands
···
 2. Create a new app password named "noteleaf"
 3. Use that password here
 
-The password will be prompted securely if not provided via flag.`,
+If credentials are not provided via flags, use the interactive input.`,
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			var handle string
···
 
 			password, _ := cmd.Flags().GetString("password")
 
-			if handle == "" {
-				return fmt.Errorf("handle is required")
+			if handle != "" && password != "" {
+				defer c.handler.Close()
+				return c.handler.Auth(cmd.Context(), handle, password)
 			}
 
-			if password == "" {
-				return fmt.Errorf("password is required (use --password flag)")
+			form := ui.NewAuthForm(handle, ui.AuthFormOptions{})
+			result, err := form.Run()
+			if err != nil {
+				return fmt.Errorf("failed to display auth form: %w", err)
+			}
+
+			if result.Canceled {
+				return fmt.Errorf("authentication canceled")
 			}
 
 			defer c.handler.Close()
-			return c.handler.Auth(cmd.Context(), handle, password)
+			return c.handler.Auth(cmd.Context(), result.Handle, result.Password)
 		},
 	}
-	authCmd.Flags().StringP("password", "p", "", "App password (will be prompted if not provided)")
+	authCmd.Flags().StringP("password", "p", "", "App password (will prompt if not provided)")
 	root.AddCommand(authCmd)
 
 	pullCmd := &cobra.Command{
···
 	}
 	root.AddCommand(pullCmd)
 
-	// List command
 	listCmd := &cobra.Command{
 		Use:     "list [--published|--draft|--all]",
 		Short:   "List notes synced with leaflet",

go.mod

···
 )
 
 require (
+	github.com/bluesky-social/indigo v0.0.0-20251031012455-0b4bd2478a61
 	github.com/gomarkdown/markdown v0.0.0-20250810172220-2e2c11897d1a
 	github.com/jaswdr/faker/v2 v2.8.0
 )
 
 require (
 	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/earthboundkid/versioninfo/v2 v2.24.1 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
+	github.com/hashicorp/golang-lru v1.0.2 // indirect
+	github.com/ipfs/bbloom v0.0.4 // indirect
+	github.com/ipfs/go-block-format v0.2.0 // indirect
+	github.com/ipfs/go-cid v0.4.1 // indirect
+	github.com/ipfs/go-datastore v0.6.0 // indirect
+	github.com/ipfs/go-ipfs-blockstore v1.3.1 // indirect
+	github.com/ipfs/go-ipfs-ds-help v1.1.1 // indirect
+	github.com/ipfs/go-ipfs-util v0.0.3 // indirect
+	github.com/ipfs/go-ipld-cbor v0.1.0 // indirect
+	github.com/ipfs/go-ipld-format v0.6.0 // indirect
+	github.com/ipfs/go-log v1.0.5 // indirect
+	github.com/ipfs/go-log/v2 v2.5.1 // indirect
+	github.com/ipfs/go-metrics-interface v0.0.1 // indirect
+	github.com/jbenet/goprocess v0.1.4 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/minio/sha256-simd v1.0.1 // indirect
+	github.com/mr-tron/base58 v1.2.0 // indirect
+	github.com/multiformats/go-base32 v0.1.0 // indirect
+	github.com/multiformats/go-base36 v0.2.0 // indirect
+	github.com/multiformats/go-multibase v0.2.0 // indirect
+	github.com/multiformats/go-multihash v0.2.3 // indirect
+	github.com/multiformats/go-varint v0.0.7 // indirect
+	github.com/opentracing/opentracing-go v1.2.0 // indirect
+	github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/spaolacci/murmur3 v1.1.0 // indirect
+	github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
+	go.opentelemetry.io/otel v1.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.21.0 // indirect
+	go.opentelemetry.io/otel/trace v1.21.0 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.26.0 // indirect
+	golang.org/x/crypto v0.43.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	lukechampine.com/blake3 v1.2.1 // indirect
 )
 
 require (
···
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/pflag v1.0.6 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
+	golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa // indirect
 	golang.org/x/sys v0.37.0 // indirect
 	golang.org/x/text v0.30.0
 )

