simplify stuff, remove bullshit, find better alternatives

bun.lock

···
     "": {
       "name": "watproto",
       "devDependencies": {
-        "@atproto/lex-cli": "^0.9.6",
+        "@atcute/atproto": "^3.1.8",
+        "@atcute/bluesky": "^3.2.9",
+        "@atcute/lex-cli": "^2.3.1",
+        "@atcute/lexicons": "^1.2.2",
         "concurrently": "^9.2.1",
         "prettier": "^3.6.2",
         "typescript": "^5.9.3",
···
     "packages/client": {
       "name": "@watproto/client",
       "dependencies": {
-        "@elysiajs/eden": "1.4.4",
+        "@atcute/client": "^4.0.5",
+        "@atproto/identity": "^0.4.9",
+        "@atproto/oauth-client-node": "^0.3.10",
         "@react-router/fs-routes": "^7.9.4",
         "@react-router/node": "^7.9.2",
         "@react-router/serve": "^7.9.2",
···
         "react": "^19.1.1",
         "react-dom": "^19.1.1",
         "react-router": "^7.9.2",
+        "sonner": "^2.0.7",
         "tiny-invariant": "^1.3.3",
       },
       "devDependencies": {
···
         "@types/node": "22",
         "@types/react": "^19.1.13",
         "@types/react-dom": "^19.1.9",
-        "elysia": "1.4.13",
         "eslint": "^9.36.0",
         "eslint-config-flat-gitignore": "^2.1.0",
         "eslint-plugin-react-hooks": "^7.0.1",
···
       "name": "@watproto/server",
       "version": "0.0.1",
       "dependencies": {
-        "@atproto/api": "^0.17.3",
-        "@atproto/identity": "^0.4.9",
-        "@atproto/oauth-client-node": "^0.3.9",
+        "@atcute/xrpc-server": "^0.1.3",
         "@elysiajs/cors": "1.4.0",
         "@elysiajs/openapi": "1.4.11",
         "elysia": "1.4.13",
···
     },
   },
   "packages": {
+    "@atcute/atproto": ["@atcute/atproto@3.1.8", "", { "dependencies": { "@atcute/lexicons": "^1.2.2" } }, "sha512-Miu+S7RSgAYbmQWtHJKfSFUN5Kliqoo4YH0rILPmBtfmlZieORJgXNj9oO/Uive0/ulWkiRse07ATIcK8JxMnw=="],
+
+    "@atcute/bluesky": ["@atcute/bluesky@3.2.9", "", { "dependencies": { "@atcute/atproto": "^3.1.8", "@atcute/lexicons": "^1.2.2" } }, "sha512-69+mAnnH/uyMoT3/jHLBNILHa3+dm8utDKbm/2xqSPMLvRK47Wo5COlpchu8Xq+NGisHqukhHYT8NYdQFfSJhA=="],
+
+    "@atcute/cbor": ["@atcute/cbor@2.2.7", "", { "dependencies": { "@atcute/cid": "^2.2.5", "@atcute/multibase": "^1.1.6", "@atcute/uint8array": "^1.0.5" } }, "sha512-/mwAF0gnokOphceZqFq3uzMGdd8sbw5y6bxF8CRutRkCCUcpjjpJc5fkLwhxyGgOveF3mZuHE6p7t/+IAqb7Aw=="],
+
+    "@atcute/cid": ["@atcute/cid@2.2.6", "", { "dependencies": { "@atcute/multibase": "^1.1.6", "@atcute/uint8array": "^1.0.5" } }, "sha512-bTAHHbJ24p+E//V4KCS4xdmd39o211jJswvqQOevj7vk+5IYcgDLx1ryZWZ1sEPOo9x875li/kj5gpKL14RDwQ=="],
+
+    "@atcute/client": ["@atcute/client@4.0.5", "", { "dependencies": { "@atcute/identity": "^1.1.1", "@atcute/lexicons": "^1.2.2" } }, "sha512-R8Qen8goGmEkynYGg2m6XFlVmz0GTDvQ+9w+4QqOob+XMk8/WDpF4aImev7WKEde/rV2gjcqW7zM8E6W9NShDA=="],
+
+    "@atcute/crypto": ["@atcute/crypto@2.2.6", "", { "dependencies": { "@atcute/multibase": "^1.1.6", "@atcute/uint8array": "^1.0.5", "@noble/secp256k1": "^3.0.0" } }, "sha512-vkuexF+kmrKE1/Uqzub99Qi4QpnxA2jbu60E6PTgL4XypELQ6rb59MB/J1VbY2gs0kd3ET7+L3+NWpKD5nXyfA=="],
+
+    "@atcute/identity": ["@atcute/identity@1.1.1", "", { "dependencies": { "@atcute/lexicons": "^1.2.2", "@badrap/valita": "^0.4.6" } }, "sha512-zax42n693VEhnC+5tndvO2KLDTMkHOz8UExwmklvJv7R9VujfEwiSWhcv6Jgwb3ellaG8wjiQ1lMOIjLLvwh0Q=="],
+
+    "@atcute/identity-resolver": ["@atcute/identity-resolver@1.1.4", "", { "dependencies": { "@atcute/lexicons": "^1.2.2", "@atcute/util-fetch": "^1.0.3", "@badrap/valita": "^0.4.6" }, "peerDependencies": { "@atcute/identity": "^1.0.0" } }, "sha512-/SVh8vf2cXFJenmBnGeYF2aY3WGQm3cJeew5NWTlkqoy3LvJ5wkvKq9PWu4Tv653VF40rPOp6LOdVr9Fa+q5rA=="],
+
+    "@atcute/lex-cli": ["@atcute/lex-cli@2.3.1", "", { "dependencies": { "@atcute/lexicon-doc": "^1.1.4", "@badrap/valita": "^0.4.6", "@optique/core": "^0.6.1", "@optique/run": "^0.6.1", "picocolors": "^1.1.1", "prettier": "^3.6.2" }, "bin": { "lex-cli": "cli.mjs" } }, "sha512-HrHD91CFSFd/p0UFe3akFA1HXiboQwd5LbYiU0srKdLxGX+NLTX/EdCdhbLV6M7LsXdmxk7PB6BMcprsX4rbvg=="],
+
+    "@atcute/lexicon-doc": ["@atcute/lexicon-doc@1.1.4", "", { "dependencies": { "@badrap/valita": "^0.4.6" } }, "sha512-OL0fsXtbnN/KwCq/L3nWGvOCdSHV0NWTatgLUIPt+T9AhcziFNaXAbbjvVHdflr3ZaLh3ksleHK0J789UBhlWQ=="],
+
+    "@atcute/lexicons": ["@atcute/lexicons@1.2.2", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "esm-env": "^1.2.2" } }, "sha512-bgEhJq5Z70/0TbK5sx+tAkrR8FsCODNiL2gUEvS5PuJfPxmFmRYNWaMGehxSPaXWpU2+Oa9ckceHiYbrItDTkA=="],
+
+    "@atcute/multibase": ["@atcute/multibase@1.1.6", "", { "dependencies": { "@atcute/uint8array": "^1.0.5" } }, "sha512-HBxuCgYLKPPxETV0Rot4VP9e24vKl8JdzGCZOVsDaOXJgbRZoRIF67Lp0H/OgnJeH/Xpva8Z5ReoTNJE5dn3kg=="],
+
+    "@atcute/uint8array": ["@atcute/uint8array@1.0.5", "", {}, "sha512-XLWWxoR2HNl2qU+FCr0rp1APwJXci7HnzbOQLxK55OaMNBXZ19+xNC5ii4QCsThsDxa4JS/JTzuiQLziITWf2Q=="],
+
+    "@atcute/util-fetch": ["@atcute/util-fetch@1.0.3", "", { "dependencies": { "@badrap/valita": "^0.4.6" } }, "sha512-f8zzTb/xlKIwv2OQ31DhShPUNCmIIleX6p7qIXwWwEUjX6x8skUtpdISSjnImq01LXpltGV5y8yhV4/Mlb7CRQ=="],
+
+    "@atcute/xrpc-server": ["@atcute/xrpc-server@0.1.3", "", { "dependencies": { "@atcute/cbor": "^2.2.7", "@atcute/crypto": "^2.2.5", "@atcute/identity": "^1.1.1", "@atcute/identity-resolver": "^1.1.4", "@atcute/lexicons": "^1.2.2", "@atcute/multibase": "^1.1.6", "@atcute/uint8array": "^1.0.5", "@badrap/valita": "^0.4.6", "nanoid": "^5.1.5" } }, "sha512-AMig6MuAL5VfXRZVsQqQXKCXnZgpjTc6UM6RggvyE1qVT8y9tZPFXdP5tt/p6Jf+h4cAw+XMu2uyrGpUmnTSyQ=="],
+
     "@atproto-labs/did-resolver": ["@atproto-labs/did-resolver@0.2.2", "", { "dependencies": { "@atproto-labs/fetch": "0.2.3", "@atproto-labs/pipe": "0.1.1", "@atproto-labs/simple-store": "0.3.0", "@atproto-labs/simple-store-memory": "0.1.4", "@atproto/did": "0.2.1", "zod": "^3.23.8" } }, "sha512-ca2B7xR43tVoQ8XxBvha58DXwIH8cIyKQl6lpOKGkPUrJuFoO4iCLlDiSDi2Ueh+yE1rMDPP/qveHdajgDX3WQ=="],
 
     "@atproto-labs/fetch": ["@atproto-labs/fetch@0.2.3", "", { "dependencies": { "@atproto-labs/pipe": "0.1.1" } }, "sha512-NZtbJOCbxKUFRFKMpamT38PUQMY0hX0p7TG5AEYOPhZKZEP7dHZ1K2s1aB8MdVH0qxmqX7nQleNrrvLf09Zfdw=="],
···
 
     "@atproto-labs/simple-store-memory": ["@atproto-labs/simple-store-memory@0.1.4", "", { "dependencies": { "@atproto-labs/simple-store": "0.3.0", "lru-cache": "^10.2.0" } }, "sha512-3mKY4dP8I7yKPFj9VKpYyCRzGJOi5CEpOLPlRhoJyLmgs3J4RzDrjn323Oakjz2Aj2JzRU/AIvWRAZVhpYNJHw=="],
 
-    "@atproto/api": ["@atproto/api@0.17.5", "", { "dependencies": { "@atproto/common-web": "^0.4.3", "@atproto/lexicon": "^0.5.1", "@atproto/syntax": "^0.4.1", "@atproto/xrpc": "^0.7.5", "await-lock": "^2.2.2", "multiformats": "^9.9.0", "tlds": "^1.234.0", "zod": "^3.23.8" } }, "sha512-AMm/XFfVJPpPznY0Dk4fvv6alVMrPFtPTyLk8U70wPjvJf4P52AGHXFUjWwoy6mvPHSJ+L1+3LWddzb4gdIMng=="],
-
     "@atproto/common-web": ["@atproto/common-web@0.4.3", "", { "dependencies": { "graphemer": "^1.4.0", "multiformats": "^9.9.0", "uint8arrays": "3.0.0", "zod": "^3.23.8" } }, "sha512-nRDINmSe4VycJzPo6fP/hEltBcULFxt9Kw7fQk6405FyAWZiTluYHlXOnU7GkQfeUK44OENG1qFTBcmCJ7e8pg=="],
 
     "@atproto/crypto": ["@atproto/crypto@0.4.4", "", { "dependencies": { "@noble/curves": "^1.7.0", "@noble/hashes": "^1.6.1", "uint8arrays": "3.0.0" } }, "sha512-Yq9+crJ7WQl7sxStVpHgie5Z51R05etaK9DLWYG/7bR5T4bhdcIgF6IfklLShtZwLYdVVj+K15s0BqW9a8PSDA=="],
···
     "@atproto/jwk-jose": ["@atproto/jwk-jose@0.1.11", "", { "dependencies": { "@atproto/jwk": "0.6.0", "jose": "^5.2.0" } }, "sha512-i4Fnr2sTBYmMmHXl7NJh8GrCH+tDQEVWrcDMDnV5DjJfkgT17wIqvojIw9SNbSL4Uf0OtfEv6AgG0A+mgh8b5Q=="],
 
     "@atproto/jwk-webcrypto": ["@atproto/jwk-webcrypto@0.2.0", "", { "dependencies": { "@atproto/jwk": "0.6.0", "@atproto/jwk-jose": "0.1.11", "zod": "^3.23.8" } }, "sha512-UmgRrrEAkWvxwhlwe30UmDOdTEFidlIzBC7C3cCbeJMcBN1x8B3KH+crXrsTqfWQBG58mXgt8wgSK3Kxs2LhFg=="],
-
-    "@atproto/lex-cli": ["@atproto/lex-cli@0.9.6", "", { "dependencies": { "@atproto/lexicon": "^0.5.1", "@atproto/syntax": "^0.4.1", "chalk": "^4.1.2", "commander": "^9.4.0", "prettier": "^3.2.5", "ts-morph": "^24.0.0", "yesno": "^0.4.0", "zod": "^3.23.8" }, "bin": { "lex": "dist/index.js" } }, "sha512-EedEKmURoSP735YwSDHsFrLOhZ4P2it8goCHv5ApWi/R9DFpOKOpmYfIXJ9MAprK8cw+yBnjDJbzpLJy7UXlTg=="],
 
     "@atproto/lexicon": ["@atproto/lexicon@0.5.1", "", { "dependencies": { "@atproto/common-web": "^0.4.3", "@atproto/syntax": "^0.4.1", "iso-datestring-validator": "^2.2.2", "multiformats": "^9.9.0", "zod": "^3.23.8" } }, "sha512-y8AEtYmfgVl4fqFxqXAeGvhesiGkxiy3CWoJIfsFDDdTlZUC8DFnZrYhcqkIop3OlCkkljvpSJi1hbeC1tbi8A=="],
 
···
 
     "@babel/types": ["@babel/types@7.28.5", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.28.5" } }, "sha512-qQ5m48eI/MFLQ5PxQj4PFaprjyCTLI37ElWMmNs0K8Lk3dVeOdNpB3ks8jc7yM5CDmVC73eMVk/trk3fgmrUpA=="],
 
+    "@badrap/valita": ["@badrap/valita@0.4.6", "", {}, "sha512-4kdqcjyxo/8RQ8ayjms47HCWZIF5981oE5nIenbfThKDxWXtEHKipAOWlflpPJzZx9y/JWYQkp18Awr7VuepFg=="],
+
     "@borewit/text-codec": ["@borewit/text-codec@0.1.1", "", {}, "sha512-5L/uBxmjaCIX5h8Z+uu+kA9BQLkc/Wl06UGR5ajNRxu+/XjonB5i8JpgFMrPj3LXTCPA0pv8yxUvbUi+QthGGA=="],
 
     "@elysiajs/cors": ["@elysiajs/cors@1.4.0", "", { "peerDependencies": { "elysia": ">= 1.4.0" } }, "sha512-pb0SCzBfFbFSYA/U40HHO7R+YrcXBJXOWgL20eSViK33ol1e20ru2/KUaZYo5IMUn63yaTJI/bQERuQ+77ND8g=="],
-
-    "@elysiajs/eden": ["@elysiajs/eden@1.4.4", "", { "peerDependencies": { "elysia": ">= 1.4.0-exp.0" } }, "sha512-/LVqflmgUcCiXb8rz1iRq9Rx3SWfIV/EkoNqDFGMx+TvOyo8QHAygFXAVQz7RHs+jk6n6mEgpI6KlKBANoErsQ=="],
 
     "@elysiajs/openapi": ["@elysiajs/openapi@1.4.11", "", { "peerDependencies": { "elysia": ">= 1.4.0" } }, "sha512-d75bMxYJpN6qSDi/z9L1S7SLk1S/8Px+cTb3W2lrYzU8uQ5E0kXdy1oOMJEfTyVsz3OA19NP9KNxE7ztSbLBLg=="],
 
···
 
     "@noble/hashes": ["@noble/hashes@1.8.0", "", {}, "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A=="],
 
+    "@noble/secp256k1": ["@noble/secp256k1@3.0.0", "", {}, "sha512-NJBaR352KyIvj3t6sgT/+7xrNyF9Xk9QlLSIqUGVUYlsnDTAUqY8LOmwpcgEx4AMJXRITQ5XEVHD+mMaPfr3mg=="],
+
     "@nodelib/fs.scandir": ["@nodelib/fs.scandir@2.1.5", "", { "dependencies": { "@nodelib/fs.stat": "2.0.5", "run-parallel": "^1.1.9" } }, "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g=="],
 
     "@nodelib/fs.stat": ["@nodelib/fs.stat@2.0.5", "", {}, "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A=="],
···
     "@npmcli/package-json": ["@npmcli/package-json@4.0.1", "", { "dependencies": { "@npmcli/git": "^4.1.0", "glob": "^10.2.2", "hosted-git-info": "^6.1.1", "json-parse-even-better-errors": "^3.0.0", "normalize-package-data": "^5.0.0", "proc-log": "^3.0.0", "semver": "^7.5.3" } }, "sha512-lRCEGdHZomFsURroh522YvA/2cVb9oPIJrjHanCJZkiasz1BzcnLr3tBJhlV7S86MBJBuAQ33is2D60YitZL2Q=="],
 
     "@npmcli/promise-spawn": ["@npmcli/promise-spawn@6.0.2", "", { "dependencies": { "which": "^3.0.0" } }, "sha512-gGq0NJkIGSwdbUt4yhdF8ZrmkGKVz9vAdVzpOfnom+V8PLSmSOVhZwbNvZZS1EYcJN5hzzKBxmmVVAInM6HQLg=="],
+
+    "@optique/core": ["@optique/core@0.6.2", "", {}, "sha512-HTxIHJ8xLOSZotiU6Zc5BCJv+SJ8DMYmuiQM+7tjF7RolJn/pdZNe7M78G3+DgXL9lIf82l8aGcilmgVYRQnGQ=="],
+
+    "@optique/run": ["@optique/run@0.6.2", "", { "dependencies": { "@optique/core": "0.6.2" } }, "sha512-ERksB5bHozwEUVlTPToIc8UjZZBOgLeBhFZYh2lgldUbNDt7LItzgcErsPq5au5i5IBmmyCti4+2A3x+MRI4Xw=="],
 
     "@pkgjs/parseargs": ["@pkgjs/parseargs@0.11.0", "", {}, "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg=="],
 
···
 
     "@sinclair/typebox": ["@sinclair/typebox@0.34.41", "", {}, "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g=="],
 
+    "@standard-schema/spec": ["@standard-schema/spec@1.0.0", "", {}, "sha512-m2bOd0f2RT9k8QJx1JN85cZYyH1RqFBdlwtkSlf4tBDYLCiiZnv1fIIwacK6cqwXavOydf0NPToMQgpKq+dVlA=="],
+
     "@tailwindcss/node": ["@tailwindcss/node@4.1.16", "", { "dependencies": { "@jridgewell/remapping": "^2.3.4", "enhanced-resolve": "^5.18.3", "jiti": "^2.6.1", "lightningcss": "1.30.2", "magic-string": "^0.30.19", "source-map-js": "^1.2.1", "tailwindcss": "4.1.16" } }, "sha512-BX5iaSsloNuvKNHRN3k2RcCuTEgASTo77mofW0vmeHkfrDWaoFAFvNHpEgtu0eqyypcyiBkDWzSMxJhp3AUVcw=="],
 
     "@tailwindcss/oxide": ["@tailwindcss/oxide@4.1.16", "", { "optionalDependencies": { "@tailwindcss/oxide-android-arm64": "4.1.16", "@tailwindcss/oxide-darwin-arm64": "4.1.16", "@tailwindcss/oxide-darwin-x64": "4.1.16", "@tailwindcss/oxide-freebsd-x64": "4.1.16", "@tailwindcss/oxide-linux-arm-gnueabihf": "4.1.16", "@tailwindcss/oxide-linux-arm64-gnu": "4.1.16", "@tailwindcss/oxide-linux-arm64-musl": "4.1.16", "@tailwindcss/oxide-linux-x64-gnu": "4.1.16", "@tailwindcss/oxide-linux-x64-musl": "4.1.16", "@tailwindcss/oxide-wasm32-wasi": "4.1.16", "@tailwindcss/oxide-win32-arm64-msvc": "4.1.16", "@tailwindcss/oxide-win32-x64-msvc": "4.1.16" } }, "sha512-2OSv52FRuhdlgyOQqgtQHuCgXnS8nFSYRp2tJ+4WZXKgTxqPy7SMSls8c3mPT5pkZ17SBToGM5LHEJBO7miEdg=="],
···
     "@tokenizer/inflate": ["@tokenizer/inflate@0.2.7", "", { "dependencies": { "debug": "^4.4.0", "fflate": "^0.8.2", "token-types": "^6.0.0" } }, "sha512-MADQgmZT1eKjp06jpI2yozxaU9uVs4GzzgSL+uEq7bVcJ9V1ZXQkeGNql1fsSI0gMy1vhvNTNbUqrx+pZfJVmg=="],
 
     "@tokenizer/token": ["@tokenizer/token@0.3.0", "", {}, "sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A=="],
-
-    "@ts-morph/common": ["@ts-morph/common@0.25.0", "", { "dependencies": { "minimatch": "^9.0.4", "path-browserify": "^1.0.1", "tinyglobby": "^0.2.9" } }, "sha512-kMnZz+vGGHi4GoHnLmMhGNjm44kGtKUXGnOvrKmMwAuvNjM/PgKVGfUnL7IDvK7Jb2QQ82jq3Zmp04Gy+r3Dkg=="],
 
     "@types/bun": ["@types/bun@1.3.1", "", { "dependencies": { "bun-types": "1.3.1" } }, "sha512-4jNMk2/K9YJtfqwoAa28c8wK+T7nvJFOjxI4h/7sORWcypRNxBpr+TPNaCfVWq70tLCJsqoFwcf0oI0JU/fvMQ=="],
 
···
 
     "array-flatten": ["array-flatten@1.1.1", "", {}, "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg=="],
 
-    "await-lock": ["await-lock@2.2.2", "", {}, "sha512-aDczADvlvTGajTDjcjpJMqRkOF6Qdz3YbPZm/PyW6tKPkx2hlYBzxMhEywM/tU72HrVZjgl5VCdRuMlA7pZ8Gw=="],
-
     "babel-dead-code-elimination": ["babel-dead-code-elimination@1.0.10", "", { "dependencies": { "@babel/core": "^7.23.7", "@babel/parser": "^7.23.6", "@babel/traverse": "^7.23.7", "@babel/types": "^7.23.6" } }, "sha512-DV5bdJZTzZ0zn0DC24v3jD7Mnidh6xhKa4GfKCbq3sfW8kaWhDdZjP3i81geA8T33tdYqWKw4D3fVv0CwEgKVA=="],
 
     "balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
···
 
     "clsx": ["clsx@2.1.1", "", {}, "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA=="],
 
-    "code-block-writer": ["code-block-writer@13.0.3", "", {}, "sha512-Oofo0pq3IKnsFtuHqSF7TqBfr71aeyZDVJ0HpmqB7FBM2qEigL0iPONSCZSO9pE9dZTAxANe5XHG9Uy0YMv8cg=="],
-
     "color-convert": ["color-convert@2.0.1", "", { "dependencies": { "color-name": "~1.1.4" } }, "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ=="],
 
     "color-name": ["color-name@1.1.4", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
 
-    "commander": ["commander@9.5.0", "", {}, "sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ=="],
-
     "compressible": ["compressible@2.0.18", "", { "dependencies": { "mime-db": ">= 1.43.0 < 2" } }, "sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg=="],
 
     "compression": ["compression@1.8.1", "", { "dependencies": { "bytes": "3.1.2", "compressible": "~2.0.18", "debug": "2.6.9", "negotiator": "~0.6.4", "on-headers": "~1.1.0", "safe-buffer": "5.2.1", "vary": "~1.1.2" } }, "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w=="],
···
     "eslint-scope": ["eslint-scope@8.4.0", "", { "dependencies": { "esrecurse": "^4.3.0", "estraverse": "^5.2.0" } }, "sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg=="],
 
     "eslint-visitor-keys": ["eslint-visitor-keys@4.2.1", "", {}, "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ=="],
+
+    "esm-env": ["esm-env@1.2.2", "", {}, "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA=="],
 