go.sum

···
+al.essio.dev/pkg/shellescape v1.5.1 h1:86HrALUujYS/h+GtqoB26SBEdkWfmMI6FubjXlsXyho=
+al.essio.dev/pkg/shellescape v1.5.1/go.mod h1:6sIqp7X2P6mThCQ7twERpZTuigpr6KbZWtls1U8I890=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
 github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
···
 github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
+github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/bits-and-blooms/bitset v1.20.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bits-and-blooms/bitset v1.22.0 h1:Tquv9S8+SGaS3EhyA+up3FXzmkhxPGjQQCkcs2uw7w4=
 github.com/bits-and-blooms/bitset v1.22.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
+github.com/bluesky-social/indigo v0.0.0-20251031012455-0b4bd2478a61 h1:lU2NnyuvevVWtE35sb4xWBp1AQxa1Sv4XhexiWlrWng=
+github.com/bluesky-social/indigo v0.0.0-20251031012455-0b4bd2478a61/go.mod h1:GuGAU33qKulpZCZNPcUeIQ4RW6KzNvOy7s8MSUXbAng=
 github.com/charmbracelet/bubbles v0.21.0 h1:9TdC97SdRVg/1aaXNVWfFH3nnLAwOXr8Fn6u6mfQdFs=
 github.com/charmbracelet/bubbles v0.21.0/go.mod h1:HF+v6QUR4HkEpz62dx7ym2xc71/KBHg+zKwJtMw+qtg=
 github.com/charmbracelet/bubbletea v1.3.4 h1:kCg7B+jSCFPLYRA52SDZjr51kG/fMUEoPoZrkaDHyoI=
···
 github.com/charmbracelet/x/exp/slice v0.0.0-20250327172914-2fdc97757edf/go.mod h1:B3UgsnsBZS/eX42BlaNiJkD1pPOUa+oF1IYC6Yd2CEU=
 github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
 github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/danieljoos/wincred v1.2.2 h1:774zMFJrqaeYCK2W57BgAem/MLi6mtSE47MB6BOJ0i0=
+github.com/danieljoos/wincred v1.2.2/go.mod h1:w7w4Utbrz8lqeMbDAK0lkNJUv5sAOkFi7nd/ogr0Uh8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/earthboundkid/versioninfo/v2 v2.24.1 h1:SJTMHaoUx3GzjjnUO1QzP3ZXK6Ee/nbWyCm58eY3oUg=
+github.com/earthboundkid/versioninfo/v2 v2.24.1/go.mod h1:VcWEooDEuyUJnMfbdTh0uFN4cfEIg+kHMuWB2CDCLjw=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
 github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-yaml/yaml v2.1.0+incompatible/go.mod h1:w2MrLa16VYP0jy6N7M5kHaCkaLENm+P+Tv+MfurjSw0=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/gocolly/colly/v2 v2.2.0 h1:FQGxcqvTdFAvOpMRhk52o20Qsf6KtRU5HSf0bITS38I=
 github.com/gocolly/colly/v2 v2.2.0/go.mod h1:YOQwv1ofoQOzJiELnkThDd6ObOfl6odUk2i6Czbx3Ws=
+github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
+github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
···
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-hclog v0.9.2 h1:CG6TE5H9/JXsFWJCfoIVpKFIkFe6ysEuHirp4DxCsHI=
+github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
+github.com/hashicorp/go-retryablehttp v0.7.5 h1:bJj+Pj19UZMIweq/iie+1u5YCdGrnxCT9yvm0e+Nd5M=
+github.com/hashicorp/go-retryablehttp v0.7.5/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
+github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
+github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
+github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
+github.com/ipfs/go-block-format v0.2.0 h1:ZqrkxBA2ICbDRbK8KJs/u0O3dlp6gmAuuXUJNiW1Ycs=
+github.com/ipfs/go-block-format v0.2.0/go.mod h1:+jpL11nFx5A/SPpsoBn6Bzkra/zaArfSmsknbPMYgzM=
+github.com/ipfs/go-cid v0.4.1 h1:A/T3qGvxi4kpKWWcPC/PgbvDA2bjVLO7n4UeVwnbs/s=
+github.com/ipfs/go-cid v0.4.1/go.mod h1:uQHwDeX4c6CtyrFwdqyhpNcxVewur1M7l7fNU7LKwZk=
+github.com/ipfs/go-datastore v0.6.0 h1:JKyz+Gvz1QEZw0LsX1IBn+JFCJQH4SJVFtM4uWU0Myk=
+github.com/ipfs/go-datastore v0.6.0/go.mod h1:rt5M3nNbSO/8q1t4LNkLyUwRs8HupMeN/8O4Vn9YAT8=
+github.com/ipfs/go-detect-race v0.0.1 h1:qX/xay2W3E4Q1U7d9lNs1sU9nvguX0a7319XbyQ6cOk=
+github.com/ipfs/go-detect-race v0.0.1/go.mod h1:8BNT7shDZPo99Q74BpGMK+4D8Mn4j46UU0LZ723meps=
+github.com/ipfs/go-ipfs-blockstore v1.3.1 h1:cEI9ci7V0sRNivqaOr0elDsamxXFxJMMMy7PTTDQNsQ=
+github.com/ipfs/go-ipfs-blockstore v1.3.1/go.mod h1:KgtZyc9fq+P2xJUiCAzbRdhhqJHvsw8u2Dlqy2MyRTE=
+github.com/ipfs/go-ipfs-ds-help v1.1.1 h1:B5UJOH52IbcfS56+Ul+sv8jnIV10lbjLF5eOO0C66Nw=
+github.com/ipfs/go-ipfs-ds-help v1.1.1/go.mod h1:75vrVCkSdSFidJscs8n4W+77AtTpCIAdDGAwjitJMIo=
+github.com/ipfs/go-ipfs-util v0.0.3 h1:2RFdGez6bu2ZlZdI+rWfIdbQb1KudQp3VGwPtdNCmE0=
+github.com/ipfs/go-ipfs-util v0.0.3/go.mod h1:LHzG1a0Ig4G+iZ26UUOMjHd+lfM84LZCrn17xAKWBvs=
+github.com/ipfs/go-ipld-cbor v0.1.0 h1:dx0nS0kILVivGhfWuB6dUpMa/LAwElHPw1yOGYopoYs=
+github.com/ipfs/go-ipld-cbor v0.1.0/go.mod h1:U2aYlmVrJr2wsUBU67K4KgepApSZddGRDWBYR0H4sCk=
+github.com/ipfs/go-ipld-format v0.6.0 h1:VEJlA2kQ3LqFSIm5Vu6eIlSxD/Ze90xtc4Meten1F5U=
+github.com/ipfs/go-ipld-format v0.6.0/go.mod h1:g4QVMTn3marU3qXchwjpKPKgJv+zF+OlaKMyhJ4LHPg=
+github.com/ipfs/go-log v1.0.5 h1:2dOuUCB1Z7uoczMWgAyDck5JLb72zHzrMnGnCNNbvY8=
+github.com/ipfs/go-log v1.0.5/go.mod h1:j0b8ZoR+7+R99LD9jZ6+AJsrzkPbSXbZfGakb5JPtIo=
+github.com/ipfs/go-log/v2 v2.1.3/go.mod h1:/8d0SH3Su5Ooc31QlL1WysJhvyOTDCjcCZ9Axpmri6g=
+github.com/ipfs/go-log/v2 v2.5.1 h1:1XdUzF7048prq4aBjDQQ4SL5RxftpRGdXhNRwKSAlcY=
+github.com/ipfs/go-log/v2 v2.5.1/go.mod h1:prSpmC1Gpllc9UYWxDiZDreBYw7zp4Iqp1kOLU9U5UI=
+github.com/ipfs/go-metrics-interface v0.0.1 h1:j+cpbjYvu4R8zbleSs36gvB7jR+wsL2fGD6n0jO4kdg=
+github.com/ipfs/go-metrics-interface v0.0.1/go.mod h1:6s6euYU4zowdslK0GKHmqaIZ3j/b/tL7HTWtJ4VPgWY=
 github.com/jaswdr/faker/v2 v2.8.0 h1:3AxdXW9U7dJmWckh/P0YgRbNlCcVsTyrUNUnLVP9b3Q=
 github.com/jaswdr/faker/v2 v2.8.0/go.mod h1:jZq+qzNQr8/P+5fHd9t3txe2GNPnthrTfohtnJ7B+68=
+github.com/jbenet/go-cienv v0.1.0/go.mod h1:TqNnHUmJgXau0nCzC7kXWeotg3J9W34CUv5Djy1+FlA=
+github.com/jbenet/goprocess v0.1.4 h1:DRGOFReOMqqDNXwW70QkacFW0YN9QnwLV0Vqk+3oU0o=
+github.com/jbenet/goprocess v0.1.4/go.mod h1:5yspPrukOVuOLORacaBi858NqyClJPQxYZlqdZVfqY4=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/kennygrant/sanitize v1.2.4 h1:gN25/otpP5vAsO2djbMhF/LQX6R7+O1TB4yv8NzpJ3o=