     "espree": ["espree@10.4.0", "", { "dependencies": { "acorn": "^8.15.0", "acorn-jsx": "^5.3.2", "eslint-visitor-keys": "^4.2.1" } }, "sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ=="],
 
···
 
     "interpret": ["interpret@1.4.0", "", {}, "sha512-agE4QfB2Lkp9uICn7BAqoscw4SZP9kTE2hxiFI3jBPmXJfdqiahTbUuKGsMoN2GtqL9AxhYioAcVvgsb1HvRbA=="],
 
-    "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
+    "ipaddr.js": ["ipaddr.js@2.2.0", "", {}, "sha512-Ag3wB2o37wslZS19hZqorUnrnzSkpOVy+IiiDEiTqNubEYpYuHWIf6K4psgN2ZWKExS4xhVCrRVfb/wfW8fWJA=="],
 
     "is-arrayish": ["is-arrayish@0.2.1", "", {}, "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg=="],
 
···
 
     "multiformats": ["multiformats@9.9.0", "", {}, "sha512-HoMUjhH9T8DDBNT+6xzkrd9ga/XiBI4xLr58LJACwK6G3HTOPeMz4nB4KJs33L2BelrIJa7P0VuNaVF3hMYfjg=="],
 
-    "nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],
+    "nanoid": ["nanoid@5.1.6", "", { "bin": { "nanoid": "bin/nanoid.js" } }, "sha512-c7+7RQ+dMB5dPwwCp4ee1/iV/q2P6aK1mTZcfr1BTuVlyW9hJYiMPybJCcnBlQtuSmTIWNeazm/zqNoZSSElBg=="],
 
     "napi-build-utils": ["napi-build-utils@2.0.0", "", {}, "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA=="],
 
···
 
     "parseurl": ["parseurl@1.3.3", "", {}, "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="],
 
-    "path-browserify": ["path-browserify@1.0.1", "", {}, "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g=="],
-
     "path-exists": ["path-exists@4.0.0", "", {}, "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w=="],
 
     "path-is-absolute": ["path-is-absolute@1.0.1", "", {}, "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg=="],
···
 
     "simple-get": ["simple-get@4.0.1", "", { "dependencies": { "decompress-response": "^6.0.0", "once": "^1.3.1", "simple-concat": "^1.0.0" } }, "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA=="],
 
+    "sonner": ["sonner@2.0.7", "", { "peerDependencies": { "react": "^18.0.0 || ^19.0.0 || ^19.0.0-rc", "react-dom": "^18.0.0 || ^19.0.0 || ^19.0.0-rc" } }, "sha512-W6ZN4p58k8aDKA4XPcx2hpIQXBRAgyiWVkYhT7CvK6D3iAu7xjvVyhQHg2/iaKJZ1XVJ4r7XuwGL+WGEK37i9w=="],
+
     "source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
     "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
···
 
     "tinyglobby": ["tinyglobby@0.2.15", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.3" } }, "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ=="],
 
-    "tlds": ["tlds@1.261.0", "", { "bin": { "tlds": "bin.js" } }, "sha512-QXqwfEl9ddlGBaRFXIvNKK6OhipSiLXuRuLJX5DErz0o0Q0rYxulWLdFryTkV5PkdZct5iMInwYEGe/eR++1AA=="],
-
     "to-regex-range": ["to-regex-range@5.0.1", "", { "dependencies": { "is-number": "^7.0.0" } }, "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ=="],
 
     "toidentifier": ["toidentifier@1.0.1", "", {}, "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="],
···
     "tree-kill": ["tree-kill@1.2.2", "", { "bin": { "tree-kill": "cli.js" } }, "sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A=="],
 
     "ts-api-utils": ["ts-api-utils@2.1.0", "", { "peerDependencies": { "typescript": ">=4.8.4" } }, "sha512-CUgTZL1irw8u29bzrOD/nH85jqyc74D6SshFgujOIA7osm2Rz7dYH77agkx7H4FBNxDq7Cjf+IjaX/8zwFW+ZQ=="],
-
-    "ts-morph": ["ts-morph@24.0.0", "", { "dependencies": { "@ts-morph/common": "~0.25.0", "code-block-writer": "^13.0.3" } }, "sha512-2OAOg/Ob5yx9Et7ZX4CvTCc0UFoZHwLEJ+dpDPSUi5TgwwlTlX47w+iFRrEwzUZwYACjq83cgjS/Da50Ga37uw=="],
 
     "tsconfck": ["tsconfck@3.1.6", "", { "peerDependencies": { "typescript": "^5.0.0" }, "optionalPeers": ["typescript"], "bin": { "tsconfck": "bin/tsconfck.js" } }, "sha512-ks6Vjr/jEw0P1gmOVwutM3B7fWxoWBL2KRDb1JfqGVawBmO5UsvmWOQFGHBPl5yxYz4eERr19E6L7NMv+Fej4w=="],
 
···
 
     "yargs-parser": ["yargs-parser@21.1.1", "", {}, "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw=="],
 
-    "yesno": ["yesno@0.4.0", "", {}, "sha512-tdBxmHvbXPBKYIg81bMCB7bVeDmHkRzk5rVJyYYXurwKkHq/MCd8rz4HSJUP7hW0H2NlXiq8IFiWvYKEHhlotA=="],
-
     "yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
 
-    "zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+    "zod": ["zod@4.1.12", "", {}, "sha512-JInaHOamG8pt5+Ey8kGmdcAcg3OL9reK8ltczgHTAwNhMys/6ThXHityHxVV2p3fkw/c+MAvBHFVYHFZDmjMCQ=="],
 
     "zod-validation-error": ["zod-validation-error@4.0.2", "", { "peerDependencies": { "zod": "^3.25.0 || ^4.0.0" } }, "sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ=="],
 
-    "@atproto-labs/fetch-node/ipaddr.js": ["ipaddr.js@2.2.0", "", {}, "sha512-Ag3wB2o37wslZS19hZqorUnrnzSkpOVy+IiiDEiTqNubEYpYuHWIf6K4psgN2ZWKExS4xhVCrRVfb/wfW8fWJA=="],
+    "@atproto-labs/did-resolver/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
+    "@atproto-labs/handle-resolver/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
     "@atproto-labs/simple-store-memory/lru-cache": ["lru-cache@10.4.3", "", {}, "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="],
 
+    "@atproto/common-web/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
+    "@atproto/did/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
+    "@atproto/jwk/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
+    "@atproto/jwk-webcrypto/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
+    "@atproto/lexicon/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
+    "@atproto/oauth-client/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
+    "@atproto/oauth-types/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
+    "@atproto/xrpc/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
     "@babel/core/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
     "@babel/helper-compilation-targets/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
···
 
     "@tailwindcss/oxide-wasm32-wasi/tslib": ["tslib@2.8.1", "", { "bundled": true }, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
 
-    "@ts-morph/common/minimatch": ["minimatch@9.0.5", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow=="],
-
     "@typescript-eslint/eslint-plugin/ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="],
 
     "@typescript-eslint/typescript-estree/minimatch": ["minimatch@9.0.5", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow=="],
···
 
     "dotenv-expand/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
 
-    "eslint-plugin-react-hooks/zod": ["zod@4.1.12", "", {}, "sha512-JInaHOamG8pt5+Ey8kGmdcAcg3OL9reK8ltczgHTAwNhMys/6ThXHityHxVV2p3fkw/c+MAvBHFVYHFZDmjMCQ=="],
-
     "express/cookie": ["cookie@0.7.1", "", {}, "sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w=="],
 
     "express/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],
···
 
     "hosted-git-info/lru-cache": ["lru-cache@7.18.3", "", {}, "sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA=="],
 
-    "kysely-codegen/zod": ["zod@4.1.12", "", {}, "sha512-JInaHOamG8pt5+Ey8kGmdcAcg3OL9reK8ltczgHTAwNhMys/6ThXHityHxVV2p3fkw/c+MAvBHFVYHFZDmjMCQ=="],
-
     "kysely-ctl/pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
 
     "micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
···
 
     "pkg-types/pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
 
+    "postcss/nanoid": ["nanoid@3.3.11", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w=="],
+
+    "proxy-addr/ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
+
     "rc/strip-json-comments": ["strip-json-comments@2.0.1", "", {}, "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ=="],
 
     "send/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],
···
     "@isaacs/cliui/wrap-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
 
     "@react-router/fs-routes/minimatch/brace-expansion": ["brace-expansion@2.0.2", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ=="],
-
-    "@ts-morph/common/minimatch/brace-expansion": ["brace-expansion@2.0.2", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ=="],
 
     "@typescript-eslint/typescript-estree/minimatch/brace-expansion": ["brace-expansion@2.0.2", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ=="],
 

lex.config.js

···
+import { defineLexiconConfig } from '@atcute/lex-cli'
+
+const LEX_ENV = process.env.LEX_ENV
+
+export default defineLexiconConfig({
+  files: ['lexicons/**/*.json'],
+  outdir:
+    LEX_ENV === 'server'
+      ? 'packages/server/src/xrpc/'
+      : 'packages/client/app/xrpc/',
+  imports: ['@atcute/atproto', '@atcute/bluesky']
+})

lexicons.json

···
 {
   "lexicons": [
-    "com.atproto.label.defs"
+    "com.atproto.label.defs",
+    "com.atproto.repo.getRecord",
+    "com.atproto.repo.listRecords",
+    "com.atproto.repo.createRecord",
+    "com.atproto.repo.putRecord",
+    "com.atproto.repo.deleteRecord"
   ]
 }

lexicons/app/wafrn/content/createPost.json

···
       },
       "output": {
         "encoding": "application/json",
-        "schema": { "type": "ref", "ref": "app.wafrn.content.post" }
+        "schema": {
+          "type": "object",
+          "required": ["post"],
+          "properties": {
+            "post": {
+              "type": "ref",
+              "ref": "app.wafrn.content.post"
+            }
+          }
+        }
       }
     }
   }

lexicons/com/atproto/label/defs.json

···
-{
-  "lexicon": 1,
-  "id": "com.atproto.label.defs",
-  "defs": {
-    "label": {
-      "type": "object",
-      "required": [
-        "src",
-        "uri",
-        "val",
-        "cts"
-      ],
-      "properties": {
-        "cid": {
-          "type": "string",
-          "format": "cid",
-          "description": "Optionally, CID specifying the specific version of 'uri' resource this label applies to."
-        },
-        "cts": {
-          "type": "string",
-          "format": "datetime",
-          "description": "Timestamp when this label was created."
-        },
-        "exp": {
-          "type": "string",
-          "format": "datetime",
-          "description": "Timestamp at which this label expires (no longer applies)."
-        },
-        "neg": {
-          "type": "boolean",
-          "description": "If true, this is a negation label, overwriting a previous label."
-        },
-        "sig": {
-          "type": "bytes",
-          "description": "Signature of dag-cbor encoded label."
-        },
-        "src": {
-          "type": "string",
-          "format": "did",
-          "description": "DID of the actor who created this label."
-        },
-        "uri": {
-          "type": "string",
-          "format": "uri",
-          "description": "AT URI of the record, repository (account), or other resource that this label applies to."
-        },
-        "val": {
-          "type": "string",
-          "maxLength": 128,
-          "description": "The short string name of the value or type of this label."
-        },
-        "ver": {
-          "type": "integer",
-          "description": "The AT Protocol version of the label object."
-        }
-      },
-      "description": "Metadata tag on an atproto resource (eg, repo or record)."
-    },
-    "selfLabel": {
-      "type": "object",
-      "required": [
-        "val"
-      ],
-      "properties": {
-        "val": {
-          "type": "string",
-          "maxLength": 128,
-          "description": "The short string name of the value or type of this label."
-        }
-      },
-      "description": "Metadata tag on an atproto record, published by the author within the record. Note that schemas should use #selfLabels, not #selfLabel."
-    },
-    "labelValue": {
-      "type": "string",
-      "knownValues": [
-        "!hide",
-        "!no-promote",
-        "!warn",
-        "!no-unauthenticated",
-        "dmca-violation",
-        "doxxing",
-        "porn",
-        "sexual",
-        "nudity",
-        "nsfl",
-        "gore"
-      ]
-    },
-    "selfLabels": {
-      "type": "object",
-      "required": [
-        "values"
-      ],
-      "properties": {
-        "values": {
-          "type": "array",
-          "items": {
-            "ref": "#selfLabel",
-            "type": "ref"
-          },
-          "maxLength": 10
-        }
-      },
-      "description": "Metadata tags on an atproto record, published by the author within the record."
-    },
-    "labelValueDefinition": {
-      "type": "object",
-      "required": [
-        "identifier",
-        "severity",
-        "blurs",
-        "locales"
-      ],
-      "properties": {
-        "blurs": {
-          "type": "string",
-          "description": "What should this label hide in the UI, if applied? 'content' hides all of the target; 'media' hides the images/video/audio; 'none' hides nothing.",
-          "knownValues": [
-            "content",
-            "media",
-            "none"
-          ]
-        },
-        "locales": {
-          "type": "array",
-          "items": {
-            "ref": "#labelValueDefinitionStrings",
-            "type": "ref"
-          }
-        },
-        "severity": {
-          "type": "string",
-          "description": "How should a client visually convey this label? 'inform' means neutral and informational; 'alert' means negative and warning; 'none' means show nothing.",
-          "knownValues": [
-            "inform",
-            "alert",
-            "none"
-          ]
-        },
-        "adultOnly": {
-          "type": "boolean",
-          "description": "Does the user need to have adult content enabled in order to configure this label?"
-        },
-        "identifier": {
-          "type": "string",
-          "maxLength": 100,
-          "description": "The value of the label being defined. Must only include lowercase ascii and the '-' character ([a-z-]+).",
-          "maxGraphemes": 100
-        },
-        "defaultSetting": {
-          "type": "string",
-          "default": "warn",
-          "description": "The default setting for this label.",
-          "knownValues": [
-            "ignore",
-            "warn",
-            "hide"
-          ]
-        }
-      },
-      "description": "Declares a label value and its expected interpretations and behaviors."
-    },
-    "labelValueDefinitionStrings": {
-      "type": "object",
-      "required": [
-        "lang",
-        "name",
-        "description"
-      ],
-      "properties": {
-        "lang": {
-          "type": "string",
-          "format": "language",
-          "description": "The code of the language these strings are written in."
-        },
-        "name": {
-          "type": "string",
-          "maxLength": 640,
-          "description": "A short human-readable name for the label.",
-          "maxGraphemes": 64
-        },
-        "description": {
-          "type": "string",
-          "maxLength": 100000,
-          "description": "A longer description of what the label means and why it might be applied.",
-          "maxGraphemes": 10000
-        }
-      },
-      "description": "Strings which describe the label in the UI, localized into a specific language."
-    }
-  }
-}

package.json

···
     "typecheck": "bun run --workspaces typecheck",
     "typecheck:server": "bun run --filter @watproto/server typecheck",
     "typecheck:client": "bun run --filter @watproto/client typecheck",
-    "lex-server": "bunx lex gen-server ./packages/server/src/xrpc ./lexicons/app/wafrn/**/*.json"
+    "lex": "bun run lex:client && bun run lex:server",
+    "lex:client": "LEX_ENV=client bunx --bun lex-cli generate -c lex.config.js",
+    "lex:server": "LEX_ENV=server bunx --bun lex-cli generate -c lex.config.js"
   },
   "devDependencies": {
-    "@atproto/lex-cli": "^0.9.6",
+    "@atcute/atproto": "^3.1.8",
+    "@atcute/bluesky": "^3.2.9",
+    "@atcute/lex-cli": "^2.3.1",
+    "@atcute/lexicons": "^1.2.2",
     "concurrently": "^9.2.1",
     "prettier": "^3.6.2",
     "typescript": "^5.9.3"

packages/client/app/components/FlashMessages.tsx

···
+import { useRootData } from '@www/lib/useRootData'
+import { useEffect } from 'react'
+import { toast, Toaster } from 'sonner'
+
+const NOTIFICATION_TIME = 2000 // show flash messages only for 2s
+
+export default function FlashMessages() {
+  const { message } = useRootData()
+  useEffect(() => {
+    if (message) {
+      const toastFn = toast[message.type]
+      if (toastFn) {
+        toastFn(message.message, {
+          duration: NOTIFICATION_TIME,
+          position: 'top-center'
+        })
+      }
+    }
+  }, [message])
+
+  return <Toaster />
+}

packages/client/app/components/UserMenu.tsx

···
-import { buildOauthLoginUrl } from '@www/lib/oauth'
 import type { RootData } from '@www/lib/useRootData'
 import clsx from 'clsx'
-import { Link } from 'react-router'
+import { useFetcher } from 'react-router'
+import { Link, Form } from 'react-router'
 
 export default function UserMenu({ user }: { user?: RootData['user'] }) {
   const avatar = user?.profile?.avatar
   const handle = user?.identity.handle
+  const fetcher = useFetcher()
 
-  function signUp() {
-    const loginUrl = buildOauthLoginUrl(window.location.origin)
-    window.location.replace(loginUrl)
+  function logout() {
+    fetcher.submit(
+      { action: 'logout' },
+      {
+        action: '/login',
+        method: 'POST'
+      }
+    )
   }
 
   return user ? (
···
             <a>Profile</a>
           </li>
           <li>
-            <a>Logout</a>
+            <button onClick={logout}>Logout</button>
           </li>
         </ul>
       </div>
···
       <Link to="/login" className="btn btn-ghost">
         Login
       </Link>
-      <button onClick={signUp} className="btn btn-accent">
-        Join us!
-      </button>
+      <Form action="/login" method="POST">
+        <button className="btn btn-accent">Join us!</button>
+      </Form>
     </div>
   )
 }

packages/client/app/lib/api.ts

···
-import { treaty } from '@elysiajs/eden'
-import { env } from './env'
-import { StatusError } from './https'
-import type { app } from '@api/index'
-
-export const apiClient = treaty<typeof app>(env.API_URL)
-
-export const sessionClient = (cookie: string) =>
-  treaty<typeof app>(env.API_URL, { headers: { Cookie: cookie } })
-
-export function wrapApiResponse<T>({
-  data,
-  error
-}: {
-  data: T
-  error: null | { status: number; value: string }
-}) {
-  if (error) {
-    throw new StatusError(error.status, error.value)
-  }
-  return data
-}

packages/client/app/lib/db.server.ts

···
+import { Database } from 'bun:sqlite'
+import { existsSync, mkdirSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { env } from './env.server'
+
+const dbPath = env.DB_PATH
+
+// Ensure database directory exists
+const dbDir = dirname(dbPath)
+if (!existsSync(dbDir)) {
+  mkdirSync(dbDir, { recursive: true })
+}
+
+// Initialize SQLite database
+const db = new Database(dbPath)
+
+// enable WAL mode: https://bun.com/docs/runtime/sqlite#wal-mode
+db.run('PRAGMA journal_mode = WAL;')
+
+// Check if we need to migrate the schema
+const tablesExist = db
+  .query(
+    `SELECT name FROM sqlite_master WHERE type='table' AND name='oauth_sessions'`
+  )
+  .get() as { name: string } | null
+
+if (!tablesExist) {
+  db.run(`
+    CREATE TABLE oauth_sessions (
+      key TEXT PRIMARY KEY,
+      session TEXT NOT NULL
+    );
+    CREATE TABLE oauth_states (
+      key TEXT PRIMARY KEY,
+      state TEXT NOT NULL
+    );
+  `)
+}
+
+export default db

packages/client/app/lib/env.server.ts

···
+import invariant from 'tiny-invariant'
+
+const CLIENT_URL = process.env.CLIENT_URL
+
+const API_URL = process.env.API_URL as string
+invariant(API_URL, 'API_URL must be defined')
+
+const DEFAULT_PDS_URL = process.env.DEFAULT_PDS_URL as string
+invariant(DEFAULT_PDS_URL, 'DEFAULT_PDS_URL must be defined')
+
+const DB_PATH = (process.env.DB_PATH as string) || './data/state.db'
+const IS_PROD = process.env.NODE_ENV === 'production'
+const PORT = Number(process.env.PORT || 5173)
+
+const AUTH_SECRET = process.env.AUTH_SECRET as string
+invariant(AUTH_SECRET, 'AUTH_SECRET must be defined')
+
+export const env = {
+  CLIENT_URL,
+  API_URL,
+  DEFAULT_PDS_URL,
+  DB_PATH,
+  IS_PROD,
+  PORT,
+  AUTH_SECRET
+}

packages/client/app/lib/env.ts

···
-import invariant from 'tiny-invariant'
-
-const API_URL = import.meta.env.VITE_API_URL as string
-invariant(API_URL, 'VITE_API_URL must be defined')
-
-const DEFAULT_PDS_URL = import.meta.env.VITE_DEFAULT_PDS_URL as string
-invariant(DEFAULT_PDS_URL, 'VITE_DEFAULT_PDS_URL must be defined')
-
-export const env = {
-  API_URL,
-  DEFAULT_PDS_URL
-}

packages/client/app/lib/idResolver.server.ts

···
+import { IdResolver, MemoryCache } from '@atproto/identity'
+
+const HOUR = 60e3 * 60
+const DAY = HOUR * 24
+
+export const idResolver = new IdResolver({
+  didCache: new MemoryCache(HOUR, DAY)
+})

packages/client/app/lib/oauth.server.ts

···
+import { env } from './env.server'
+import { oauthClient } from './oauthClient.server'
+import { commitSession, getSession } from './session.server'
+
+export async function buildOauthLoginUrl(
+  redirect_uri: string,
+  handle?: string
+) {
+  const url = await oauthClient.authorize(handle || env.DEFAULT_PDS_URL, {
+    state: redirect_uri
+  })
+  return url.toString()
+}
+
+export async function logout(request: Request) {
+  const cookie = request.headers.get('Cookie')
+  const session = await getSession(cookie)
+  const did = session.get('did')
+  if (did) {
+    try {
+      await oauthClient.revoke(did)
+    } catch (err) {
+      console.error(err)
+    }
+  }
+  // using an empty session with a flash to replace the old one
+  // effectively the same as calling `destroySession`
+  // according to this: https://sergiodxa.com/tutorials/destroy-user-session-and-while-setting-a-flash-message-in-remix
+  const newSession = await getSession()
+  newSession.flash('toast', {
+    type: 'info',
+    message: 'You have been logged out'
+  })
+  return commitSession(newSession)
+}

packages/client/app/lib/oauth.ts

···
-import { env } from './env'
-
-export function buildOauthLoginUrl(redirect_uri: string, handle?: string) {
-  const url = new URL(redirect_uri)
-  url.pathname = '/login'
-  const params = new URLSearchParams({
-    handle: handle || env.DEFAULT_PDS_URL,
-    redirect_uri: url.toString()
-  })
-  return `${env.API_URL}/oauth/login?${params.toString()}`
-}

packages/client/app/lib/oauthStore.server.ts

···
+import type {
+  NodeSavedSession,
+  NodeSavedSessionStore,
+  NodeSavedState,
+  NodeSavedStateStore
+} from '@atproto/oauth-client-node'
+import db from './db.server'
+
+export class StateStore implements NodeSavedStateStore {
+  async get(key: string): Promise<NodeSavedState | undefined> {
+    const result = db
+      .query<
+        { state: string },
+        string
+      >(`SELECT state FROM oauth_states WHERE key = ?`)
+      .get(key)
+    if (!result) return
+    return JSON.parse(result.state) as NodeSavedState
+  }
+  async set(key: string, val: NodeSavedState) {
+    db.query<void, [string, string]>(
+      'INSERT INTO oauth_states VALUES (?, ?)'
+    ).run(key, JSON.stringify(val))
+  }
+  async del(key: string) {
+    db.query<void, string>('DELETE FROM oauth_states WHERE key = ?').run(key)
+  }
+}
+
+export class SessionStore implements NodeSavedSessionStore {
+  async get(key: string): Promise<NodeSavedSession | undefined> {
+    const result = db
+      .query<
+        { session: string },
+        string
+      >(`SELECT session FROM oauth_sessions WHERE key = ?`)
+      .get(key)
+    if (!result) return
+    return JSON.parse(result.session) as NodeSavedSession
+  }
+  async set(key: string, val: NodeSavedSession) {
+    db.query<void, [string, string]>(
+      'INSERT INTO oauth_sessions VALUES (?, ?)'
+    ).run(key, JSON.stringify(val))
+  }
+  async del(key: string) {
+    db.query<void, string>('DELETE FROM oauth_sessions WHERE key = ?').run(key)
+  }
+}