 github.com/kennygrant/sanitize v1.2.4/go.mod h1:LGsjYYtgxbetdg5owWB2mpgUL6e2nfw2eObZ0u0qvak=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
+github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
 github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
···
 github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
+github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
+github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
+github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
+github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
···
 github.com/muesli/roff v0.1.0/go.mod h1:pjAHQM9hdUUwm/krAfrLGgJkXJ+YuhtsfZ42kieB2Ig=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
+github.com/multiformats/go-base32 v0.1.0 h1:pVx9xoSPqEIQG8o+UbAe7DNi51oej1NtK+aGkbLYxPE=
+github.com/multiformats/go-base32 v0.1.0/go.mod h1:Kj3tFY6zNr+ABYMqeUNeGvkIC/UYgtWibDcT0rExnbI=
+github.com/multiformats/go-base36 v0.2.0 h1:lFsAbNOGeKtuKozrtBsAkSVhv1p9D0/qedU9rQyccr0=
+github.com/multiformats/go-base36 v0.2.0/go.mod h1:qvnKE++v+2MWCfePClUEjE78Z7P2a1UV0xHgWc0hkp4=
+github.com/multiformats/go-multibase v0.2.0 h1:isdYCVLvksgWlMW9OZRYJEa9pZETFivncJHmHnnd87g=
+github.com/multiformats/go-multibase v0.2.0/go.mod h1:bFBZX4lKCA/2lyOFSAoKH5SS6oPyjtnzK/XTFDPkNuk=
+github.com/multiformats/go-multihash v0.2.3 h1:7Lyc8XfX/IY2jWb/gI7JP+o7JEq9hOa7BFvVU9RSh+U=
+github.com/multiformats/go-multihash v0.2.3/go.mod h1:dXgKXCXjBzdscBLk9JkjINiEsCKRVch90MdaGiKsvSM=
+github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8=
+github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
 github.com/nlnwa/whatwg-url v0.6.1 h1:Zlefa3aglQFHF/jku45VxbEJwPicDnOz64Ra3F7npqQ=
 github.com/nlnwa/whatwg-url v0.6.1/go.mod h1:x0FPXJzzOEieQtsBT/AKvbiBbQ46YlL6Xa7m02M1ECk=
+github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
+github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f h1:VXTQfuJj9vKR4TCkEuWIckKvdHFeJH/huIFJ9/cXOB0=
+github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f/go.mod h1:/zvteZs/GwLtCgZ4BL6CBsk9IKIlexP43ObX9AxTqTw=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d h1:hrujxIzL1woJ7AwssoOcM/tq5JjjG2yYOc8odClEiXA=
 github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/smartystreets/assertions v1.2.0 h1:42S6lae5dvLc7BrLu/0ugRtcFVjoJNMC/N3yZFZkDFs=
+github.com/smartystreets/assertions v1.2.0/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo=
+github.com/smartystreets/goconvey v1.7.2 h1:9RBaZCeXEQ3UselpuwUQHltGVXvdwm6cv1hgR6gDIPg=
+github.com/smartystreets/goconvey v1.7.2/go.mod h1:Vw0tHAZW6lzCRk3xgdin6fKYcG+G3Pg9vgXWeJpQFMM=
+github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
+github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/temoto/robotstxt v1.1.2 h1:W2pOjSJ6SWvldyEuiFXNxz3xZ8aiWX5LbfDiOFd7Fxg=
 github.com/temoto/robotstxt v1.1.2/go.mod h1:+1AmkuG3IYkh1kv0d2qEB9Le88ehNO0zwOr3ujewlOo=
+github.com/urfave/cli v1.22.10/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0 h1:GDDkbFiaK8jsSDJfjId/PEGEShv6ugrt4kYsC5UIDaQ=
+github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
+github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e h1:28X54ciEwwUxyHn9yrZfl5ojgF4CBNLWX7LR0rvBkf4=
+github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e/go.mod h1:pM99HXyEbSQHcosHc0iW7YFmwnscr+t9Te4ibko05so=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.7.1/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 github.com/yuin/goldmark v1.7.8 h1:iERMLn0/QJeHFhxSt3p6PeN9mGnvIKSpG9YYorDMnic=
 github.com/yuin/goldmark v1.7.8/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 github.com/yuin/goldmark-emoji v1.0.5 h1:EMVWyCGPlXJfUXBXpuMu+ii3TIaxbVBnEX9uaDC4cIk=
 github.com/yuin/goldmark-emoji v1.0.5/go.mod h1:tTkZEbwu5wkPmgTcitqddVxY9osFZiavD+r4AzQrh1U=
+github.com/zalando/go-keyring v0.2.6 h1:r7Yc3+H+Ux0+M72zacZoItR3UDxeWfKTcabvkI8ua9s=
+github.com/zalando/go-keyring v0.2.6/go.mod h1:2TCrxYrbUNYfNS/Kgy/LSrkSQzZ5UPVH85RwfczwvcI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
+go.opentelemetry.io/otel v1.21.0 h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
+go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
+go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
+go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
+go.opentelemetry.io/otel/trace v1.21.0 h1:WD9i5gzvoUPuXIXH24ZNBudiarZDKuekPqi/E8fpfLc=
+go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
+go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/goleak v1.1.11-0.20210813005559-691160354723/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
+go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
+go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
+go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
+go.uber.org/zap v1.16.0/go.mod h1:MA8QOfq0BHJwdXa996Y4dYkAqRKB8/1K1QMMZVaNZjQ=
+go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI=
+go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
+go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
+golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
+golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
+golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ=
+golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
···
 golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
 golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
···
 golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
 golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
···
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
 google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
 google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
+lukechampine.com/blake3 v1.2.1 h1:YuqqRuaqsGV71BV/nm9xlI0MKUv4QC54jQnBChWbGnI=
+lukechampine.com/blake3 v1.2.1/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=

internal/handlers/publication.go

···
-// TODO: Store credentials securely in [PublicationHandler.Auth]
-// Options:
-//  1. Use system keyring (go-keyring)
-//  2. Store encrypted in config file
-//  3. Store in environment variables
-//
 // TODO: Implement document processing
 // For each document:
 //  1. Check if note with this leaflet_rkey exists
···
 import (
 	"context"
 	"fmt"
+	"time"
 
 	"github.com/stormlightlabs/noteleaf/internal/repo"
 	"github.com/stormlightlabs/noteleaf/internal/services"
···
 	repos := repo.NewRepositories(db.DB)
 	atproto := services.NewATProtoService()
 
+	if config.ATProtoDID != "" && config.ATProtoAccessJWT != "" && config.ATProtoRefreshJWT != "" {
+		session, err := sessionFromConfig(config)
+		if err == nil {
+			_ = atproto.RestoreSession(session)
+		}
+	}
+
 	return &PublicationHandler{
 		db:      db,
 		config:  config,
···
 		return fmt.Errorf("authentication failed: %w", err)
 	}
 
+	session, err := h.atproto.GetSession()
+	if err != nil {
+		return fmt.Errorf("failed to get session after authentication: %w", err)
+	}
+
+	h.config.ATProtoDID = session.DID
+	h.config.ATProtoHandle = session.Handle
+	h.config.ATProtoAccessJWT = session.AccessJWT
+	h.config.ATProtoRefreshJWT = session.RefreshJWT
+	h.config.ATProtoPDSURL = session.PDSURL
+	h.config.ATProtoExpiresAt = session.ExpiresAt.Format("2006-01-02T15:04:05Z07:00")
+
+	if err := store.SaveConfig(h.config); err != nil {
+		return fmt.Errorf("authentication successful but failed to save credentials: %w", err)
+	}
+
 	fmt.Println("✓ Authentication successful!")
-	fmt.Println("TODO: Implement persistent credential storage")
+	fmt.Println("✓ Credentials saved")
 	return nil
 }
 
···
 	return nil
 }
 
-// List displays notes with leaflet publication metadata, showing all notes that
-// have been pulled from or pushed to leaflet
+// List displays notes with leaflet publication metadata, showing all notes that have been pulled from or pushed to leaflet
 func (h *PublicationHandler) List(ctx context.Context, filter string) error {
 	fmt.Println("TODO: Implement leaflet document listing")
 	return nil
···
 	}
 	return "Not authenticated"
 }
+
+// sessionFromConfig converts config AT Protocol fields to a Session
+func sessionFromConfig(config *store.Config) (*services.Session, error) {
+	if config.ATProtoDID == "" || config.ATProtoAccessJWT == "" || config.ATProtoRefreshJWT == "" {
+		return nil, fmt.Errorf("incomplete session data in config")
+	}
+
+	var expiresAt time.Time
+	if config.ATProtoExpiresAt != "" {
+		parsed, err := time.Parse("2006-01-02T15:04:05Z07:00", config.ATProtoExpiresAt)
+		if err != nil {
+			expiresAt = time.Now().Add(-1 * time.Hour)
+		} else {
+			expiresAt = parsed
+		}
+	} else {
+		expiresAt = time.Now().Add(-1 * time.Hour)
+	}
+
+	return &services.Session{
+		DID:           config.ATProtoDID,
+		Handle:        config.ATProtoHandle,
+		AccessJWT:     config.ATProtoAccessJWT,
+		RefreshJWT:    config.ATProtoRefreshJWT,
+		PDSURL:        config.ATProtoPDSURL,
+		ExpiresAt:     expiresAt,
+		Authenticated: true,
+	}, nil
+}