packages/client/app/lib/session.server.ts

···
+import { createCookieSessionStorage } from 'react-router'
+import { env } from './env.server'
+import type { Did } from '@atcute/lexicons'
+
+type SessionData = {
+  did: Did
+}
+type SessionFlash = {
+  toast: {
+    type: 'error' | 'success' | 'info' | 'warning'
+    message: string
+  }
+}
+
+const { getSession, commitSession, destroySession } =
+  createCookieSessionStorage<SessionData, SessionFlash>({
+    cookie: {
+      name: '__session',
+      httpOnly: true,
+      sameSite: 'lax',
+      secure: true,
+      secrets: [env.AUTH_SECRET]
+    }
+  })
+
+export { getSession, commitSession, destroySession }
+
+export async function getFlashMessage(request: Request) {
+  const cookie = request.headers.get('Cookie')
+  const session = await getSession(cookie)
+  const message = session.get('toast')
+
+  return {
+    message,
+    newCookie: await commitSession(session)
+  }
+}

packages/client/app/lib/user.ts

···
-import { sessionClient, wrapApiResponse } from './api'
+import { idResolver } from './idResolver.server'
+import { StatusError } from './https'
+import { getSessionAgent, type XRPCLient } from '@www/lib/xprcClient'
+import type { Did } from '@atcute/lexicons'
 
 export async function getCurrentUser(request: Request) {
   try {
-    const cookie = request.headers.get('Cookie') || ''
-    const response = await sessionClient(cookie).oauth.me.get()
-    return wrapApiResponse(response)
+    const { client, did } = await getSessionAgent(request)
+    const identity = await idResolver.did.resolveAtprotoData(did)
+    const profile = await getProfile(client, did)
+    return { profile, identity }
   } catch (error) {
-    console.error('🚫 API error during auth check: \n', error)
+    const isStatusError =
+      error instanceof StatusError && [401, 403].includes(error.statusCode ?? 0)
+    const isErrorResponse =
+      error instanceof Response && [401, 403].includes(error.status)
+    const isUnauthorized = isStatusError || isErrorResponse
+    if (!isUnauthorized) {
+      console.error('🚫 API error during auth check: \n', error)
+    }
     return null
   }
 }
+
+export async function getProfile(agent: XRPCLient, did: Did) {
+  // if no 'app.bsky.actor.profile' record is found on the user's PDS, this method will not return an error
+  // instead it will return an empty skeleton of a profile record with "handle" set to "handle.invalid"
+  // const profile = await agent.getProfile(
+  //   didOrHandle ? { actor: didOrHandle } : undefined
+  // )
+  const profile = await agent.get('app.bsky.actor.getProfile', {
+    params: { actor: did }
+  })
+  if (!profile.ok) {
+    throw new Error('Failed to fetch profile')
+  }
+
+  const data = profile.data.handle === 'handle.invalid' ? null : profile.data
+  return data
+}

packages/client/app/lib/xprcClient.ts

···
+import { Client } from '@atcute/client'
+import { oauthClient } from '@www/lib/oauthClient.server'
+import { getSession } from '@www/lib/session.server'
+
+// magic import: this loads bluesky calls into the current atcute client
+import type {} from '@atcute/bluesky'
+
+export type XRPCLient = Awaited<ReturnType<typeof getSessionAgent>>['client']
+
+export async function getSessionAgent(request: Request) {
+  const sessionStore = await getSession(request.headers.get('Cookie'))
+  const did = sessionStore.get('did')
+  if (did) {
+    try {
+      const session = await oauthClient.restore(did)
+      const client = new Client({ handler: session.fetchHandler })
+      return { client, did }
+    } catch (err) {
+      throw new Response(`Cannot restore session: ${String(err)}`, {
+        status: 500
+      })
+    }
+  } else {
+    throw new Response('No session found', { status: 401 })
+  }
+}

packages/client/app/root.tsx

···
 import {
+  data,
   isRouteErrorResponse,
   Links,
   Meta,
···
 import './app.css'
 import { getCurrentUser } from './lib/user'
 import Header from './components/Header'
+import { Link } from 'react-router'
+import { getFlashMessage } from './lib/session.server'
+import FlashMessages from './components/FlashMessages'
 
 export const links: Route.LinksFunction = () => [
   { rel: 'preconnect', href: 'https://fonts.googleapis.com' },
···
 ]
 
 export async function loader({ request }: Route.LoaderArgs) {
+  const { message, newCookie } = await getFlashMessage(request)
   const user = await getCurrentUser(request)
-  return { user }
+  return data(
+    { user, message },
+    {
+      headers: { 'Set-Cookie': newCookie }
+    }
+  )
 }
 
 export function Layout({ children }: { children: React.ReactNode }) {
···
 export default function App() {
   return (
     <>
+      <FlashMessages />
       <Header />
       <Outlet />
     </>
···
   }
 
   return (
-    <main className="pt-16 p-4 container mx-auto">
-      <h1>{message}</h1>
-      <p>{details}</p>
+    <main className="mt-16 p-4 container mx-auto bg-error-content rounded-md">
+      <h1 className="text-lg text-error mb-2">{message}</h1>
+      <p className="text-error mb-2">{details}</p>
       {stack && (
-        <pre className="w-full p-4 overflow-x-auto">
+        <pre className="w-full p-4 overflow-x-auto border border-base-200">
           <code>{stack}</code>
         </pre>
       )}
+      <Link className="btn btn-error mt-2" to="/">
+        Go home
+      </Link>
     </main>
   )
 }

packages/client/app/routes/login.tsx

···
-import { buildOauthLoginUrl } from '@www/lib/oauth'
 import type { Route } from './+types/login'
-import { redirect, useSearchParams } from 'react-router'
+import { data, Form, redirect, useSearchParams } from 'react-router'
+import { buildOauthLoginUrl, logout } from '@www/lib/oauth.server'
 import { useRootData } from '@www/lib/useRootData'
 import { useNavigate } from 'react-router'
 import { useEffect, useRef } from 'react'
 
 export async function action({ request }: Route.ActionArgs) {
   const formData = await request.formData()
-  const handle = String(formData.get('handle'))
+  const action = formData.get('action')
+  if (action === 'logout') {
+    const cookie = await logout(request)
+    return data({ success: true }, { headers: { 'Set-Cookie': cookie } })
+  }
+
+  const handle = String(formData.get('handle') ?? '')
   const origin = new URL(request.url).origin
-  const loginUrl = buildOauthLoginUrl(origin, handle)
+  const loginUrl = await buildOauthLoginUrl(origin, handle)
   return redirect(loginUrl)
 }
 
···
   }, [loginSuccess, navigate])
 
   return (
-    <form method="POST" className="w-xs mx-auto mt-8">
+    <Form method="POST" className="w-xs mx-auto mt-8">
       <fieldset className="fieldset bg-base-200 p-4 rounded-box border border-base-300">
         <legend className="fieldset-legend">
           Login with your ATProto account
···
 
         <button className="btn btn-primary mt-4">Login</button>
       </fieldset>
-    </form>
+    </Form>
   )
 }

packages/client/app/routes/oauth.$.tsx

···
+import { oauthClient } from '@www/lib/oauthClient.server'
+import type { Route } from './+types/oauth.$'
+import keys from '@www/jwks.json'
+import { commitSession, getSession } from '@www/lib/session.server'
+import { redirect } from 'react-router'
+
+const publicKeys = keys.map((k) => {
+  const { kty, alg, kid, crv, x, y } = k
+  return { kty, alg, kid, crv, x, y }
+})
+
+export async function loader({ params, request }: Route.LoaderArgs) {
+  const path = params['*']
+  if (path === 'jwks.json') {
+    return publicKeys
+  }
+  if (path === 'client-metadata.json') {
+    return oauthClient.clientMetadata
+  }
+  if (path === 'callback') {
+    const sessionStore = await getSession(request.headers.get('Cookie'))
+    try {
+      const params = new URL(request.url).searchParams
+      const { session, state } = await oauthClient.callback(params)
+      sessionStore.set('did', session.did)
+      sessionStore.flash('toast', {
+        type: 'success',
+        message: 'You are now logged in'
+      })
+      const redirectUrl = new URL(state ?? '/', request.url).toString()
+      return redirect(redirectUrl, {
+        headers: {
+          'Set-Cookie': await commitSession(sessionStore)
+        }
+      })
+    } catch (err) {
+      console.error(err)
+      sessionStore.flash('toast', {
+        type: 'error',
+        message: 'Invalid credentials'
+      })
+      return redirect('/login', {
+        headers: {
+          'Set-Cookie': await commitSession(sessionStore)
+        }
+      })
+    }
+  }
+
+  return new Response('Not found', { status: 404 })
+}

packages/client/app/xrpc/index.ts

···
+export * as AppWafrnContentCreatePost from "./types/app/wafrn/content/createPost.js";
+export * as AppWafrnContentPost from "./types/app/wafrn/content/post.js";

packages/client/app/xrpc/types/app/wafrn/content/createPost.ts

···
+import type {} from "@atcute/lexicons";
+import * as v from "@atcute/lexicons/validations";
+import type {} from "@atcute/lexicons/ambient";
+import * as AppWafrnContentPost from "./post.js";
+import * as ComAtprotoLabelDefs from "@atcute/atproto/types/label/defs";
+
+const _mainSchema = /*#__PURE__*/ v.procedure("app.wafrn.content.createPost", {
+  params: null,
+  input: {
+    type: "lex",
+    schema: /*#__PURE__*/ v.object({
+      contentMarkdown: /*#__PURE__*/ v.string(),
+      contentWarning: /*#__PURE__*/ v.optional(/*#__PURE__*/ v.string()),
+      get labels() {
+        return /*#__PURE__*/ v.optional(
+          /*#__PURE__*/ v.variant([ComAtprotoLabelDefs.selfLabelsSchema]),
+        );
+      },
+      tags: /*#__PURE__*/ v.optional(
+        /*#__PURE__*/ v.array(/*#__PURE__*/ v.string()),
+      ),
+      /**
+       * @default "public"
+       */
+      visibility: /*#__PURE__*/ v.optional(
+        /*#__PURE__*/ v.string<
+          "followers" | "mentioned" | "public" | (string & {})
+        >(),
+        "public",
+      ),
+    }),
+  },
+  output: {
+    type: "lex",
+    schema: /*#__PURE__*/ v.object({
+      get post() {
+        return AppWafrnContentPost.mainSchema;
+      },
+    }),
+  },
+});
+
+type main$schematype = typeof _mainSchema;
+
+export interface mainSchema extends main$schematype {}
+
+export const mainSchema = _mainSchema as mainSchema;
+
+export interface $params {}
+export interface $input extends v.InferXRPCBodyInput<mainSchema["input"]> {}
+export interface $output extends v.InferXRPCBodyInput<mainSchema["output"]> {}
+
+declare module "@atcute/lexicons/ambient" {
+  interface XRPCProcedures {
+    "app.wafrn.content.createPost": mainSchema;
+  }
+}