internal/handlers/publication_test.go

···
+package handlers
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stormlightlabs/noteleaf/internal/services"
+	"github.com/stormlightlabs/noteleaf/internal/store"
+)
+
+func TestPublicationHandler(t *testing.T) {
+	t.Run("sessionFromConfig", func(t *testing.T) {
+		t.Run("returns error when DID is missing", func(t *testing.T) {
+			config := &store.Config{
+				ATProtoDID:        "",
+				ATProtoHandle:     "test.bsky.social",
+				ATProtoAccessJWT:  "access_token",
+				ATProtoRefreshJWT: "refresh_token",
+			}
+
+			_, err := sessionFromConfig(config)
+			if err == nil {
+				t.Error("Expected error when DID is missing")
+			}
+		})
+
+		t.Run("returns error when AccessJWT is missing", func(t *testing.T) {
+			config := &store.Config{
+				ATProtoDID:        "did:plc:test123",
+				ATProtoHandle:     "test.bsky.social",
+				ATProtoAccessJWT:  "",
+				ATProtoRefreshJWT: "refresh_token",
+			}
+
+			_, err := sessionFromConfig(config)
+			if err == nil {
+				t.Error("Expected error when AccessJWT is missing")
+			}
+		})
+
+		t.Run("returns error when RefreshJWT is missing", func(t *testing.T) {
+			config := &store.Config{
+				ATProtoDID:        "did:plc:test123",
+				ATProtoHandle:     "test.bsky.social",
+				ATProtoAccessJWT:  "access_token",
+				ATProtoRefreshJWT: "",
+			}
+
+			_, err := sessionFromConfig(config)
+			if err == nil {
+				t.Error("Expected error when RefreshJWT is missing")
+			}
+		})
+
+		t.Run("successfully creates session from complete config", func(t *testing.T) {
+			expiresAt := time.Now().Add(2 * time.Hour)
+			config := &store.Config{
+				ATProtoDID:        "did:plc:test123",
+				ATProtoHandle:     "test.bsky.social",
+				ATProtoAccessJWT:  "access_token",
+				ATProtoRefreshJWT: "refresh_token",
+				ATProtoPDSURL:     "https://bsky.social",
+				ATProtoExpiresAt:  expiresAt.Format("2006-01-02T15:04:05Z07:00"),
+			}
+
+			session, err := sessionFromConfig(config)
+			if err != nil {
+				t.Errorf("Expected no error, got %v", err)
+			}
+
+			if session.DID != config.ATProtoDID {
+				t.Errorf("Expected DID '%s', got '%s'", config.ATProtoDID, session.DID)
+			}
+			if session.Handle != config.ATProtoHandle {
+				t.Errorf("Expected Handle '%s', got '%s'", config.ATProtoHandle, session.Handle)
+			}
+			if session.AccessJWT != config.ATProtoAccessJWT {
+				t.Errorf("Expected AccessJWT '%s', got '%s'", config.ATProtoAccessJWT, session.AccessJWT)
+			}
+			if session.RefreshJWT != config.ATProtoRefreshJWT {
+				t.Errorf("Expected RefreshJWT '%s', got '%s'", config.ATProtoRefreshJWT, session.RefreshJWT)
+			}
+			if session.PDSURL != config.ATProtoPDSURL {
+				t.Errorf("Expected PDSURL '%s', got '%s'", config.ATProtoPDSURL, session.PDSURL)
+			}
+			if !session.Authenticated {
+				t.Error("Expected session to be authenticated")
+			}
+		})
+
+		t.Run("handles missing expiry time gracefully", func(t *testing.T) {
+			config := &store.Config{
+				ATProtoDID:        "did:plc:test123",
+				ATProtoHandle:     "test.bsky.social",
+				ATProtoAccessJWT:  "access_token",
+				ATProtoRefreshJWT: "refresh_token",
+				ATProtoExpiresAt:  "",
+			}
+
+			session, err := sessionFromConfig(config)
+			if err != nil {
+				t.Errorf("Expected no error, got %v", err)
+			}
+
+			if session.ExpiresAt.After(time.Now()) {
+				t.Error("Expected ExpiresAt to be in the past when not provided")
+			}
+		})
+
+		t.Run("handles invalid expiry time format gracefully", func(t *testing.T) {
+			config := &store.Config{
+				ATProtoDID:        "did:plc:test123",
+				ATProtoHandle:     "test.bsky.social",
+				ATProtoAccessJWT:  "access_token",
+				ATProtoRefreshJWT: "refresh_token",
+				ATProtoExpiresAt:  "invalid-timestamp",
+			}
+
+			session, err := sessionFromConfig(config)
+			if err != nil {
+				t.Errorf("Expected no error, got %v", err)
+			}
+
+			if session.ExpiresAt.After(time.Now()) {
+				t.Error("Expected ExpiresAt to be in the past when parse fails")
+			}
+		})
+	})
+
+	t.Run("Auth", func(t *testing.T) {
+		t.Run("validates required parameters", func(t *testing.T) {
+			_ = NewHandlerTestSuite(t)
+			handler := CreateHandler(t, NewPublicationHandler)
+			ctx := context.Background()
+
+			err := handler.Auth(ctx, "", "password")
+			if err == nil {
+				t.Error("Expected error when handle is empty")
+			}
+
+			err = handler.Auth(ctx, "handle", "")
+			if err == nil {
+				t.Error("Expected error when password is empty")
+			}
+		})
+
+	})
+
+	t.Run("GetAuthStatus", func(t *testing.T) {
+		t.Run("returns not authenticated when no session", func(t *testing.T) {
+			_ = NewHandlerTestSuite(t)
+			handler := CreateHandler(t, NewPublicationHandler)
+
+			status := handler.GetAuthStatus()
+			if status != "Not authenticated" {
+				t.Errorf("Expected 'Not authenticated', got '%s'", status)
+			}
+		})
+
+		t.Run("returns authenticated status with session", func(t *testing.T) {
+			_ = NewHandlerTestSuite(t)
+			handler := CreateHandler(t, NewPublicationHandler)
+
+			session := &services.Session{
+				DID:           "did:plc:test123",
+				Handle:        "test.bsky.social",
+				AccessJWT:     "access_token",
+				RefreshJWT:    "refresh_token",
+				PDSURL:        "https://bsky.social",
+				ExpiresAt:     time.Now().Add(2 * time.Hour),
+				Authenticated: true,
+			}
+
+			err := handler.atproto.RestoreSession(session)
+			if err != nil {
+				t.Fatalf("Failed to restore session: %v", err)
+			}
+
+			status := handler.GetAuthStatus()
+			expectedStatus := "Authenticated as test.bsky.social"
+			if status != expectedStatus {
+				t.Errorf("Expected '%s', got '%s'", expectedStatus, status)
+			}
+		})
+	})
+
+	t.Run("NewPublicationHandler", func(t *testing.T) {
+		t.Run("creates handler successfully", func(t *testing.T) {
+			suite := NewHandlerTestSuite(t)
+			defer suite.Cleanup()
+
+			handler, err := NewPublicationHandler()
+			if err != nil {
+				t.Fatalf("Expected no error creating handler, got %v", err)
+			}
+			defer handler.Close()
+
+			if handler.db == nil {
+				t.Error("Expected database to be initialized")
+			}
+			if handler.config == nil {
+				t.Error("Expected config to be initialized")
+			}
+			if handler.repos == nil {
+				t.Error("Expected repos to be initialized")
+			}
+			if handler.atproto == nil {
+				t.Error("Expected atproto service to be initialized")
+			}
+		})
+
+		t.Run("restores session from config when available", func(t *testing.T) {
+			suite := NewHandlerTestSuite(t)
+			defer suite.Cleanup()
+
+			config, err := store.LoadConfig()
+			if err != nil {
+				t.Fatalf("Failed to load config: %v", err)
+			}
+
+			config.ATProtoDID = "did:plc:test123"
+			config.ATProtoHandle = "test.bsky.social"
+			config.ATProtoAccessJWT = "access_token"
+			config.ATProtoRefreshJWT = "refresh_token"
+			config.ATProtoPDSURL = "https://bsky.social"
+			config.ATProtoExpiresAt = time.Now().Add(2 * time.Hour).Format("2006-01-02T15:04:05Z07:00")
+
+			err = store.SaveConfig(config)
+			if err != nil {
+				t.Fatalf("Failed to save config: %v", err)
+			}
+
+			handler, err := NewPublicationHandler()
+			if err != nil {
+				t.Fatalf("Expected no error creating handler, got %v", err)
+			}
+			defer handler.Close()
+
+			if !handler.atproto.IsAuthenticated() {
+				t.Error("Expected handler to be authenticated after restoring from config")
+			}
+
+			session, err := handler.atproto.GetSession()
+			if err != nil {
+				t.Errorf("Expected to get session, got error: %v", err)
+			}
+			if session.DID != config.ATProtoDID {
+				t.Errorf("Expected DID '%s', got '%s'", config.ATProtoDID, session.DID)
+			}
+		})
+
+		t.Run("handles empty config gracefully", func(t *testing.T) {
+			suite := NewHandlerTestSuite(t)
+			defer suite.Cleanup()
+
+			handler, err := NewPublicationHandler()
+			if err != nil {
+				t.Fatalf("Expected no error creating handler, got %v", err)
+			}
+			defer handler.Close()
+
+			if handler.atproto.IsAuthenticated() {
+				t.Error("Expected handler to not be authenticated with empty config")
+			}
+		})
+	})
+
+	t.Run("Close", func(t *testing.T) {
+		t.Run("cleans up resources properly", func(t *testing.T) {
+			suite := NewHandlerTestSuite(t)
+			defer suite.Cleanup()
+
+			handler, err := NewPublicationHandler()
+			if err != nil {
+				t.Fatalf("Expected no error creating handler, got %v", err)
+			}
+
+			err = handler.Close()
+			if err != nil {
+				t.Errorf("Expected no error on close, got %v", err)
+			}
+		})
+	})
+}

internal/services/atproto.go

···
-// TODO: Implement authentication using indigo's xrpc client:
-//  1. Create session via com.atproto.server.createSession
-//  2. Store session tokens
-//  3. Handle token refresh
-//
-// TODO: Implement authentication
-//  1. Create XRPC client
-//  2. Call com.atproto.server.createSession
-//  3. Parse response and store session
-//  4. Resolve PDS URL from DID
-//
 // TODO: Implement document fetching:
 //  1. Call com.atproto.sync.getRepo to get repository CAR file
 //  2. Parse CAR (Content Addressable aRchive) format
···
 	"fmt"
 	"time"
 
+	"github.com/bluesky-social/indigo/api/atproto"
+	"github.com/bluesky-social/indigo/xrpc"
 	"github.com/stormlightlabs/noteleaf/internal/public"
 )
 
···
 	password string
 	session  *Session
 	pdsURL   string // Personal Data Server URL
-	// TODO: wrap AT Protocol client from indigo package
-	// client    *xrpc.Client
+	client   *xrpc.Client
 }
 
 // NewATProtoService creates a new AT Protocol service
 func NewATProtoService() *ATProtoService {
+	pdsURL := "https://bsky.social"
 	return &ATProtoService{
-		pdsURL: "https://bsky.social",
+		pdsURL: pdsURL,
+		client: &xrpc.Client{
+			Host: pdsURL,
+		},
 	}
 }
 
···
 
 	s.handle = handle
 	s.password = password
+
+	input := &atproto.ServerCreateSession_Input{
+		Identifier: handle,
+		Password:   password,
+	}
+
+	output, err := atproto.ServerCreateSession(ctx, s.client, input)
+	if err != nil {
+		return fmt.Errorf("failed to create session: %w", err)
+	}
+
+	expiresAt := time.Now().Add(2 * time.Hour)
+
 	s.session = &Session{
-		Handle: handle,
-		// TODO: Set to true once auth is implemented
-		Authenticated: false,
+		DID:           output.Did,
+		Handle:        output.Handle,
+		AccessJWT:     output.AccessJwt,
+		RefreshJWT:    output.RefreshJwt,
 		PDSURL:        s.pdsURL,
+		ExpiresAt:     expiresAt,
+		Authenticated: true,
 	}
 