packages/client/app/xrpc/types/app/wafrn/content/post.ts

···
+import type {} from "@atcute/lexicons";
+import * as v from "@atcute/lexicons/validations";
+import type {} from "@atcute/lexicons/ambient";
+import * as ComAtprotoLabelDefs from "@atcute/atproto/types/label/defs";
+
+const _mainSchema = /*#__PURE__*/ v.record(
+  /*#__PURE__*/ v.tidString(),
+  /*#__PURE__*/ v.object({
+    $type: /*#__PURE__*/ v.literal("app.wafrn.content.post"),
+    get content() {
+      return /*#__PURE__*/ v.variant([
+        postContentSchema,
+        postEncryptedContentSchema,
+      ]);
+    },
+    /**
+     * @default "public"
+     */
+    visibility: /*#__PURE__*/ v.optional(
+      /*#__PURE__*/ v.string<
+        "followers" | "mentioned" | "public" | (string & {})
+      >(),
+      "public",
+    ),
+  }),
+);
+const _postContentSchema = /*#__PURE__*/ v.object({
+  $type: /*#__PURE__*/ v.optional(
+    /*#__PURE__*/ v.literal("app.wafrn.content.post#postContent"),
+  ),
+  contentHTML: /*#__PURE__*/ v.string(),
+  contentMarkdown: /*#__PURE__*/ v.string(),
+  contentWarning: /*#__PURE__*/ v.optional(/*#__PURE__*/ v.string()),
+  createdAt: /*#__PURE__*/ v.datetimeString(),
+  get labels() {
+    return /*#__PURE__*/ v.optional(
+      /*#__PURE__*/ v.variant([ComAtprotoLabelDefs.selfLabelsSchema]),
+    );
+  },
+  tags: /*#__PURE__*/ v.optional(
+    /*#__PURE__*/ v.array(/*#__PURE__*/ v.string()),
+  ),
+  updatedAt: /*#__PURE__*/ v.optional(/*#__PURE__*/ v.datetimeString()),
+});
+const _postEncryptedContentSchema = /*#__PURE__*/ v.object({
+  $type: /*#__PURE__*/ v.optional(
+    /*#__PURE__*/ v.literal("app.wafrn.content.post#postEncryptedContent"),
+  ),
+  encryptedContent: /*#__PURE__*/ v.string(),
+  /**
+   * @minimum 0
+   */
+  keyVersion: /*#__PURE__*/ v.integer(),
+});
+
+type main$schematype = typeof _mainSchema;
+type postContent$schematype = typeof _postContentSchema;
+type postEncryptedContent$schematype = typeof _postEncryptedContentSchema;
+
+export interface mainSchema extends main$schematype {}
+export interface postContentSchema extends postContent$schematype {}
+export interface postEncryptedContentSchema
+  extends postEncryptedContent$schematype {}
+
+export const mainSchema = _mainSchema as mainSchema;
+export const postContentSchema = _postContentSchema as postContentSchema;
+export const postEncryptedContentSchema =
+  _postEncryptedContentSchema as postEncryptedContentSchema;
+
+export interface Main extends v.InferInput<typeof mainSchema> {}
+export interface PostContent extends v.InferInput<typeof postContentSchema> {}
+export interface PostEncryptedContent
+  extends v.InferInput<typeof postEncryptedContentSchema> {}
+
+declare module "@atcute/lexicons/ambient" {
+  interface Records {
+    "app.wafrn.content.post": mainSchema;
+  }
+}

packages/client/package.json

···
     "typecheck": "bunx --bun react-router typegen && tsc"
   },
   "dependencies": {
-    "@elysiajs/eden": "1.4.4",
+    "@atcute/client": "^4.0.5",
+    "@atproto/identity": "^0.4.9",
+    "@atproto/oauth-client-node": "^0.3.10",
     "@react-router/fs-routes": "^7.9.4",
     "@react-router/node": "^7.9.2",
     "@react-router/serve": "^7.9.2",
···
     "react": "^19.1.1",
     "react-dom": "^19.1.1",
     "react-router": "^7.9.2",
+    "sonner": "^2.0.7",
     "tiny-invariant": "^1.3.3"
   },
   "devDependencies": {
···
     "@types/node": "22",
     "@types/react": "^19.1.13",
     "@types/react-dom": "^19.1.9",
-    "elysia": "1.4.13",
     "eslint": "^9.36.0",
     "eslint-config-flat-gitignore": "^2.1.0",
     "eslint-plugin-react-hooks": "^7.0.1",

packages/client/react-router.config.ts

···
-import type { Config } from "@react-router/dev/config";
+import type { Config } from '@react-router/dev/config'
 
 export default {
   // Config options...
   // Server-side render by default, to enable SPA mode set this to `false`
-  ssr: true,
-} satisfies Config;
+  ssr: true
+} satisfies Config

packages/client/vite.config.ts

···
 export default defineConfig({
   plugins: [tailwindcss(), reactRouter(), tsconfigPaths()],
   server: {
+    port: Number(import.meta.env.PORT || 5173),
     host: '127.0.0.1'
   }
 })

packages/server/package.json

···
     "typecheck": "bunx --bun tsc --noEmit"
   },
   "dependencies": {
-    "@atproto/api": "^0.17.3",
-    "@atproto/identity": "^0.4.9",
-    "@atproto/oauth-client-node": "^0.3.9",
+    "@atcute/xrpc-server": "^0.1.3",
     "@elysiajs/cors": "1.4.0",
     "@elysiajs/openapi": "1.4.11",
     "elysia": "1.4.13",

packages/server/src/db/migrations/001-oauth-state.ts

···
-import type { Kysely } from 'kysely'
-
-// `any` is required here since migrations should be frozen in time. alternatively, keep a "snapshot" db interface.
-export async function up(db: Kysely<any>): Promise<void> {
-  await db.schema
-    .createTable('oauth_sessions')
-    .addColumn('key', 'text', (col) => col.primaryKey())
-    .addColumn('session', 'text', (col) => col.notNull())
-    .execute()
-  await db.schema
-    .createTable('oauth_states')
-    .addColumn('key', 'text', (col) => col.primaryKey())
-    .addColumn('state', 'text', (col) => col.notNull())
-    .execute()
-}
-
-// `any` is required here since migrations should be frozen in time. alternatively, keep a "snapshot" db interface.
-export async function down(db: Kysely<any>): Promise<void> {
-  await db.schema.dropTable('oauth_states').execute()
-  await db.schema.dropTable('oauth_sessions').execute()
-}

packages/server/src/db/migrations/1761604662090_app_session.ts

···
-import { sql, type Kysely } from 'kysely'
-
-// `any` is required here since migrations should be frozen in time. alternatively, keep a "snapshot" db interface.
-export async function up(db: Kysely<any>): Promise<void> {
-  await db.schema
-    .createTable('app_sessions')
-    .addColumn('id', 'text', (col) => col.primaryKey().notNull())
-    .addColumn('account_did', 'text', (col) =>
-      col.references('accounts.did').onDelete('cascade').notNull()
-    )
-    .addColumn('data', 'text', (col) => col.notNull())
-    .addColumn('created_at', 'integer', (col) =>
-      col.notNull().defaultTo(sql`(unixepoch() * 1000)`)
-    )
-    .addColumn('expires_at', 'integer', (col) =>
-      col.notNull().defaultTo(sql`((unixepoch() + 7 * 24 * 60 * 60) * 1000)`)
-    )
-    .execute()
-
-  // Add index for faster lookups and cleanup
-  await db.schema
-    .createIndex('app_sessions_expires_at_index')
-    .on('app_sessions')
-    .column('expires_at')
-    .execute()
-
-  await db.schema
-    .createIndex('app_sessions_account_did_index')
-    .on('app_sessions')
-    .column('account_did')
-    .execute()
-}
-
-// `any` is required here since migrations should be frozen in time. alternatively, keep a "snapshot" db interface.
-export async function down(db: Kysely<any>): Promise<void> {
-  await db.schema.dropIndex('app_sessions_expires_at_index').execute()
-  await db.schema.dropIndex('app_sessions_account_did_index').execute()
-  await db.schema.dropTable('app_sessions').execute()
-}

packages/server/src/db/schema.d.ts

···
-/**
- * This file was generated by kysely-codegen.
- * Please do not edit it manually.
- */
-
-import type { ColumnType } from "kysely";
-
-export type Generated<T> = T extends ColumnType<infer S, infer I, infer U>
-  ? ColumnType<S, I | undefined, U>
-  : ColumnType<T, T | undefined, T>;
-
-export interface Accounts {
-  active: Generated<number>;
-  did: string;
-  first_seen_at: Generated<number>;
-  handle: string;
-  last_login_at: Generated<number>;
-  role: Generated<string>;
-  status: string | null;
-}
-
-export interface AppSessions {
-  account_did: string;
-  created_at: Generated<number>;
-  data: string;
-  expires_at: Generated<number>;
-  id: string;
-}
-
-export interface OauthSessions {
-  key: string | null;
-  session: string;
-}
-
-export interface OauthStates {
-  key: string | null;
-  state: string;
-}
-
-export interface DB {
-  accounts: Accounts;
-  app_sessions: AppSessions;
-  oauth_sessions: OauthSessions;
-  oauth_states: OauthStates;
-}

packages/server/src/index.ts

···
 import cors from '@elysiajs/cors'
 import { migrateDBToLatest } from './db/db'
 import env from './lib/env'
-import oauthRoutes from './oauth/routes'
-import { cleanupExpiredSessions } from './lib/session'
+import { xrpcServer } from './lib/xrpcServer'
 
 // Ensure latest migration is in database
 await migrateDBToLatest()
 
-// Cleanup expired sessions on startup
-const deletedCount = await cleanupExpiredSessions()
-if (deletedCount > 0) {
-  console.log(`🧹 Cleaned up ${deletedCount} expired session(s)`)
-}
-
 export const app = new Elysia()
-  .use(
-    cors({
-      origin: '*',
-      credentials: true,
-      allowedHeaders: ['Content-Type', 'Authorization'],
-      methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS']
-    })
-  )
+  .use(cors())
   .use(
     openapi({
       references: fromTypes('src/index.ts', {
···
       })
     })
   )
-  .use(oauthRoutes)
   .get('/', () => ({
     version: pkg.version,
     name: pkg.name
   }))
+  .mount(xrpcServer.fetch)
   .listen(env.PORT)
 
 console.log(

packages/server/src/lib/env.ts

···
 const DATABASE_URL = process.env.DATABASE_URL || ':memory:'
 invariant(DATABASE_URL, 'process.env.DATABASE_URL is required')
 
-const AUTH_SECRET = process.env.AUTH_SECRET
-invariant(AUTH_SECRET, 'process.env.AUTH_SECRET is required')
-
-// BASE_URL can be undefined
-const BASE_URL = process.env.BASE_URL
-
-const ADMIN_EMAIL = process.env.ADMIN_EMAIL || '[e-mail]'
-invariant(ADMIN_EMAIL, 'process.env.ADMIN_EMAIL is required')
-
-const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'adminpassword'
-invariant(ADMIN_PASSWORD, 'process.env.ADMIN_PASSWORD is required')
-
-const ALLOWED_REDIRECT_ORIGINS = process.env.ALLOWED_REDIRECT_ORIGINS
-invariant(
-  ALLOWED_REDIRECT_ORIGINS,
-  'process.env.ALLOWED_REDIRECT_ORIGINS is required'
-)
-
 const IS_PROD = process.env.NODE_ENV === 'production'
 
 export default {
   PORT,
   DATABASE_URL,
-  AUTH_SECRET,
-  BASE_URL,
-  ADMIN_EMAIL,
-  ADMIN_PASSWORD,
-  ALLOWED_REDIRECT_ORIGINS,
   IS_PROD
 }

packages/server/src/lib/idresolver.ts

···
-import { IdResolver, MemoryCache } from '@atproto/identity'
-
-const HOUR = 60e3 * 60
-const DAY = HOUR * 24
-
-export const idResolver = new IdResolver({
-  didCache: new MemoryCache(HOUR, DAY),
-})
-
-// export function createIdResolver() {
-//   return new IdResolver({
-//     didCache: new MemoryCache(HOUR, DAY),
-//   })
-// }
-
-// export type BidirectionalResolver = ReturnType<
-//   typeof createBidirectionalResolver
-// >
-
-// export function createBidirectionalResolver(resolver: IdResolver) {
-//   return {
-//     async resolveHandleToDid(handle: string) {
-//       const resolvedDid = await resolver.handle.resolve(handle)
-//       if (!resolvedDid) {
-//         return undefined
-//       }
-//       const didDoc = await resolver.did.resolveAtprotoData(resolvedDid)
-//       return didDoc
-//     },
-
-//     async resolveDidToHandle(did: string) {
-//       const didDoc = await resolver.did.resolveAtprotoData(did)
-//       const resolvedHandle = await resolver.handle.resolve(didDoc.handle)
-//       if (resolvedHandle === did) {
-//         return didDoc.handle
-//       }
-//       return did
-//     },
-
-//     async resolveDidsToHandles(dids: string[]) {
-//       const didHandleMap: Record<string, string> = {}
-//       const resolves = await Promise.all(
-//         dids.map((did) => this.resolveDidToHandle(did).catch((_) => did)),
-//       )
-//       for (let i = 0; i < dids.length; i++) {
-//         didHandleMap[dids[i]] = resolves[i]
-//       }
-//       return didHandleMap
-//     },
-//   }
-// }

packages/server/src/lib/middleware.ts

···
-import { Elysia } from 'elysia'
-import { getSession, refreshSession, type SessionData } from './session'
-
-/**
- * Auth plugin with Macro for declarative authentication
- *
- * Usage:
- *   const app = new Elysia()
- *     .use(authMacro)
- *     .get('/profile', ({ session }) => session.account, {
- *       auth: true
- *     })
- *     .get('/admin', ({ session }) => 'admin area', {
- *       auth: 'admin'
- *     })
- */
-export const authMacro = new Elysia({ name: 'auth' }).macro({
-  auth: (enabled: boolean | 'admin') => ({
-    async resolve({ cookie, status }) {
-      if (!enabled) {
-        return
-      }
-
-      const sessionId = cookie.session?.value as string
-
-      if (!sessionId) {
-        return status(401, 'Unauthorized: No session cookie')
-      }
-
-      const session = await getSession(sessionId)
-
-      if (!session) {
-        return status(401, 'Unauthorized: Invalid or expired session')
-      }
-
-      // Check if account is active
-      if (!session.account.active) {
-        return status(403, 'Forbidden: Account is inactive')
-      }
-
-      if (enabled === 'admin' && session.account.role !== 'admin') {
-        return status(403, 'Forbidden: Admin role required')
-      }
-
-      // Refresh session if needed (sliding window)
-      await refreshSession(sessionId)
-
-      return { session }
-    }
-  })
-})

packages/server/src/lib/profile.ts

···
-import { Agent } from '@atproto/api'
-import type { ProfileViewDetailed } from '@atproto/api/dist/client/types/app/bsky/actor/defs'
-
-export function parseProfile(profile: ProfileViewDetailed) {
-  return profile.handle !== 'handle.invalid' ? null : profile
-}
-
-export async function getProfile(agent: Agent, didOrHandle: string) {
-  // if no 'app.bsky.actor.profile' record is found on the user's PDS, this method will not return an error
-  // instead it will return an empty skeleton of a profile record with "handle" set to "handle.invalid"
-  const profile = await agent.getProfile({ actor: didOrHandle })
-  if (!profile.success) {
-    throw new Error('Failed to fetch profile')
-  }
-
-  const data = profile.data.handle === 'handle.invalid' ? null : profile.data
-  return data
-}

packages/server/src/lib/redirect-validator.ts

···
-import env from '@api/lib/env'
-
-/**
- * Validates that a redirect URI is allowed
- * Prevents open redirect vulnerabilities by checking against whitelist
- *
- * @param uri - The redirect URI to validate
- * @returns true if the URI's origin is in the whitelist
- */
-export function isAllowedRedirectUri(uri: string): boolean {
-  try {
-    const url = new URL(uri)
-    const allowedOrigins = env.ALLOWED_REDIRECT_ORIGINS.split(',').map((o) =>
-      o.trim()
-    )
-    return allowedOrigins.includes(url.origin)
-  } catch {
-    // Invalid URL format
-    return false
-  }
-}
-
-const DEFAULT_LOCAL_REDIRECT_URI = 'http://127.0.0.1:5173'
-
-/**
- * Gets the default redirect URI for the environment
- * Uses the first allowed origin in the whitelist
- *
- * @returns The default redirect URI
- */
-export function getDefaultRedirectUri(): string {
-  const allowed = env.ALLOWED_REDIRECT_ORIGINS.split(',').map((o) => o.trim())
-  return allowed[0] || DEFAULT_LOCAL_REDIRECT_URI
-}
-
-export function parseRedirectState(state: string | null) {
-  let defaultUri = getDefaultRedirectUri()
-  if (!state) {
-    return defaultUri
-  }
-
-  try {
-    const stateData = JSON.parse(state) as {
-      returnTo: string
-      timestamp: number
-    }
-    if (!stateData.returnTo) {
-      return defaultUri
-    }
-
-    // Re-validate even though we validated on login
-    // (defense in depth - in case state was tampered with)
-    if (!isAllowedRedirectUri(stateData.returnTo)) {
-      console.warn('State contained invalid redirect_uri:', stateData.returnTo)
-      return defaultUri
-    }
-
-    return stateData.returnTo
-  } catch (error) {
-    console.error('Failed to parse OAuth state:', error)
-    return defaultUri
-  }
-}

packages/server/src/lib/session.ts

···
-import { db } from '@api/db/db'
-
-// Session configuration
-const SESSION_DURATION = 7 * 24 * 60 * 60 * 1000 // 7 days in milliseconds
-const REFRESH_THRESHOLD = 0.5 // Refresh if >50% time elapsed
-
-export interface SessionData {
-  id: string
-  account: {
-    did: string
-    handle: string
-    role: string
-    active: boolean
-  }
-  created_at: number
-  expires_at: number
-}
-
-/**
- * Create a new app session for a user
- * @param accountDid - The user's DID
- * @param data - Optional additional data to store (will be merged with account data)
- * @returns Session UUID
- */
-export async function createSession(
-  accountDid: string,
-  data?: object
-): Promise<string> {
-  const sessionId = crypto.randomUUID()
-  const now = Date.now()
-  const expiresAt = now + SESSION_DURATION
-
-  // Get account data
-  const account = await db
-    .selectFrom('accounts')
-    .select(['did', 'handle', 'role', 'active'])
-    .where('did', '=', accountDid)
-    .executeTakeFirst()
-
-  if (!account) {
-    throw new Error('Account not found')
-  }
-
-  // Store session data as JSON
-  const sessionData = {
-    did: account.did,
-    handle: account.handle,
-    role: account.role,
-    active: Boolean(account.active),
-    ...data
-  }
-
-  await db
-    .insertInto('app_sessions')
-    .values({
-      id: sessionId,
-      account_did: accountDid,
-      data: JSON.stringify(sessionData),
-      created_at: now,
-      expires_at: expiresAt
-    })
-    .execute()
-
-  return sessionId
-}
-
-/**
- * Get session data with fresh account information
- * @param sessionId - Session UUID
- * @returns Session data with account info, or null if not found/expired
- */
-export async function getSession(
-  sessionId: string
-): Promise<SessionData | null> {
-  const now = Date.now()
-
-  // Get session joined with account to ensure fresh data
-  const result = await db
-    .selectFrom('app_sessions')
-    .innerJoin('accounts', 'accounts.did', 'app_sessions.account_did')
-    .select([
-      'app_sessions.id',
-      'app_sessions.created_at',
-      'app_sessions.expires_at',
-      'accounts.did',
-      'accounts.handle',
-      'accounts.role',
-      'accounts.active'
-    ])
-    .where('app_sessions.id', '=', sessionId)
-    .where('app_sessions.expires_at', '>', now)
-    .executeTakeFirst()
-
-  if (!result) {
-    return null
-  }
-
-  return {
-    id: result.id,
-    account: {
-      did: result.did,
-      handle: result.handle,
-      role: result.role,
-      active: Boolean(result.active)
-    },
-    created_at: result.created_at,
-    expires_at: result.expires_at
-  }
-}
-
-/**
- * Refresh session expiration (sliding window)
- * Only refreshes if more than REFRESH_THRESHOLD of time has elapsed
- * @param sessionId - Session UUID
- */
-export async function refreshSession(sessionId: string): Promise<void> {
-  const session = await db
-    .selectFrom('app_sessions')
-    .select(['created_at', 'expires_at'])
-    .where('id', '=', sessionId)
-    .executeTakeFirst()
-
-  if (!session) {
-    return
-  }
-
-  const now = Date.now()
-  const elapsed = now - session.created_at
-  const total = session.expires_at - session.created_at
-
-  // Only refresh if more than threshold has elapsed
-  if (elapsed / total > REFRESH_THRESHOLD) {
-    const newExpiresAt = now + SESSION_DURATION
-
-    await db
-      .updateTable('app_sessions')
-      .set({ expires_at: newExpiresAt })
-      .where('id', '=', sessionId)
-      .execute()
-  }
-}
-
-/**
- * Delete a single session (logout)
- * @param sessionId - Session UUID
- */
-export async function deleteSession(sessionId: string): Promise<void> {
-  await db.deleteFrom('app_sessions').where('id', '=', sessionId).execute()
-}
-
-/**
- * Delete all sessions for a user (revoke all)
- * @param accountDid - User's DID
- * @returns Number of sessions deleted
- */
-export async function deleteAllUserSessions(
-  accountDid: string
-): Promise<number> {
-  const result = await db
-    .deleteFrom('app_sessions')
-    .where('account_did', '=', accountDid)
-    .executeTakeFirst()
-
-  return Number(result.numDeletedRows)
-}
-
-/**
- * Clean up expired sessions
- * Should be run periodically (cron job or on startup)
- * @returns Number of sessions deleted
- */
-export async function cleanupExpiredSessions(): Promise<number> {
-  const now = Date.now()
-
-  const result = await db
-    .deleteFrom('app_sessions')
-    .where('expires_at', '<', now)
-    .executeTakeFirst()
-
-  return Number(result.numDeletedRows)
-}

packages/server/src/lib/xrpcServer.ts

···
+import { XRPCRouter, json } from '@atcute/xrpc-server'
+import { cors } from '@atcute/xrpc-server/middlewares/cors'
+import { AppWafrnContentCreatePost } from '../xrpc/index.js'
+
+const xrpcServer = new XRPCRouter({ middlewares: [cors()] })
+
+xrpcServer.add(AppWafrnContentCreatePost.mainSchema, {
+  async handler({ input }) {
+    return json({
+      post: {
+        visibility: 'public',
+        $type: 'app.wafrn.content.post',
+        content: {
+          $type: 'app.wafrn.content.post#postEncryptedContent',
+          encryptedContent: '',
+          keyVersion: 1
+        }
+      }
+    })
+  }
+})
+
+export { xrpcServer }

packages/server/src/oauth/client.ts packages/client/app/lib/oauthClient.server.ts

···
 import { JoseKey, NodeOAuthClient } from '@atproto/oauth-client-node'
-import type { Db } from '@api/db/db'
-import { SessionStore, StateStore } from './storage'
-import keys from '@api/../jwks.json'
-import env from '@api/lib/env'
+import { env } from './env.server'
+import keys from '@www/jwks.json'
+import { SessionStore, StateStore } from './oauthStore.server'
+import pkg from '@www/../package.json'
 
 const keyset = await Promise.all(
   keys.map((k) => JoseKey.fromImportable(JSON.stringify(k), k.kid))
 )
 