-	return fmt.Errorf("TODO: implement com.atproto.server.createSession")
+	s.client.Auth = &xrpc.AuthInfo{
+		AccessJwt:  output.AccessJwt,
+		RefreshJwt: output.RefreshJwt,
+		Handle:     output.Handle,
+		Did:        output.Did,
+	}
+
+	return nil
 }
 
 // GetSession returns the current session information
···
 // IsAuthenticated checks if the service has a valid session
 func (s *ATProtoService) IsAuthenticated() bool {
 	return s.session != nil && s.session.Authenticated
+}
+
+// RestoreSession restores a previously authenticated session from stored credentials
+func (s *ATProtoService) RestoreSession(session *Session) error {
+	if session == nil {
+		return fmt.Errorf("session cannot be nil")
+	}
+
+	if session.DID == "" || session.AccessJWT == "" || session.RefreshJWT == "" {
+		return fmt.Errorf("session missing required fields (DID, AccessJWT, RefreshJWT)")
+	}
+
+	s.session = session
+
+	s.client.Auth = &xrpc.AuthInfo{
+		AccessJwt:  session.AccessJWT,
+		RefreshJwt: session.RefreshJWT,
+		Handle:     session.Handle,
+		Did:        session.DID,
+	}
+
+	if session.PDSURL != "" {
+		s.pdsURL = session.PDSURL
+		s.client.Host = session.PDSURL
+	}
+
+	return nil
+}
+
+// RefreshToken refreshes the access token using the refresh token
+func (s *ATProtoService) RefreshToken(ctx context.Context) error {
+	if s.session == nil || s.session.RefreshJWT == "" {
+		return fmt.Errorf("no session available to refresh")
+	}
+
+	s.client.Auth = &xrpc.AuthInfo{
+		AccessJwt:  s.session.AccessJWT,
+		RefreshJwt: s.session.RefreshJWT,
+		Handle:     s.session.Handle,
+		Did:        s.session.DID,
+	}
+
+	output, err := atproto.ServerRefreshSession(ctx, s.client)
+	if err != nil {
+		return fmt.Errorf("failed to refresh session: %w", err)
+	}
+
+	expiresAt := time.Now().Add(2 * time.Hour)
+	s.session.AccessJWT = output.AccessJwt
+	s.session.RefreshJWT = output.RefreshJwt
+	s.session.ExpiresAt = expiresAt
+	s.session.Authenticated = true
+
+	s.client.Auth.AccessJwt = output.AccessJwt
+	s.client.Auth.RefreshJwt = output.RefreshJwt
+
+	return nil
 }
 
 // PullDocuments fetches all leaflet documents from the user's repository

internal/services/atproto_test.go

···
+package services
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+func TestATProtoService(t *testing.T) {
+	t.Run("NewATProtoService", func(t *testing.T) {
+		t.Run("creates service with default configuration", func(t *testing.T) {
+			svc := NewATProtoService()
+
+			if svc == nil {
+				t.Fatal("Expected service to be created, got nil")
+			}
+
+			if svc.pdsURL != "https://bsky.social" {
+				t.Errorf("Expected pdsURL to be 'https://bsky.social', got '%s'", svc.pdsURL)
+			}
+
+			if svc.client == nil {
+				t.Fatal("Expected client to be initialized, got nil")
+			}
+
+			if svc.client.Host != "https://bsky.social" {
+				t.Errorf("Expected client Host to be 'https://bsky.social', got '%s'", svc.client.Host)
+			}
+		})
+	})
+
+	t.Run("Authenticate", func(t *testing.T) {
+		t.Run("validates required parameters", func(t *testing.T) {
+			svc := NewATProtoService()
+			ctx := context.Background()
+
+			err := svc.Authenticate(ctx, "", "password")
+			if err == nil {
+				t.Error("Expected error for empty handle, got nil")
+			}
+
+			err = svc.Authenticate(ctx, "handle", "")
+			if err == nil {
+				t.Error("Expected error for empty password, got nil")
+			}
+
+			err = svc.Authenticate(ctx, "", "")
+			if err == nil {
+				t.Error("Expected error for empty handle and password, got nil")
+			}
+		})
+	})
+
+	t.Run("IsAuthenticated", func(t *testing.T) {
+		t.Run("returns false when no session exists", func(t *testing.T) {
+			svc := NewATProtoService()
+
+			if svc.IsAuthenticated() {
+				t.Error("Expected IsAuthenticated to return false for new service")
+			}
+		})
+
+		t.Run("returns false when session is not authenticated", func(t *testing.T) {
+			svc := NewATProtoService()
+			svc.session = &Session{
+				Handle:        "test.bsky.social",
+				Authenticated: false,
+			}
+
+			if svc.IsAuthenticated() {
+				t.Error("Expected IsAuthenticated to return false for unauthenticated session")
+			}
+		})
+
+		t.Run("returns true when session is authenticated", func(t *testing.T) {
+			svc := NewATProtoService()
+			svc.session = &Session{
+				Handle:        "test.bsky.social",
+				Authenticated: true,
+			}
+
+			if !svc.IsAuthenticated() {
+				t.Error("Expected IsAuthenticated to return true for authenticated session")
+			}
+		})
+	})
+
+	t.Run("GetSession", func(t *testing.T) {
+		t.Run("returns error when not authenticated", func(t *testing.T) {
+			svc := NewATProtoService()
+
+			session, err := svc.GetSession()
+			if err == nil {
+				t.Error("Expected error when getting session without authentication")
+			}
+			if session != nil {
+				t.Error("Expected nil session when not authenticated")
+			}
+		})
+
+		t.Run("returns session when authenticated", func(t *testing.T) {
+			svc := NewATProtoService()
+			expectedSession := &Session{
+				DID:           "did:plc:test123",
+				Handle:        "test.bsky.social",
+				AccessJWT:     "access_token",
+				RefreshJWT:    "refresh_token",
+				PDSURL:        "https://bsky.social",
+				ExpiresAt:     time.Now().Add(2 * time.Hour),
+				Authenticated: true,
+			}
+			svc.session = expectedSession
+
+			session, err := svc.GetSession()
+			if err != nil {
+				t.Errorf("Expected no error, got %v", err)
+			}
+			if session == nil {
+				t.Fatal("Expected session to be returned, got nil")
+			}
+			if session.DID != expectedSession.DID {
+				t.Errorf("Expected DID '%s', got '%s'", expectedSession.DID, session.DID)
+			}
+			if session.Handle != expectedSession.Handle {
+				t.Errorf("Expected Handle '%s', got '%s'", expectedSession.Handle, session.Handle)
+			}
+		})
+	})
+
+	t.Run("RefreshToken", func(t *testing.T) {
+		t.Run("returns error when no session exists", func(t *testing.T) {
+			svc := NewATProtoService()
+			ctx := context.Background()
+
+			err := svc.RefreshToken(ctx)
+			if err == nil {
+				t.Error("Expected error when refreshing without session")
+			}
+		})
+
+		t.Run("returns error when refresh token is empty", func(t *testing.T) {
+			svc := NewATProtoService()
+			ctx := context.Background()
+			svc.session = &Session{
+				Handle:     "test.bsky.social",
+				RefreshJWT: "",
+			}
+
+			err := svc.RefreshToken(ctx)
+			if err == nil {
+				t.Error("Expected error when refreshing with empty refresh token")
+			}
+		})
+	})
+
+	t.Run("RestoreSession", func(t *testing.T) {
+		t.Run("returns error when session is nil", func(t *testing.T) {
+			svc := NewATProtoService()
+
+			err := svc.RestoreSession(nil)
+			if err == nil {
+				t.Error("Expected error when restoring nil session")
+			}
+		})
+
+		t.Run("returns error when session missing DID", func(t *testing.T) {
+			svc := NewATProtoService()
+			session := &Session{
+				DID:        "",
+				Handle:     "test.bsky.social",
+				AccessJWT:  "access_token",
+				RefreshJWT: "refresh_token",
+			}
+
+			err := svc.RestoreSession(session)
+			if err == nil {
+				t.Error("Expected error when session missing DID")
+			}
+		})
+
+		t.Run("returns error when session missing AccessJWT", func(t *testing.T) {
+			svc := NewATProtoService()
+			session := &Session{
+				DID:        "did:plc:test123",
+				Handle:     "test.bsky.social",
+				AccessJWT:  "",
+				RefreshJWT: "refresh_token",
+			}
+
+			err := svc.RestoreSession(session)
+			if err == nil {
+				t.Error("Expected error when session missing AccessJWT")
+			}
+		})
+
+		t.Run("returns error when session missing RefreshJWT", func(t *testing.T) {
+			svc := NewATProtoService()
+			session := &Session{
+				DID:        "did:plc:test123",
+				Handle:     "test.bsky.social",
+				AccessJWT:  "access_token",
+				RefreshJWT: "",
+			}
+
+			err := svc.RestoreSession(session)
+			if err == nil {
+				t.Error("Expected error when session missing RefreshJWT")
+			}
+		})
+
+		t.Run("successfully restores valid session", func(t *testing.T) {
+			svc := NewATProtoService()
+			session := &Session{
+				DID:           "did:plc:test123",
+				Handle:        "test.bsky.social",
+				AccessJWT:     "access_token",
+				RefreshJWT:    "refresh_token",
+				PDSURL:        "https://test.pds.example",
+				ExpiresAt:     time.Now().Add(2 * time.Hour),
+				Authenticated: true,
+			}
+
+			err := svc.RestoreSession(session)
+			if err != nil {
+				t.Errorf("Expected no error, got %v", err)
+			}
+
+			if !svc.IsAuthenticated() {
+				t.Error("Expected service to be authenticated after restore")
+			}
+
+			restoredSession, err := svc.GetSession()
+			if err != nil {
+				t.Errorf("Expected to get session, got error: %v", err)
+			}
+			if restoredSession.DID != session.DID {
+				t.Errorf("Expected DID '%s', got '%s'", session.DID, restoredSession.DID)
+			}
+			if restoredSession.Handle != session.Handle {
+				t.Errorf("Expected Handle '%s', got '%s'", session.Handle, restoredSession.Handle)
+			}
+		})
+
+		t.Run("updates client authentication", func(t *testing.T) {
+			svc := NewATProtoService()
+			session := &Session{
+				DID:           "did:plc:test123",
+				Handle:        "test.bsky.social",
+				AccessJWT:     "access_token",
+				RefreshJWT:    "refresh_token",
+				PDSURL:        "https://test.pds.example",
+				ExpiresAt:     time.Now().Add(2 * time.Hour),
+				Authenticated: true,
+			}
+
+			err := svc.RestoreSession(session)
+			if err != nil {
+				t.Errorf("Expected no error, got %v", err)
+			}
+
+			if svc.client.Auth == nil {
+				t.Fatal("Expected client Auth to be set")
+			}
+			if svc.client.Auth.Did != session.DID {
+				t.Errorf("Expected client DID '%s', got '%s'", session.DID, svc.client.Auth.Did)
+			}
+			if svc.client.Auth.AccessJwt != session.AccessJWT {
+				t.Errorf("Expected client AccessJwt '%s', got '%s'", session.AccessJWT, svc.client.Auth.AccessJwt)
+			}
+		})
+
+		t.Run("updates PDS URL when provided", func(t *testing.T) {
+			svc := NewATProtoService()
+			customPDS := "https://custom.pds.example"
+			session := &Session{
+				DID:           "did:plc:test123",
+				Handle:        "test.bsky.social",
+				AccessJWT:     "access_token",
+				RefreshJWT:    "refresh_token",
+				PDSURL:        customPDS,
+				ExpiresAt:     time.Now().Add(2 * time.Hour),
+				Authenticated: true,
+			}
+
+			err := svc.RestoreSession(session)
+			if err != nil {
+				t.Errorf("Expected no error, got %v", err)
+			}
+
+			if svc.pdsURL != customPDS {
+				t.Errorf("Expected pdsURL '%s', got '%s'", customPDS, svc.pdsURL)
+			}
+			if svc.client.Host != customPDS {
+				t.Errorf("Expected client Host '%s', got '%s'", customPDS, svc.client.Host)
+			}
+		})
+	})
+
+	t.Run("Close", func(t *testing.T) {
+		t.Run("clears session", func(t *testing.T) {
+			svc := NewATProtoService()
+			svc.session = &Session{
+				Handle:        "test.bsky.social",
+				Authenticated: true,
+			}
+
+			err := svc.Close()
+			if err != nil {
+				t.Errorf("Expected no error on close, got %v", err)
+			}
+			if svc.session != nil {
+				t.Error("Expected session to be nil after close")
+			}
+		})
+	})
+}