-export const createOAuthClient = (db: Db, baseUrl?: string) => {
+const createOAuthClient = (baseUrl?: string) => {
   const scope = 'atproto transition:generic' as const
 
   if (env.IS_PROD && !baseUrl) {
···
     redirect_uri: `${url}/oauth/callback`,
     scope
   })
+
   return new NodeOAuthClient({
     clientMetadata: {
-      client_name: 'ATProto Elysia App',
+      client_name: pkg.name,
       client_id: baseUrl
-        ? `${url}/client-metadata.json`
+        ? `${url}/oauth/client-metadata.json`
         : `http://localhost?${localParams.toString()}`,
       client_uri: url,
       redirect_uris: [`${url}/oauth/callback`],
···
       token_endpoint_auth_method: 'private_key_jwt',
       token_endpoint_auth_signing_alg: 'ES256',
       dpop_bound_access_tokens: true,
-      jwks_uri: `${url}/jwks.json`
+      jwks_uri: `${url}/oauth/jwks.json`
     },
-    stateStore: new StateStore(db),
-    sessionStore: new SessionStore(db),
+    stateStore: new StateStore(),
+    sessionStore: new SessionStore(),
     keyset
   })
 }
+
+export const oauthClient = createOAuthClient(env.CLIENT_URL)

packages/server/src/oauth/routes.ts

···
-import Elysia, { redirect, status } from 'elysia'
-import { createOAuthClient } from './client'
-import { Agent } from '@atproto/api'
-import { db } from '@api/db/db'
-import env from '@api/lib/env'
-import keys from '@api/../jwks.json'
-import { createOrUpdateAccount } from '@api/lib/account'
-import {
-  createSession,
-  deleteSession,
-  type SessionData
-} from '@api/lib/session'
-import { authMacro } from '@api/lib/middleware'
-import { getProfile } from '@api/lib/profile'
-import { idResolver } from '@api/lib/idresolver'
-import {
-  isAllowedRedirectUri,
-  getDefaultRedirectUri,
-  parseRedirectState
-} from '@api/lib/redirect-validator'
-
-const publicKeys = keys.map((k) => {
-  const { kty, alg, kid, crv, x, y } = k
-  return { kty, alg, kid, crv, x, y }
-})
-
-const oauthClient = createOAuthClient(db, env.BASE_URL)
-const oauthRoutes = new Elysia()
-  .use(authMacro)
-  .get('/jwks.json', () => publicKeys)
-  .get('/client-metadata.json', () => oauthClient.clientMetadata)
-  .get(
-    '/oauth/me',
-    async ({ session }) => {
-      const oauthSession = await oauthClient.restore(session.account.did)
-      if (!oauthSession) {
-        return status(401, 'OAuth session not found')
-      }
-
-      const agent = new Agent(oauthSession)
-      const identity = await idResolver.did.resolveAtprotoData(oauthSession.did)
-      const profile = await getProfile(agent, session.account.did)
-
-      return { profile, identity: identity }
-    },
-    {
-      auth: true
-    }
-  )
-  .get('/oauth/login', async (c) => {
-    const handle = c.query.handle
-    const redirectUri = c.query.redirect_uri
-
-    if (!handle) {
-      return status(400, 'Missing handle parameter')
-    }
-
-    // Validate redirect_uri if provided, otherwise use default
-    const returnTo = redirectUri || getDefaultRedirectUri()
-
-    if (!isAllowedRedirectUri(returnTo)) {
-      return status(
-        400,
-        'Invalid redirect_uri. Must be one of: ' + env.ALLOWED_REDIRECT_ORIGINS
-      )
-    }
-
-    // Embed redirect URI in OAuth state
-    const state = JSON.stringify({
-      returnTo,
-      timestamp: Date.now()
-    })
-
-    const url = await oauthClient.authorize(handle, { state })
-
-    return redirect(url.toString())
-  })
-  .get('/oauth/callback', async (c) => {
-    try {
-      const params = new URLSearchParams(c.query)
-      const { session, state } = await oauthClient.callback(params)
-
-      const agent = new Agent(session)
-      const account = await agent.com.atproto.server.getSession()
-
-      // Create or update account record
-      await createOrUpdateAccount({
-        ...account.data,
-        active: Number(account.data.active)
-      })
-
-      // Create app session and set cookie with session UUID
-      const sessionId = await createSession(session.did)
-      c.cookie.session.set({
-        httpOnly: true,
-        secure: true,
-        secrets: env.AUTH_SECRET,
-        sameSite: 'lax',
-        value: sessionId,
-        maxAge: 7 * 24 * 60 * 60 // 7 days in seconds
-      })
-
-      // Parse state to get redirect URI
-      const returnTo = parseRedirectState(state)
-
-      // Redirect back to client with success
-      return redirect(returnTo)
-    } catch (error) {
-      console.error('OAuth callback error:', error)
-
-      // On error, try to redirect back to client with error
-      const errorRedirect = parseRedirectState(c.query.state)
-      const url = new URL(errorRedirect)
-      url.searchParams.set('error', 'auth_failed')
-
-      // Redirect with error query param
-      return redirect(url.toString())
-    }
-  })
-  .post(
-    '/oauth/logout',
-    async ({ session, cookie }: { session: SessionData; cookie: any }) => {
-      try {
-        // Try to sign out OAuth session (revokes tokens at PDS)
-        const oauthSession = await oauthClient.restore(session.account.did)
-        if (oauthSession) {
-          await oauthSession.signOut()
-        }
-      } catch (error) {
-        // Log but don't fail - app session cleanup is more important
-        console.warn('OAuth signOut failed:', error)
-      }
-
-      // Always delete app session and cookie
-      await deleteSession(session.id)
-      cookie.session.remove()
-
-      return { success: true }
-    },
-    {
-      auth: true
-    }
-  )
-
-export default oauthRoutes

packages/server/src/oauth/storage.ts

···
-import type {
-  NodeSavedSession,
-  NodeSavedSessionStore,
-  NodeSavedState,
-  NodeSavedStateStore
-} from '@atproto/oauth-client-node'
-import type { Db } from '@api/db/db'
-
-export class StateStore implements NodeSavedStateStore {
-  constructor(private db: Db) {}
-
-  async get(key: string): Promise<NodeSavedState | undefined> {
-    const result = await this.db
-      .selectFrom('oauth_states')
-      .selectAll()
-      .where('key', '=', key)
-      .executeTakeFirst()
-    if (!result) return
-    return JSON.parse(result.state) as NodeSavedState
-  }
-
-  async set(key: string, val: NodeSavedState) {
-    const state = JSON.stringify(val)
-    await this.db
-      .insertInto('oauth_states')
-      .values({ key, state })
-      .onConflict((oc) => oc.doUpdateSet({ state }))
-      .execute()
-  }
-
-  async del(key: string) {
-    await this.db.deleteFrom('oauth_states').where('key', '=', key).execute()
-  }
-}
-
-export class SessionStore implements NodeSavedSessionStore {
-  constructor(private db: Db) {}
-
-  async get(key: string): Promise<NodeSavedSession | undefined> {
-    const result = await this.db
-      .selectFrom('oauth_sessions')
-      .selectAll()
-      .where('key', '=', key)
-      .executeTakeFirst()
-    if (!result) return
-    return JSON.parse(result.session) as NodeSavedSession
-  }
-
-  async set(key: string, val: NodeSavedSession) {
-    const session = JSON.stringify(val)
-    await this.db
-      .insertInto('oauth_sessions')
-      .values({ key, session })
-      .onConflict((oc) => oc.doUpdateSet({ session }))
-      .execute()
-  }
-
-  async del(key: string) {
-    await this.db.deleteFrom('oauth_sessions').where('key', '=', key).execute()
-  }
-}

packages/server/src/xrpc/index.ts

···
+export * as AppWafrnContentCreatePost from "./types/app/wafrn/content/createPost.js";
+export * as AppWafrnContentPost from "./types/app/wafrn/content/post.js";

packages/server/src/xrpc/types/app/wafrn/content/createPost.ts

···
+import type {} from "@atcute/lexicons";
+import * as v from "@atcute/lexicons/validations";
+import type {} from "@atcute/lexicons/ambient";
+import * as AppWafrnContentPost from "./post.js";
+import * as ComAtprotoLabelDefs from "@atcute/atproto/types/label/defs";
+
+const _mainSchema = /*#__PURE__*/ v.procedure("app.wafrn.content.createPost", {
+  params: null,
+  input: {
+    type: "lex",
+    schema: /*#__PURE__*/ v.object({
+      contentMarkdown: /*#__PURE__*/ v.string(),
+      contentWarning: /*#__PURE__*/ v.optional(/*#__PURE__*/ v.string()),
+      get labels() {
+        return /*#__PURE__*/ v.optional(
+          /*#__PURE__*/ v.variant([ComAtprotoLabelDefs.selfLabelsSchema]),
+        );
+      },
+      tags: /*#__PURE__*/ v.optional(
+        /*#__PURE__*/ v.array(/*#__PURE__*/ v.string()),
+      ),
+      /**
+       * @default "public"
+       */
+      visibility: /*#__PURE__*/ v.optional(
+        /*#__PURE__*/ v.string<
+          "followers" | "mentioned" | "public" | (string & {})
+        >(),
+        "public",
+      ),
+    }),
+  },
+  output: {
+    type: "lex",
+    schema: /*#__PURE__*/ v.object({
+      get post() {
+        return AppWafrnContentPost.mainSchema;
+      },
+    }),
+  },
+});
+
+type main$schematype = typeof _mainSchema;
+
+export interface mainSchema extends main$schematype {}
+
+export const mainSchema = _mainSchema as mainSchema;
+
+export interface $params {}
+export interface $input extends v.InferXRPCBodyInput<mainSchema["input"]> {}
+export interface $output extends v.InferXRPCBodyInput<mainSchema["output"]> {}
+
+declare module "@atcute/lexicons/ambient" {
+  interface XRPCProcedures {
+    "app.wafrn.content.createPost": mainSchema;
+  }
+}

packages/server/src/xrpc/types/app/wafrn/content/post.ts

···
+import type {} from "@atcute/lexicons";
+import * as v from "@atcute/lexicons/validations";
+import type {} from "@atcute/lexicons/ambient";
+import * as ComAtprotoLabelDefs from "@atcute/atproto/types/label/defs";
+
+const _mainSchema = /*#__PURE__*/ v.record(
+  /*#__PURE__*/ v.tidString(),
+  /*#__PURE__*/ v.object({
+    $type: /*#__PURE__*/ v.literal("app.wafrn.content.post"),
+    get content() {
+      return /*#__PURE__*/ v.variant([
+        postContentSchema,
+        postEncryptedContentSchema,
+      ]);
+    },
+    /**
+     * @default "public"
+     */
+    visibility: /*#__PURE__*/ v.optional(
+      /*#__PURE__*/ v.string<
+        "followers" | "mentioned" | "public" | (string & {})
+      >(),
+      "public",
+    ),
+  }),
+);
+const _postContentSchema = /*#__PURE__*/ v.object({
+  $type: /*#__PURE__*/ v.optional(
+    /*#__PURE__*/ v.literal("app.wafrn.content.post#postContent"),
+  ),
+  contentHTML: /*#__PURE__*/ v.string(),
+  contentMarkdown: /*#__PURE__*/ v.string(),
+  contentWarning: /*#__PURE__*/ v.optional(/*#__PURE__*/ v.string()),
+  createdAt: /*#__PURE__*/ v.datetimeString(),
+  get labels() {
+    return /*#__PURE__*/ v.optional(
+      /*#__PURE__*/ v.variant([ComAtprotoLabelDefs.selfLabelsSchema]),
+    );
+  },
+  tags: /*#__PURE__*/ v.optional(
+    /*#__PURE__*/ v.array(/*#__PURE__*/ v.string()),
+  ),
+  updatedAt: /*#__PURE__*/ v.optional(/*#__PURE__*/ v.datetimeString()),
+});
+const _postEncryptedContentSchema = /*#__PURE__*/ v.object({
+  $type: /*#__PURE__*/ v.optional(
+    /*#__PURE__*/ v.literal("app.wafrn.content.post#postEncryptedContent"),
+  ),
+  encryptedContent: /*#__PURE__*/ v.string(),
+  /**
+   * @minimum 0
+   */
+  keyVersion: /*#__PURE__*/ v.integer(),
+});
+
+type main$schematype = typeof _mainSchema;
+type postContent$schematype = typeof _postContentSchema;
+type postEncryptedContent$schematype = typeof _postEncryptedContentSchema;
+
+export interface mainSchema extends main$schematype {}
+export interface postContentSchema extends postContent$schematype {}
+export interface postEncryptedContentSchema
+  extends postEncryptedContent$schematype {}
+
+export const mainSchema = _mainSchema as mainSchema;
+export const postContentSchema = _postContentSchema as postContentSchema;
+export const postEncryptedContentSchema =
+  _postEncryptedContentSchema as postEncryptedContentSchema;
+
+export interface Main extends v.InferInput<typeof mainSchema> {}
+export interface PostContent extends v.InferInput<typeof postContentSchema> {}
+export interface PostEncryptedContent
+  extends v.InferInput<typeof postEncryptedContentSchema> {}
+
+declare module "@atcute/lexicons/ambient" {
+  interface Records {
+    "app.wafrn.content.post": mainSchema;
+  }
+}

packages/server/tsconfig.json

···
 
     /* Modules */
     "module": "ES2022",
-    "moduleResolution": "node",
+    "moduleResolution": "bundler",
     "types": ["@types/bun"],
     "resolveJsonModule": true,