internal/store/config.go

···
 	ExportFormat    string `toml:"export_format"`
 	MovieAPIKey     string `toml:"movie_api_key,omitempty"`
 	BookAPIKey      string `toml:"book_api_key,omitempty"`
+
+	ATProtoDID        string `toml:"atproto_did,omitempty"`
+	ATProtoHandle     string `toml:"atproto_handle,omitempty"`
+	ATProtoAccessJWT  string `toml:"atproto_access_jwt,omitempty"`
+	ATProtoRefreshJWT string `toml:"atproto_refresh_jwt,omitempty"`
+	ATProtoPDSURL     string `toml:"atproto_pds_url,omitempty"`
+	ATProtoExpiresAt  string `toml:"atproto_expires_at,omitempty"` // ISO8601 timestamp
 }
 
 // DefaultConfig returns a configuration with sensible defaults

internal/ui/auth_form.go

···
+package ui
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"github.com/charmbracelet/bubbles/key"
+	"github.com/charmbracelet/bubbles/textinput"
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+)
+
+// AuthFormOptions configures the auth form display
+type AuthFormOptions struct {
+	Output io.Writer
+	Input  io.Reader
+	Width  int
+	Height int
+}
+
+// AuthFormResult holds the submitted credentials
+type AuthFormResult struct {
+	Handle   string
+	Password string
+	Canceled bool
+}
+
+// AuthForm provides an interactive form for AT Protocol authentication
+type AuthForm struct {
+	initialHandle string
+	opts          AuthFormOptions
+}
+
+// NewAuthForm creates a new authentication form
+func NewAuthForm(initialHandle string, opts AuthFormOptions) *AuthForm {
+	if opts.Output == nil {
+		opts.Output = os.Stdout
+	}
+	if opts.Input == nil {
+		opts.Input = os.Stdin
+	}
+	if opts.Width == 0 {
+		opts.Width = 80
+	}
+	if opts.Height == 0 {
+		opts.Height = 24
+	}
+
+	return &AuthForm{
+		initialHandle: initialHandle,
+		opts:          opts,
+	}
+}
+
+type authFormKeyMap struct {
+	Up       key.Binding
+	Down     key.Binding
+	Tab      key.Binding
+	ShiftTab key.Binding
+	Enter    key.Binding
+	Submit   key.Binding
+	Cancel   key.Binding
+}
+
+var authFormKeys = authFormKeyMap{
+	Up:       key.NewBinding(key.WithKeys("up", "shift+tab"), key.WithHelp("↑/shift+tab", "previous field")),
+	Down:     key.NewBinding(key.WithKeys("down", "tab"), key.WithHelp("↓/tab", "next field")),
+	Tab:      key.NewBinding(key.WithKeys("tab")),
+	ShiftTab: key.NewBinding(key.WithKeys("shift+tab")),
+	Enter:    key.NewBinding(key.WithKeys("enter"), key.WithHelp("enter", "submit")),
+	Submit:   key.NewBinding(key.WithKeys("ctrl+s"), key.WithHelp("ctrl+s", "submit")),
+	Cancel:   key.NewBinding(key.WithKeys("esc", "ctrl+c"), key.WithHelp("esc/ctrl+c", "cancel")),
+}
+
+type authFormModel struct {
+	handleInput   textinput.Model
+	passwordInput textinput.Model
+	focusIndex    int
+	keys          authFormKeyMap
+	submitted     bool
+	canceled      bool
+	handleLocked  bool
+}
+
+func (m authFormModel) Init() tea.Cmd {
+	if m.handleLocked {
+		return m.passwordInput.Focus()
+	}
+	return m.handleInput.Focus()
+}
+
+func (m authFormModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	var cmds []tea.Cmd
+
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch {
+		case key.Matches(msg, m.keys.Cancel):
+			m.canceled = true
+			return m, tea.Quit
+
+		case key.Matches(msg, m.keys.Submit), key.Matches(msg, m.keys.Enter):
+			if m.handleInput.Value() == "" {
+				return m, nil
+			}
+			if m.passwordInput.Value() == "" {
+				return m, nil
+			}
+			m.submitted = true
+			return m, tea.Quit
+		case key.Matches(msg, m.keys.Down), key.Matches(msg, m.keys.Tab):
+			m.nextInput()
+			cmds = append(cmds, m.updateFocus())
+		case key.Matches(msg, m.keys.Up), key.Matches(msg, m.keys.ShiftTab):
+			m.prevInput()
+			cmds = append(cmds, m.updateFocus())
+		}
+	}
+
+	cmd := m.updateInputs(msg)
+	cmds = append(cmds, cmd)
+
+	return m, tea.Batch(cmds...)
+}
+
+func (m *authFormModel) nextInput() {
+	if m.handleLocked {
+		m.focusIndex = 1
+	} else {
+		m.focusIndex = (m.focusIndex + 1) % 2
+	}
+}
+
+func (m *authFormModel) prevInput() {
+	if m.handleLocked {
+		m.focusIndex = 1
+	} else {
+		m.focusIndex = (m.focusIndex - 1 + 2) % 2
+	}
+}
+
+func (m *authFormModel) updateFocus() tea.Cmd {
+	if m.focusIndex == 0 && !m.handleLocked {
+		m.handleInput.Focus()
+		m.passwordInput.Blur()
+		return textinput.Blink
+	}
+
+	m.handleInput.Blur()
+	m.passwordInput.Focus()
+	return textinput.Blink
+}
+
+func (m *authFormModel) updateInputs(msg tea.Msg) tea.Cmd {
+	var cmds []tea.Cmd
+	var cmd tea.Cmd
+
+	if !m.handleLocked {
+		m.handleInput, cmd = m.handleInput.Update(msg)
+		cmds = append(cmds, cmd)
+	}
+
+	m.passwordInput, cmd = m.passwordInput.Update(msg)
+	cmds = append(cmds, cmd)
+
+	return tea.Batch(cmds...)
+}
+
+func (m authFormModel) View() string {
+	var b strings.Builder
+
+	titleStyle := lipgloss.NewStyle().
+		Bold(true).
+		Foreground(lipgloss.Color("6")).
+		MarginBottom(1)
+
+	labelStyle := lipgloss.NewStyle().
+		Foreground(lipgloss.Color("7"))
+
+	helpStyle := lipgloss.NewStyle().
+		Foreground(lipgloss.Color("8")).
+		MarginTop(1)
+
+	errorStyle := lipgloss.NewStyle().
+		Foreground(lipgloss.Color("9"))
+
+	b.WriteString(titleStyle.Render("AT Protocol Authentication"))
+	b.WriteString("\n\n")
+
+	b.WriteString(labelStyle.Render("BlueSky Handle:"))
+	b.WriteString("\n")
+	if m.handleLocked {
+		lockedStyle := lipgloss.NewStyle().
+			Foreground(lipgloss.Color("8"))
+		b.WriteString(lockedStyle.Render(m.handleInput.Value()))
+		b.WriteString(lockedStyle.Render(" (locked)"))
+	} else {
+		b.WriteString(m.handleInput.View())
+	}
+	b.WriteString("\n\n")
+
+	b.WriteString(labelStyle.Render("App Password:"))
+	b.WriteString("\n")
+	b.WriteString(m.passwordInput.View())
+	b.WriteString("\n\n")
+
+	if m.handleInput.Value() == "" {
+		b.WriteString(errorStyle.Render("Handle is required"))
+		b.WriteString("\n")
+	}
+	if m.passwordInput.Value() == "" {
+		b.WriteString(errorStyle.Render("Password is required"))
+		b.WriteString("\n")
+	}
+
+	b.WriteString("\n")
+	helpText := "tab/shift+tab: navigate • enter/ctrl+s: submit • esc/ctrl+c: cancel"
+	b.WriteString(helpStyle.Render(helpText))
+
+	return b.String()
+}
+
+// Run displays the auth form and returns the entered credentials
+func (af *AuthForm) Run() (*AuthFormResult, error) {
+	handleInput := textinput.New()
+	handleInput.Placeholder = "username.bsky.social"
+	handleInput.Width = 40
+	handleInput.CharLimit = 253
+
+	passwordInput := textinput.New()
+	passwordInput.Placeholder = "App password"
+	passwordInput.Width = 40
+	passwordInput.EchoMode = textinput.EchoPassword
+	passwordInput.EchoCharacter = '•'
+
+	handleLocked := false
+	focusIndex := 0
+
+	if af.initialHandle != "" {
+		handleInput.SetValue(af.initialHandle)
+		handleLocked = true
+		focusIndex = 1
+	}
+
+	model := authFormModel{
+		handleInput:   handleInput,
+		passwordInput: passwordInput,
+		focusIndex:    focusIndex,
+		keys:          authFormKeys,
+		handleLocked:  handleLocked,
+	}
+
+	program := tea.NewProgram(
+		model,
+		tea.WithInput(af.opts.Input),
+		tea.WithOutput(af.opts.Output),
+	)
+
+	finalModel, err := program.Run()
+	if err != nil {
+		return nil, fmt.Errorf("failed to run auth form: %w", err)
+	}
+
+	result := finalModel.(authFormModel)
+
+	return &AuthFormResult{
+		Handle:   result.handleInput.Value(),
+		Password: result.passwordInput.Value(),
+		Canceled: result.canceled,
+	}, nil
+}

internal/ui/auth_form_test.go

···
+package ui
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/charmbracelet/bubbles/textinput"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func createTestAuthFormModel(handle string) authFormModel {
+	handleInput := textinput.New()
+	handleInput.Placeholder = "username.bsky.social"
+	handleInput.Width = 40
+
+	passwordInput := textinput.New()
+	passwordInput.Placeholder = "App password"
+	passwordInput.Width = 40
+	passwordInput.EchoMode = textinput.EchoPassword
+	passwordInput.EchoCharacter = '•'
+
+	handleLocked := false
+	focusIndex := 0
+
+	if handle != "" {
+		handleInput.SetValue(handle)
+		handleLocked = true
+		focusIndex = 1
+	}
+
+	return authFormModel{
+		handleInput:   handleInput,
+		passwordInput: passwordInput,
+		focusIndex:    focusIndex,
+		keys:          authFormKeys,
+		handleLocked:  handleLocked,
+	}
+}
+
+func TestAuthFormModel(t *testing.T) {
+	t.Run("Init", func(t *testing.T) {
+		t.Run("focuses handle input when no initial handle", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+
+			cmd := model.Init()
+			if cmd == nil {
+				t.Error("Expected Init to return a focus command")
+			}
+		})
+
+		t.Run("focuses password input when handle is locked", func(t *testing.T) {
+			model := createTestAuthFormModel("test.bsky.social")
+
+			cmd := model.Init()
+			if cmd == nil {
+				t.Error("Expected Init to return a focus command")
+			}
+
+			if !model.handleLocked {
+				t.Error("Expected handleLocked to be true")
+			}
+			if model.focusIndex != 1 {
+				t.Errorf("Expected focusIndex to be 1, got %d", model.focusIndex)
+			}
+		})
+	})
+
+	t.Run("Navigation", func(t *testing.T) {
+		t.Run("tab moves to next field", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+			if cmd := model.Init(); cmd != nil {
+				model.handleInput.Focus()
+			}
+
+			suite := NewTUITestSuite(t, model)
+			suite.Start()
+
+			if err := suite.SendKey(tea.KeyTab); err != nil {
+				t.Fatalf("Failed to send tab key: %v", err)
+			}
+
+			if err := suite.WaitFor(func(m tea.Model) bool {
+				if authModel, ok := m.(authFormModel); ok {
+					return authModel.focusIndex == 1
+				}
+				return false
+			}, 1*time.Second); err != nil {
+				t.Errorf("Expected focusIndex to change to 1: %v", err)
+			}
+		})
+
+		t.Run("shift+tab moves to previous field", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+			if cmd := model.Init(); cmd != nil {
+				model.handleInput.Focus()
+			}
+			model.focusIndex = 1
+
+			suite := NewTUITestSuite(t, model)
+			suite.Start()
+
+			if err := suite.SendKey(tea.KeyShiftTab); err != nil {
+				t.Fatalf("Failed to send shift+tab key: %v", err)
+			}
+
+			if err := suite.WaitFor(func(m tea.Model) bool {
+				if authModel, ok := m.(authFormModel); ok {
+					return authModel.focusIndex == 0
+				}
+				return false
+			}, 1*time.Second); err != nil {
+				t.Errorf("Expected focusIndex to change to 0: %v", err)
+			}
+		})
+
+		t.Run("locked handle prevents navigation to handle field", func(t *testing.T) {
+			model := createTestAuthFormModel("test.bsky.social")
+
+			suite := NewTUITestSuite(t, model)
+			suite.Start()
+
+			if err := suite.SendKey(tea.KeyShiftTab); err != nil {
+				t.Fatalf("Failed to send shift+tab key: %v", err)
+			}
+
+			if err := suite.WaitFor(func(m tea.Model) bool {
+				if authModel, ok := m.(authFormModel); ok {
+					return authModel.focusIndex == 1
+				}
+				return false
+			}, 500*time.Millisecond); err != nil {
+				t.Errorf("Expected focusIndex to stay at 1 when handle is locked: %v", err)
+			}
+		})
+	})
+
+	t.Run("Submission", func(t *testing.T) {
+		t.Run("enter submits when both fields are filled", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+			model.handleInput.SetValue("test.bsky.social")
+			model.passwordInput.SetValue("test-password")
+
+			suite := NewTUITestSuite(t, model)
+			suite.Start()
+
+			if err := suite.SendKey(tea.KeyEnter); err != nil {
+				t.Fatalf("Failed to send enter key: %v", err)
+			}
+
+			if err := suite.WaitFor(func(m tea.Model) bool {
+				if authModel, ok := m.(authFormModel); ok {
+					return authModel.submitted
+				}
+				return false
+			}, 1*time.Second); err != nil {
+				t.Errorf("Expected model to be submitted: %v", err)
+			}
+		})
+
+		t.Run("enter does not submit when handle is empty", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+			model.passwordInput.SetValue("test-password")
+
+			suite := NewTUITestSuite(t, model)
+			suite.Start()
+
+			if err := suite.SendKey(tea.KeyEnter); err != nil {
+				t.Fatalf("Failed to send enter key: %v", err)
+			}
+
+			time.Sleep(100 * time.Millisecond)
+
+			currentModel := suite.GetCurrentModel()
+			if authModel, ok := currentModel.(authFormModel); ok {
+				if authModel.submitted {
+					t.Error("Expected model to not be submitted when handle is empty")
+				}
+			}
+		})
+
+		t.Run("enter does not submit when password is empty", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+			model.handleInput.SetValue("test.bsky.social")
+
+			suite := NewTUITestSuite(t, model)
+			suite.Start()
+
+			if err := suite.SendKey(tea.KeyEnter); err != nil {
+				t.Fatalf("Failed to send enter key: %v", err)
+			}
+
+			time.Sleep(100 * time.Millisecond)
+
+			currentModel := suite.GetCurrentModel()
+			if authModel, ok := currentModel.(authFormModel); ok {
+				if authModel.submitted {
+					t.Error("Expected model to not be submitted when password is empty")
+				}
+			}
+		})
+
+		t.Run("ctrl+s submits when both fields are filled", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+			model.handleInput.SetValue("test.bsky.social")
+			model.passwordInput.SetValue("test-password")
+
+			suite := NewTUITestSuite(t, model)
+			suite.Start()
+
+			if err := suite.SendKeyString("ctrl+s"); err != nil {
+				t.Fatalf("Failed to send ctrl+s: %v", err)
+			}
+
+			if err := suite.WaitFor(func(m tea.Model) bool {
+				if authModel, ok := m.(authFormModel); ok {
+					return authModel.submitted
+				}
+				return false
+			}, 1*time.Second); err != nil {
+				t.Errorf("Expected model to be submitted: %v", err)
+			}
+		})
+	})
+
+	t.Run("Cancellation", func(t *testing.T) {
+		t.Run("esc cancels the form", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+
+			suite := NewTUITestSuite(t, model)
+			suite.Start()
+
+			if err := suite.SendKey(tea.KeyEsc); err != nil {
+				t.Fatalf("Failed to send esc key: %v", err)
+			}
+
+			if err := suite.WaitFor(func(m tea.Model) bool {
+				if authModel, ok := m.(authFormModel); ok {
+					return authModel.canceled
+				}
+				return false
+			}, 1*time.Second); err != nil {
+				t.Errorf("Expected model to be canceled: %v", err)
+			}
+		})
+
+		t.Run("ctrl+c cancels the form", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+
+			suite := NewTUITestSuite(t, model)
+			suite.Start()
+
+			if err := suite.SendKeyString("ctrl+c"); err != nil {
+				t.Fatalf("Failed to send ctrl+c: %v", err)
+			}
+
+			if err := suite.WaitFor(func(m tea.Model) bool {
+				if authModel, ok := m.(authFormModel); ok {
+					return authModel.canceled
+				}
+				return false
+			}, 1*time.Second); err != nil {
+				t.Errorf("Expected model to be canceled: %v", err)
+			}
+		})
+	})
+
+	t.Run("View", func(t *testing.T) {
+		t.Run("displays handle and password fields", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+
+			view := model.View()
+
+			if !strings.Contains(view, "AT Protocol Authentication") {
+				t.Error("Expected view to contain title")
+			}
+			if !strings.Contains(view, "BlueSky Handle:") {
+				t.Error("Expected view to contain handle label")
+			}
+			if !strings.Contains(view, "App Password:") {
+				t.Error("Expected view to contain password label")
+			}
+		})
+
+		t.Run("displays locked status for handle", func(t *testing.T) {
+			model := createTestAuthFormModel("test.bsky.social")
+
+			view := model.View()
+
+			if !strings.Contains(view, "test.bsky.social") {
+				t.Error("Expected view to contain handle value")
+			}
+			if !strings.Contains(view, "(locked)") {
+				t.Error("Expected view to indicate handle is locked")
+			}
+		})
+
+		t.Run("displays validation messages when fields are empty", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+
+			view := model.View()
+
+			if !strings.Contains(view, "Handle is required") {
+				t.Error("Expected view to show handle validation message")
+			}
+			if !strings.Contains(view, "Password is required") {
+				t.Error("Expected view to show password validation message")
+			}
+		})
+
+		t.Run("displays help text", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+
+			view := model.View()
+
+			if !strings.Contains(view, "tab/shift+tab: navigate") {
+				t.Error("Expected view to contain navigation help")
+			}
+			if !strings.Contains(view, "enter/ctrl+s: submit") {
+				t.Error("Expected view to contain submit help")
+			}
+			if !strings.Contains(view, "esc/ctrl+c: cancel") {
+				t.Error("Expected view to contain cancel help")
+			}
+		})
+	})
+
+	t.Run("Input handling", func(t *testing.T) {
+		t.Run("accepts text input in handle field", func(t *testing.T) {
+			model := createTestAuthFormModel("")
+			if cmd := model.Init(); cmd != nil {
+				model.handleInput.Focus()
+			}
+
+			suite := NewTUITestSuite(t, model)
+			suite.Start()
+
+			if err := suite.SendKeyString("t"); err != nil {
+				t.Fatalf("Failed to send 't' key: %v", err)
+			}
+
+			if err := suite.WaitFor(func(m tea.Model) bool {
+				if authModel, ok := m.(authFormModel); ok {
+					return authModel.handleInput.Value() == "t"
+				}
+				return false
+			}, 1*time.Second); err != nil {
+				t.Errorf("Expected handle input to contain 't': %v", err)
+			}
+		})
+
+		t.Run("does not accept text input in locked handle field", func(t *testing.T) {
+			model := createTestAuthFormModel("test.bsky.social")
+			originalValue := model.handleInput.Value()
+
+			suite := NewTUITestSuite(t, model)
+			suite.Start()
+
+			if err := suite.SendKeyString("x"); err != nil {
+				t.Fatalf("Failed to send 'x' key: %v", err)
+			}
+
+			time.Sleep(100 * time.Millisecond)
+
+			currentModel := suite.GetCurrentModel()
+			if authModel, ok := currentModel.(authFormModel); ok {
+				if authModel.handleInput.Value() != originalValue {
+					t.Errorf("Expected handle input to remain unchanged, got '%s'", authModel.handleInput.Value())
+				}
+			}
+		})
+	})
+}
+
+func TestNewAuthForm(t *testing.T) {
+	t.Run("creates form with default options", func(t *testing.T) {
+		form := NewAuthForm("", AuthFormOptions{})
+
+		if form == nil {
+			t.Fatal("Expected form to be created")
+		}
+		if form.opts.Width != 80 {
+			t.Errorf("Expected default width 80, got %d", form.opts.Width)
+		}
+		if form.opts.Height != 24 {
+			t.Errorf("Expected default height 24, got %d", form.opts.Height)
+		}
+		if form.opts.Output == nil {
+			t.Error("Expected output to be set to default")
+		}
+		if form.opts.Input == nil {
+			t.Error("Expected input to be set to default")
+		}
+	})
+
+	t.Run("creates form with initial handle", func(t *testing.T) {
+		handle := "test.bsky.social"
+		form := NewAuthForm(handle, AuthFormOptions{})
+
+		if form.initialHandle != handle {
+			t.Errorf("Expected initialHandle '%s', got '%s'", handle, form.initialHandle)
+		}
+	})
+
+	t.Run("creates form with custom options", func(t *testing.T) {
+		opts := AuthFormOptions{
+			Width:  100,
+			Height: 30,
+		}
+		form := NewAuthForm("", opts)
+
+		if form.opts.Width != 100 {
+			t.Errorf("Expected width 100, got %d", form.opts.Width)
+		}
+		if form.opts.Height != 30 {
+			t.Errorf("Expected height 30, got %d", form.opts.Height)
+		}
+	})
+}